Alpine: php: security update to 5.6.27-r0

critical Tenable Cloud Security Plugin ID 406289

Description

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

- ext/spl/spl_array.c in PHP before 5.6.26 and 7.x before 7.0.11 proceeds with SplArray unserialization
without validating a return value and data type, which allows remote attackers to cause a denial of
service or possibly have unspecified other impact via crafted serialized data. (CVE-2016-7417)

- ext/standard/var_unserializer.re in PHP before 5.6.26 mishandles object-deserialization failures, which
allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified
other impact via an unserialize call that references a partially constructed object. (CVE-2016-7411)

- ext/mysqlnd/mysqlnd_wireprotocol.c in PHP before 5.6.26 and 7.x before 7.0.11 does not verify that a BIT
field has the UNSIGNED_FLAG flag, which allows remote MySQL servers to cause a denial of service (heap-
based buffer overflow) or possibly have unspecified other impact via crafted field metadata.
(CVE-2016-7412)

- Use-after-free vulnerability in the wddx_stack_destroy function in ext/wddx/wddx.c in PHP before 5.6.26
and 7.x before 7.0.11 allows remote attackers to cause a denial of service or possibly have unspecified
other impact via a wddxPacket XML document that lacks an end-tag for a recordset field element, leading to
mishandling in a wddx_deserialize call. (CVE-2016-7413)

- The ZIP signature-verification feature in PHP before 5.6.26 and 7.x before 7.0.11 does not ensure that the
uncompressed_filesize field is large enough, which allows remote attackers to cause a denial of service
(out-of-bounds memory access) or possibly have unspecified other impact via a crafted PHAR archive,
related to ext/phar/util.c and ext/phar/zip.c. (CVE-2016-7414)

Plugin Details

Severity: Critical

ID: 406289

Version: Revision 1.24

Type: Local

Family: Alpine Linux Local Security Checks

Published: 10/31/2023

Updated: 3/13/2025

Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 5.9

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2016-7417

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Vulnerability Publication Date: 8/16/2016

Reference Information

CVE: CVE-2016-7411, CVE-2016-7412, CVE-2016-7413, CVE-2016-7414, CVE-2016-7416, CVE-2016-7417, CVE-2016-7418

BID: 93004, 93005, 93006, 93007, 93008, 93009, 93011

IAVB: 2016-B-0143-S

Detections

Analytics