The unserialize implementation in ext/standard/var.c in PHP 7.x before 7.0.14 allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted serialized data. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-6834.

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:1296 advisory.

  - php: Heap overflow in mysqlnd when not receiving UNSIGNED_FLAG in BIT field (CVE-2016-7412)

  - php: Use after free in wddx_deserialize (CVE-2016-7413)

  - php: Out of bounds heap read when verifying signature of zip phar in phar_parse_zipfile (CVE-2016-7414)

  - php: Stack based buffer overflow in msgfmt_format_message (CVE-2016-7416)

  - php: Missing type check when unserializing SplArray (CVE-2016-7417)

  - php: Null pointer dereference in php_wddx_push_element (CVE-2016-7418)

  - php: Use-after-free vulnerability when resizing the 'properties' hash table of a serialized object     (CVE-2016-7479)

  - php, gd: Stack overflow in gdImageFillToBorder on truecolor images (CVE-2016-9933)

  - php: NULL Pointer Dereference in WDDX Packet Deserialization with PDORow (CVE-2016-9934)

  - php: Invalid read when wddx decodes empty boolean element (CVE-2016-9935)

  - php: Use After Free in unserialize() (CVE-2016-9936)

  - php: Wrong calculation in exif_convert_any_to_int function (CVE-2016-10158)

  - php: Integer overflow in phar_parse_pharfile (CVE-2016-10159)

  - php: Off-by-one error in phar_parse_pharfile when loading crafted phar archive (CVE-2016-10160)

  - php: Out-of-bounds heap read on unserialize in finish_nested_data() (CVE-2016-10161)

  - php: Null pointer dereference when unserializing PHP object (CVE-2016-10162)

  - gd: DoS vulnerability in gdImageCreateFromGd2Ctx() (CVE-2016-10167)

  - gd: Integer overflow in gd_io.c (CVE-2016-10168)

  - php: Use of uninitialized memory in unserialize() (CVE-2017-5340)

  - php: Buffer over-read from unitialized data in gdImageCreateFromGifCtx function (CVE-2017-7890)

  - oniguruma: Out-of-bounds stack read in match_at() during regular expression searching (CVE-2017-9224)

  - oniguruma: Heap buffer overflow in next_state_val() during regular expression compilation (CVE-2017-9226)

  - oniguruma: Out-of-bounds stack read in mbc_enc_len() during regular expression searching (CVE-2017-9227)

  - oniguruma: Out-of-bounds heap write in bitset_set_range() (CVE-2017-9228)

  - oniguruma: Invalid pointer dereference in left_adjust_char_head() (CVE-2017-9229)

  - php: Incorrect WDDX deserialization of boolean parameters leads to DoS (CVE-2017-11143)

  - php: Incorrect return value check of OpenSSL sealing function leads to crash (CVE-2017-11144)

  - php: wddx_deserialize() heap out-of-bound read via php_parse_date() (CVE-2017-11145)

  - php: Out-of-bounds read in phar_parse_pharfile (CVE-2017-11147)

  - php: Stack-based buffer over-read in msgfmt_parse_message function (CVE-2017-11362)

  - php: Stack based 1-byte buffer over-write in zend_ini_do_op() function Zend/zend_ini_parser.c     (CVE-2017-11628)

  - php: Heap use after free in ext/standard/var_unserializer.re (CVE-2017-12932)

  - php: buffer over-read in finish_nested_data function (CVE-2017-12933)

  - php: heap use after free in ext/standard/var_unserializer.re (CVE-2017-12934)

  - php: Out-of-bound read in timelib_meridian() (CVE-2017-16642)

  - gd: Infinite loop in gdImageCreateFromGifCtx() in gd_gif_in.c (CVE-2018-5711)

  - php: Reflected XSS on PHAR 404 page (CVE-2018-5712)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its banner, the version of PHP running on the remote web server is 7.1.x prior to 7.1.0. It is, therefore, affected by the following vulnerabilities:

  - A stack consumption condition exists in the     gdImageFillToBorder function of the gd.c script within     the GD Graphics Library (libgd). An unauthenticated,     remote attacker can exploit this issue, via a crafted     call to imagefilltoborder using a negative color value,     to cause the application to stop responding.
    (CVE-2016-9933)

  - A denial of service (DoS) vulnerability exists in the     ext/wddx/wddx.c script. An unauthenticated, remote     attacker can exploit this issue, via crafted serialized     data in a wddxPacket XML document, to cause the     application to stop responding. (CVE-2016-9934)

  - A deserialization vulnerability exists in the     ext/standard/var.c script. An unauthenticated, remote     attacker can exploit this, via crafted serialized data,     to the application to stop responding or execute     arbitrary code on the target host. (CVE-2016-9936)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its banner, the version of PHP running on the remote web server is 7.0.x prior to 7.0.14. It is, therefore, affected by a remote code execution vulnerability due to a memory corruption issue in the php_wddx_push_element() function in ext/wddx/wddx.c that occurs when decoding empty boolean elements. An unauthenticated, remote attacker can exploit this to cause a denial of service condition or the execution of arbitrary code.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for php7 fixes the following issues :

  - CVE-2016-9933 Possible stack overflow on truecolor     images handling [bsc#1015187]

  - CVE-2016-9934 Dereference from NULL pointer could lead     to crash [bsc#1015188]

  - CVE-2016-9935 Invalid read could lead to crash     [bsc#1015189]

  - CVE-2016-9936 Use After free in the function serialize()     could lead to crash [bsc#1015191]

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

USN-3211-1 fixed vulnerabilities in PHP by updating to the new 7.0.15 upstream release. PHP 7.0.15 introduced a regression when using MySQL with large blobs. This update fixes the problem with a backported fix.

It was discovered that PHP incorrectly handled certain invalid objects when unserializing data. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2016-7479)

It was discovered that PHP incorrectly handled certain invalid objects when unserializing data. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code.
(CVE-2016-9137)

It was discovered that PHP incorrectly handled unserializing certain wddxPacket XML documents. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code.
(CVE-2016-9935)

It was discovered that PHP incorrectly handled certain invalid objects when unserializing data. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code.
(CVE-2016-9936)

It was discovered that PHP incorrectly handled certain EXIF data. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service. (CVE-2016-10158)

It was discovered that PHP incorrectly handled certain PHAR archives. A remote attacker could use this issue to cause PHP to crash or consume resources, resulting in a denial of service. (CVE-2016-10159)

It was discovered that PHP incorrectly handled certain PHAR archives. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2016-10160)

It was discovered that PHP incorrectly handled certain invalid objects when unserializing data. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service. (CVE-2016-10161)

It was discovered that PHP incorrectly handled unserializing certain wddxPacket XML documents. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service. (CVE-2016-10162)

It was discovered that PHP incorrectly handled certain invalid objects when unserializing data. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code.
(CVE-2017-5340).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that PHP incorrectly handled certain invalid objects when unserializing data. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2016-7479)

It was discovered that PHP incorrectly handled certain invalid objects when unserializing data. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2016-9137)

It was discovered that PHP incorrectly handled unserializing certain wddxPacket XML documents. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2016-9935)

It was discovered that PHP incorrectly handled certain invalid objects when unserializing data. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2016-9936)

It was discovered that PHP incorrectly handled certain EXIF data. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service. (CVE-2016-10158)

It was discovered that PHP incorrectly handled certain PHAR archives.
A remote attacker could use this issue to cause PHP to crash or consume resources, resulting in a denial of service. (CVE-2016-10159)

It was discovered that PHP incorrectly handled certain PHAR archives.
A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code.
(CVE-2016-10160)

It was discovered that PHP incorrectly handled certain invalid objects when unserializing data. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service. (CVE-2016-10161)

It was discovered that PHP incorrectly handled unserializing certain wddxPacket XML documents. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service. (CVE-2016-10162)

It was discovered that PHP incorrectly handled certain invalid objects when unserializing data. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2017-5340).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The SplObjectStorage unserialize implementation in ext/spl/spl_observer.c in PHP before 7.0.12 does not verify that a key is an object, which allows remote attackers to execute arbitrary code or cause a denial of service (uninitialized memory access) via crafted serialized data. (CVE-2016-7480)

Use-after-free vulnerability in the CURLFile implementation in ext/curl/curl_file.c in PHP 7.x before 7.0.12 allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted serialized data that is mishandled during __wakeup processing. (CVE-2016-9137)

Stack consumption vulnerability in the gdImageFillToBorder function in gd.c in the GD Graphics Library (aka libgd) before 2.2.2, as used in PHP 7.x before 7.0.13, allows remote attackers to cause a denial of service (segmentation violation) via a crafted imagefilltoborder call that triggers use of a negative color value. (CVE-2016-9933)

ext/wddx/wddx.c in PHP 7.x before 7.0.13 allows remote attackers to cause a denial of service (NULL pointer dereference) via crafted serialized data in a wddxPacket XML document, as demonstrated by a PDORow string. (CVE-2016-9934)

The php_wddx_push_element function in ext/wddx/wddx.c in PHP 7.x before 7.0.14 allows remote attackers to cause a denial of service (out-of-bounds read and memory corruption) or possibly have unspecified other impact via an empty boolean element in a wddxPacket XML document. (CVE-2016-9935)

The unserialize implementation in ext/standard/var.c in PHP 7.x before 7.0.14 allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted serialized data. This vulnerability exists because of an incomplete fix for CVE-2015-6834 . (CVE-2016-9936)

This update for php7 fixes the following issues :

  - CVE-2016-9933 Possible stack overflow on truecolor     images handling [bsc#1015187]

  - CVE-2016-9934 Dereference from NULL pointer could lead     to crash [bsc#1015188]

  - CVE-2016-9935 Invalid read could lead to crash     [bsc#1015189]

  - CVE-2016-9936 Use After free in the function serialize()     could lead to crash [bsc#1015191]

This update was imported from the SUSE:SLE-12:Update update project.

The PHP project reports :

- Use After Free Vulnerability in unserialize() (CVE-2016-9936)

- Invalid read when wddx decodes empty boolean element (CVE-2016-9935)

Versions of PHP 7.0.x prior to 7.0.14 are vulnerable to a use-after-free error in the 'unserialize()' function in 'ext/standard/var.c'. This may allow a remote attacker to dereference already freed memory and potentially execute arbitrary code.

According to its banner, the version of PHP running on the remote web server is 7.0.x prior to 7.0.14. It is, therefore, affected by the following vulnerabilities:

  -  A remote code execution vulnerability due to a memory      corruption issue in the php_wddx_push_element()      function in ext/wddx/wddx.c that occurs when decoding      empty boolean elements. An unauthenticated, remote      attacker can exploit this to cause a denial of service      condition or the execution of arbitrary code.
     (CVE-2016-9935)

  - A deserialization vulnerability exists in the     ext/standard/var.c script. An unauthenticated, remote     attacker can exploit this, via crafted serialized data,     to the application to stop responding or execute     arbitrary code on the target host. (CVE-2016-9936)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
194027	RHEL 6 / 7 : rh-php70-php (RHSA-2018:1296)	Nessus	Red Hat Local Security Checks	critical
122540	PHP 7.1.x < 7.1.0 Multiple Vulnerabilities.	Nessus	CGI abuses	critical
98838	PHP 7.0.x < 7.0.14 php_wddx_push_element() Function Empty Boolean Element Decoding RCE	Web App Scanning	Component Vulnerability	critical
119989	SUSE SLES12 Security Update : php7 (SUSE-SU-2017:0017-1)	Nessus	SuSE Local Security Checks	critical
97521	Ubuntu 16.04 LTS : PHP regression (USN-3211-2)	Nessus	Ubuntu Local Security Checks	critical
97384	Ubuntu 16.04 LTS : PHP vulnerabilities (USN-3211-1)	Nessus	Ubuntu Local Security Checks	critical
96806	Amazon Linux AMI : php70 (ALAS-2017-788)	Nessus	Amazon Linux Local Security Checks	critical
96380	openSUSE Security Update : php7 (openSUSE-2017-61)	Nessus	SuSE Local Security Checks	critical
96221	FreeBSD : PHP -- multiple vulnerabilities (6972668d-cdb7-11e6-a9a5-b499baebfeaf)	Nessus	FreeBSD Local Security Checks	critical
9842	PHP 7.0.x < 7.0.14 RCE	Nessus Network Monitor	Web Servers	high
95875	PHP 7.0.x < 7.0.14 Multiple Vulnerabilities	Nessus	CGI abuses	critical

Detections

Analytics

CVE-2016-9936

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

high

critical