GLSA-200811-05 : PHP: Multiple vulnerabilities

This script is Copyright (C) 2008-2016 Tenable Network Security, Inc.

Synopsis :

The remote Gentoo host is missing one or more security-related

Description :

The remote host is affected by the vulnerability described in GLSA-200811-05
(PHP: Multiple vulnerabilities)

Several vulnerabilitites were found in PHP:
PHP ships a
vulnerable version of the PCRE library which allows for the
circumvention of security restrictions or even for remote code
execution in case of an application which accepts user-supplied regular
expressions (CVE-2008-0674).
Multiple crash issues in several
PHP functions have been discovered.
Ryan Permeh reported that
the init_request_info() function in sapi/cgi/cgi_main.c does not
properly consider operator precedence when calculating the length of
An off-by-one error in the
metaphone() function may lead to memory corruption.
Maksymilian Arciemowicz of SecurityReason Research reported an
integer overflow, which is triggerable using printf() and related
functions (CVE-2008-1384).
Andrei Nigmatulin reported a
stack-based buffer overflow in the FastCGI SAPI, which has unknown
attack vectors (CVE-2008-2050).
Stefan Esser reported that PHP
does not correctly handle multibyte characters inside the
escapeshellcmd() function, which is used to sanitize user input before
its usage in shell commands (CVE-2008-2051).
Stefan Esser
reported that a short-coming in PHP's algorithm of seeding the random
number generator might allow for predictible random numbers
(CVE-2008-2107, CVE-2008-2108).
The IMAP extension in PHP uses
obsolete c-client API calls making it vulnerable to buffer overflows as
no bounds checking can be done (CVE-2008-2829).
Tavis Ormandy
reported a heap-based buffer overflow in pcre_compile.c in the PCRE
version shipped by PHP when processing user-supplied regular
expressions (CVE-2008-2371).
CzechSec reported that specially
crafted font files can lead to an overflow in the imageloadfont()
function in ext/gd/gd.c, which is part of the GD extension
Maksymilian Arciemowicz of SecurityReason
Research reported that a design error in PHP's stream wrappers allows
to circumvent safe_mode checks in several filesystem-related PHP
functions (CVE-2008-2665, CVE-2008-2666).
Laurent Gaffie
discovered a buffer overflow in the internal memnstr() function, which
is used by the PHP function explode() (CVE-2008-3659).
error in the FastCGI SAPI when processing a request with multiple dots
preceding the extension (CVE-2008-3660).

Impact :

These vulnerabilities might allow a remote attacker to execute
arbitrary code, to cause a Denial of Service, to circumvent security
restrictions, to disclose information, and to manipulate files.

Workaround :

There is no known workaround at this time.

See also :

Solution :

All PHP users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose '>=dev-lang/php-5.2.6-r6'

Risk factor :

Critical / CVSS Base Score : 10.0
CVSS Temporal Score : 10.0
Public Exploit Available : false

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now