openSUSE-SU-2016:3239

openSUSE-SU-2017:0061

openSUSE-SU-2017:0081

[oss-security] 20161212 CVE assignment for PHP 5.6.28, 5.6.29, 7.0.13, 7.0.14 and 7.1.0

http://www.php.net/ChangeLog-5.php

http://www.php.net/ChangeLog-7.php

94845

RHSA-2018:1296

https://bugs.php.net/bug.php?id=73331

https://github.com/php/php-src/commit/6045de69c7dedcba3eadf7c4bba424b19c81d00d

According to its banner, the version of PHP running on the remote web server is 7.1.x prior to 7.1.0. It is, therefore, affected by the following vulnerabilities:

  - A stack consumption condition exists in the     gdImageFillToBorder function of the gd.c script within     the GD Graphics Library (libgd). An unauthenticated,     remote attacker can exploit this issue, via a crafted     call to imagefilltoborder using a negative color value,     to cause the application to stop responding.
    (CVE-2016-9933)

  - A denial of service (DoS) vulnerability exists in the     ext/wddx/wddx.c script. An unauthenticated, remote     attacker can exploit this issue, via crafted serialized     data in a wddxPacket XML document, to cause the     application to stop responding. (CVE-2016-9934)

  - A deserialization vulnerability exists in the     ext/standard/var.c script. An unauthenticated, remote     attacker can exploit this, via crafted serialized data,     to the application to stop responding or execute     arbitrary code on the target host. (CVE-2016-9936)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its banner, the version of PHP running on the remote web server is 7.0.x prior to 7.0.13. It is, therefore, affected by multiple vulnerabilities :

 - A flaw exists in the parse_url() function due to returning the incorrect host. An unauthenticated, remote attacker can exploit this to have a multiple impacts depending on how the function is implemented, which can include bypassing authentication or conducting open redirection and server-side
request forgery attacks.

 - An integer overflow condition exists in the _php_imap_mail() function in file ext/imap/php_imap.c when handling overly long strings. An unauthenticated, remote attacker can exploit this to cause a heap-based buffer overflow, resulting in a denial of service condition or the execution of arbitrary
code.

 - An integer overflow condition exists in the gdImageAALine() function within file ext/gd/libgd/gd.c due to improper validation of line limit values. An unauthenticated, remote attacker can exploit this to cause an out-of-bounds memory read or write, resulting in a denial of service condition, the
disclosure of memory contents, or the execution of arbitrary code.

 Note that this software is reportedly affected by other vulnerabilities as well that have not been fixed yet in version 7.0.13.

According to its banner, the version of PHP running on the remote web server is 5.6.x prior to 5.6.28. It is, therefore, affected by multiple vulnerabilities :

 - A flaw exists in the parse_url() function due to returning the incorrect host. An unauthenticated, remote attacker can exploit this to have a multiple impacts depending on how the function is implemented, which can include bypassing authentication or conducting open redirection and server-side
request forgery attacks.

 - An integer overflow condition exists in the _php_imap_mail() function in file ext/imap/php_imap.c when handling overly long strings. An unauthenticated, remote attacker can exploit this to cause a heap-based buffer overflow, resulting in a denial of service condition or the execution of arbitrary
code.

 - A flaw exists in the bzcompress() function when handling overly long strings. An unauthenticated, remote attacker can exploit this to cause a denial of service condition.

 - An integer overflow condition exists in the gdImageAALine() function within file ext/gd/libgd/gd.c due to improper validation of line limit values. An unauthenticated, remote attacker can exploit this to cause an out-of-bounds memory read or write, resulting in a denial of service condition, the
disclosure of memory contents, or the execution of arbitrary code.

 Note that the scanner has not attempted to exploit this issue but has instead relied only on the application's self-reported version number.

This update for php5 fixes the following issues :

  - CVE-2016-9933 Possible stack overflow on truecolor     images handling [bsc#1015187]

  - CVE-2016-9934 Dereference from NULL pointer could lead     to crash [bsc#1015188]

  - CVE-2016-9935 Invalid read could lead to crash     [bsc#1015189]

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for php7 fixes the following issues :

  - CVE-2016-9933 Possible stack overflow on truecolor     images handling [bsc#1015187]

  - CVE-2016-9934 Dereference from NULL pointer could lead     to crash [bsc#1015188]

  - CVE-2016-9935 Invalid read could lead to crash     [bsc#1015189]

  - CVE-2016-9936 Use After free in the function serialize()     could lead to crash [bsc#1015191]

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for php5 fixes the following issues :

  - CVE-2016-9933 Possible stack overflow on truecolor     images handling [bsc#1015187]

  - CVE-2016-9934 Dereference from NULL pointer could lead     to crash [bsc#1015188]

  - CVE-2016-9935 Invalid read could lead to crash     [bsc#1015189]

This update was imported from the SUSE:SLE-12:Update update project.

It was discovered that PHP incorrectly handled certain arguments to the locale_get_display_name function. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2014-9912)

It was discovered that PHP incorrectly handled certain invalid objects when unserializing data. A remote attacker could use this issue to cause PHP to hang, resulting in a denial of service. (CVE-2016-7478)

It was discovered that PHP incorrectly handled certain invalid objects when unserializing data. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2016-7479)

It was discovered that PHP incorrectly handled certain invalid objects when unserializing data. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only applied to Ubuntu 14.04 LTS.
(CVE-2016-9137)

It was discovered that PHP incorrectly handled unserializing certain wddxPacket XML documents. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service. (CVE-2016-9934)

It was discovered that PHP incorrectly handled unserializing certain wddxPacket XML documents. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2016-9935)

It was discovered that PHP incorrectly handled certain EXIF data. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service. (CVE-2016-10158)

It was discovered that PHP incorrectly handled certain PHAR archives.
A remote attacker could use this issue to cause PHP to crash or consume resources, resulting in a denial of service. (CVE-2016-10159)

It was discovered that PHP incorrectly handled certain PHAR archives.
A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code.
(CVE-2016-10160)

It was discovered that PHP incorrectly handled certain invalid objects when unserializing data. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service. (CVE-2016-10161).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several issues have been discovered in PHP (recursive acronym for PHP:
Hypertext Preprocessor), a widely-used open source general-purpose scripting language that is especially suited for web development and can be embedded into HTML.

  - CVE-2016-2554 Stack-based buffer overflow in     ext/phar/tar.c allows remote attackers to cause a denial     of service (application crash) or possibly have     unspecified other impact via a crafted TAR archive.

  - CVE-2016-3141 Use-after-free vulnerability in wddx.c in     the WDDX extension allows remote attackers to cause a     denial of service (memory corruption and application     crash) or possibly have unspecified other impact by     triggering a wddx_deserialize call on XML data     containing a crafted var element.

  - CVE-2016-3142 The phar_parse_zipfile function in zip.c     in the PHAR extension in PHP before 5.5.33 and 5.6.x     before 5.6.19 allows remote attackers to obtain     sensitive information from process memory or cause a     denial of service (out-of-bounds read and application     crash) by placing a PK\x05\x06 signature at an invalid     location.

  - CVE-2016-4342 ext/phar/phar_object.c in PHP before     5.5.32, 5.6.x before 5.6.18, and 7.x before 7.0.3     mishandles zero-length uncompressed data, which allows     remote attackers to cause a denial of service (heap     memory corruption) or possibly have unspecified other     impact via a crafted (1) TAR, (2) ZIP, or (3) PHAR     archive.

  - CVE-2016-9934 ext/wddx/wddx.c in PHP before 5.6.28 and     7.x before 7.0.13 allows remote attackers to cause a     denial of service (NULL pointer dereference) via crafted     serialized data in a wddxPacket XML document, as     demonstrated by a PDORow string.

  - CVE-2016-9935 The php_wddx_push_element function in     ext/wddx/wddx.c in PHP before 5.6.29 and 7.x before     7.0.14 allows remote attackers to cause a denial of     service (out-of-bounds read and memory corruption) or     possibly have unspecified other impact via an empty     boolean element in a wddxPacket XML document.

  - CVE-2016-10158 The exif_convert_any_to_int function in     ext/exif/exif.c in PHP before 5.6.30, 7.0.x before     7.0.15, and 7.1.x before 7.1.1 allows remote attackers     to cause a denial of service (application crash) via     crafted EXIF data that triggers an attempt to divide the     minimum representable negative integer by -1.

  - CVE-2016-10159 Integer overflow in the     phar_parse_pharfile function in ext/phar/phar.c in PHP     before 5.6.30 and 7.0.x before 7.0.15 allows remote     attackers to cause a denial of service (memory     consumption or application crash) via a truncated     manifest entry in a PHAR archive.

  - CVE-2016-10160 Off-by-one error in the     phar_parse_pharfile function in ext/phar/phar.c in PHP     before 5.6.30 and 7.0.x before 7.0.15 allows remote     attackers to cause a denial of service (memory     corruption) or possibly execute arbitrary code via a     crafted PHAR archive with an alias mismatch.

  - CVE-2016-10161 The object_common1 function in     ext/standard/var_unserializer.c in PHP before 5.6.30,     7.0.x before 7.0.15, and 7.1.x before 7.1.1 allows     remote attackers to cause a denial of service (buffer     over-read and application crash) via crafted serialized     data that is mishandled in a finish_nested_data call.

  - BUG-71323.patch Output of stream_get_meta_data can be     falsified by its input

  - BUG-70979.patch Crash on bad SOAP request

  - BUG-71039.patch exec functions ignore length but look     for NULL termination

  - BUG-71459.patch Integer overflow in iptcembed()

  - BUG-71391.patch NULL pointer Dereference in     phar_tar_setupmetadata()

  - BUG-71335.patch Type confusion vulnerability in WDDX     packet deserialization

For Debian 7 'Wheezy', these problems have been fixed in version 5.4.45-0+deb7u7.

We recommend that you upgrade your php5 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The SplObjectStorage unserialize implementation in ext/spl/spl_observer.c in PHP before 7.0.12 does not verify that a key is an object, which allows remote attackers to execute arbitrary code or cause a denial of service (uninitialized memory access) via crafted serialized data. (CVE-2016-7480)

Use-after-free vulnerability in the CURLFile implementation in ext/curl/curl_file.c in PHP 7.x before 7.0.12 allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted serialized data that is mishandled during __wakeup processing. (CVE-2016-9137)

Stack consumption vulnerability in the gdImageFillToBorder function in gd.c in the GD Graphics Library (aka libgd) before 2.2.2, as used in PHP 7.x before 7.0.13, allows remote attackers to cause a denial of service (segmentation violation) via a crafted imagefilltoborder call that triggers use of a negative color value. (CVE-2016-9933)

ext/wddx/wddx.c in PHP 7.x before 7.0.13 allows remote attackers to cause a denial of service (NULL pointer dereference) via crafted serialized data in a wddxPacket XML document, as demonstrated by a PDORow string. (CVE-2016-9934)

The php_wddx_push_element function in ext/wddx/wddx.c in PHP 7.x before 7.0.14 allows remote attackers to cause a denial of service (out-of-bounds read and memory corruption) or possibly have unspecified other impact via an empty boolean element in a wddxPacket XML document. (CVE-2016-9935)

The unserialize implementation in ext/standard/var.c in PHP 7.x before 7.0.14 allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted serialized data. This vulnerability exists because of an incomplete fix for CVE-2015-6834 . (CVE-2016-9936)

A vulnerability was found in gd. Integer underflow in a calculation in dynamicGetbuf() was incorrectly handled, leading in some circumstances to an out of bounds write through a very large argument to memcpy().
An attacker could create a crafted image that would lead to a crash or, potentially, code execution. (CVE-2016-8670)

Use-after-free vulnerability in the CURLFile implementation in ext/curl/curl_file.c in PHP before 5.6.27 allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted serialized data that is mishandled during __wakeup processing. (CVE-2016-9137)

Stack consumption vulnerability in the gdImageFillToBorder function in gd.c in the GD Graphics Library (aka libgd) before 2.2.2, as used in PHP before 5.6.28, allows remote attackers to cause a denial of service (segmentation violation) via a crafted imagefilltoborder call that triggers use of a negative color value. (CVE-2016-9933)

ext/wddx/wddx.c in PHP before 5.6.28 allows remote attackers to cause a denial of service (NULL pointer dereference) via crafted serialized data in a wddxPacket XML document, as demonstrated by a PDORow string.
(CVE-2016-9934)

The php_wddx_push_element function in ext/wddx/wddx.c in PHP before 5.6.29 allows remote attackers to cause a denial of service (out-of-bounds read and memory corruption) or possibly have unspecified other impact via an empty boolean element in a wddxPacket XML document. (CVE-2016-9935)

The remote host is running a version of macOS that is 10.12.x prior to 10.12.3. It is, therefore, affected by multiple vulnerabilities in the following components :

  - apache_mod_php
  - Bluetooth
  - Graphics Drivers
  - Help Viewer
  - IOAudioFamily
  - Kernel
  - libarchive
  - Vim
  - WebKit

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

This update for php53 fixes the following issues :

  - CVE-2014-9912: Stack-based buffer overflow in     uloc_getDisplayName() [bsc#1012232]

  - CVE-2016-9933: Possible stack overflow on truecolor     images handling [bsc#1015187]

  - CVE-2016-9934: Dereference from NULL pointer could lead     to crash [bsc#1015188]

  - CVE-2016-9935: Invalid read could lead to crash     [bsc#1015189]

  - Buffer overflow in libmagic, allowing attackers to crash     the PHP interpreter [bsc#974305]

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for php7 fixes the following issues :

  - CVE-2016-9933 Possible stack overflow on truecolor     images handling [bsc#1015187]

  - CVE-2016-9934 Dereference from NULL pointer could lead     to crash [bsc#1015188]

  - CVE-2016-9935 Invalid read could lead to crash     [bsc#1015189]

  - CVE-2016-9936 Use After free in the function serialize()     could lead to crash [bsc#1015191]

This update was imported from the SUSE:SLE-12:Update update project.

This security update for php5 fixes the following issues :

  - a call to ImageFillToBorder() could cause a stack     overflow leading to stack exhaustion when the image used     was not truecolor (CVE-2016-9933, boo#1015187)

  - deserialization of a WDDX packet containing a PDORow     object could crash php (CVE-2016-9934, boo#1015188)

  - deserialization of a WDDX packet containing an empty     boolean element could crash php (CVE-2016-9935,     boo#1015189)

Several vulnerabilities were found in PHP, a general-purpose scripting language commonly used for web application development.

The vulnerabilities are addressed by upgrading PHP to the new upstream version 5.6.28, which includes additional bug fixes. Please refer to the upstream changelog for more information :

  https://secure.php.net/ChangeLog-5.php#5.6.28

New php packages are available for Slackware 14.0, 14.1, 14.2, and
-current to fix security issues.

According to its banner, the version of PHP running on the remote web server is 7.0.x prior to 7.0.13. It is, therefore, affected by multiple vulnerabilities :

  - A stack consumption condition exists in the     gdImageFillToBorder function of the gd.c script within     the GD Graphics Library (libgd). An unauthenticated,     remote attacker can exploit this issue, via a crafted     call to imagefilltoborder using a negative color value,     to cause the application to stop responding.
    (CVE-2016-9933)

  - A denial of service (DoS) vulnerability exists in the     ext/wddx/wddx.c script. An unauthenticated, remote     attacker can exploit this issue, via crafted serialized     data in a wddxPacket XML document, to cause the     application to stop responding. (CVE-2016-9934)

  - A flaw exists in the parse_url() function due to     returning the incorrect host. An unauthenticated, remote     attacker can exploit this to have a multiple impacts     depending on how the function is implemented, which can     include bypassing authentication or conducting open     redirection and server-side request forgery attacks.

  - An integer overflow condition exists in the
    _php_imap_mail() function in file ext/imap/php_imap.c     when handling overly long strings. An unauthenticated,     remote attacker can exploit this to cause a     heap-based buffer overflow, resulting in a denial of     service condition or the execution of arbitrary code.

  - An integer overflow condition exists in the     gdImageAALine() function within file ext/gd/libgd/gd.c     due to improper validation of line limit values. An     unauthenticated, remote attacker can exploit this to     cause an out-of-bounds memory read or write, resulting     in a denial of service condition, the disclosure of     memory contents, or the execution of arbitrary code.

Note that this software is reportedly affected by other vulnerabilities as well that have not been fixed yet in version 7.0.13.

According to its banner, the version of PHP running on the remote web server is 5.6.x prior to 5.6.28. It is, therefore, affected by multiple vulnerabilities :

  - A flaw exists in the parse_url() function due to     returning the incorrect host. An unauthenticated, remote     attacker can exploit this to have a multiple impacts     depending on how the function is implemented, which can     include bypassing authentication or conducting open     redirection and server-side request forgery attacks.

  - An integer overflow condition exists in the
    _php_imap_mail() function in file ext/imap/php_imap.c     when handling overly long strings. An unauthenticated,     remote attacker can exploit this to cause a     heap-based buffer overflow, resulting in a denial of     service condition or the execution of arbitrary code.

  - A flaw exists in the bzcompress() function when handling     overly long strings. An unauthenticated, remote attacker     can exploit this to cause a denial of service condition.

  - An integer overflow condition exists in the     gdImageAALine() function within file ext/gd/libgd/gd.c     due to improper validation of line limit values. An     unauthenticated, remote attacker can exploit this to     cause an out-of-bounds memory read or write, resulting     in a denial of service condition, the disclosure of     memory contents, or the execution of arbitrary code.

  - A denial of service flaw exists due to a flaw in     Zend/zend_exceptions.c via a crafted Exception object     in serialized data (CVE-2016-7478)

  - A Stack consumption vulnerability in the     gdImageFillToBorder function in gd.c in the GD Graphics     Library could lead to a denial of service condition.
    (CVE-2016-9933)

  - A denial of service flaw exists due to a flaw in     ext/wddx/wddx.c via a crafted serialized data in a     wddxPacket XML document. (CVE-2016-9934)

Note that this software is reportedly affected by other vulnerabilities as well that have not been fixed yet in version 5.6.28.

ID	Name	Product	Family	Severity
122540	PHP 7.1.x < 7.1.0 Multiple Vulnerabilities.	Nessus	CGI abuses	high
98837	PHP 7.0.x < 7.0.13 Multiple Vulnerabilities	Web Application Scanning	Component Vulnerability	medium
98818	PHP 5.6.x < 5.6.28 Multiple Vulnerabilities	Web Application Scanning	Component Vulnerability	medium
119990	SUSE SLES12 Security Update : php5 (SUSE-SU-2017:0038-1)	Nessus	SuSE Local Security Checks	high
119989	SUSE SLES12 Security Update : php7 (SUSE-SU-2017:0017-1)	Nessus	SuSE Local Security Checks	high
97566	openSUSE Security Update : php5 (openSUSE-2017-308)	Nessus	SuSE Local Security Checks	high
97190	Ubuntu 12.04 LTS / 14.04 LTS : php5 vulnerabilities (USN-3196-1)	Nessus	Ubuntu Local Security Checks	high
97052	Debian DLA-818-1 : php5 security update	Nessus	Debian Local Security Checks	critical
96806	Amazon Linux AMI : php70 (ALAS-2017-788)	Nessus	Amazon Linux Local Security Checks	high
96805	Amazon Linux AMI : php56 (ALAS-2017-787)	Nessus	Amazon Linux Local Security Checks	high
96731	macOS 10.12.x < 10.12.3 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	critical
96431	SUSE SLES11 Security Update : php53 (SUSE-SU-2017:0109-1)	Nessus	SuSE Local Security Checks	high
96381	openSUSE Security Update : php5 (openSUSE-2017-62)	Nessus	SuSE Local Security Checks	high
96380	openSUSE Security Update : php7 (openSUSE-2017-61)	Nessus	SuSE Local Security Checks	high
96130	openSUSE Security Update : php5 (openSUSE-2016-1505)	Nessus	SuSE Local Security Checks	high
95776	Debian DSA-3732-1 : php5 - security update	Nessus	Debian Local Security Checks	high
95725	Slackware 14.0 / 14.1 / 14.2 / current : php (SSA:2016-347-03)	Nessus	Slackware Local Security Checks	high
94956	PHP 7.0.x < 7.0.13 Multiple Vulnerabilities	Nessus	CGI abuses	critical
94955	PHP 5.6.x < 5.6.28 Multiple Vulnerabilities	Nessus	CGI abuses	medium

CVE-2016-9934

Description

References

Details

Risk Information

CVSS v2.0

CVSS v3.0

Vulnerable Software

Configuration 1

Tenable Plugins