FreeBSD : php -- multiple vulnerabilities (39a25a63-eb5c-11de-b650-00215c6a37bb)

This script is Copyright (C) 2009-2016 Tenable Network Security, Inc.


Synopsis :

The remote FreeBSD host is missing a security-related update.

Description :

PHP developers reports :

This release focuses on improving the stability of the PHP 5.2.x
branch with over 60 bug fixes, some of which are security related. All
users of PHP 5.2 are encouraged to upgrade to this release.

Security Enhancements and Fixes in PHP 5.2.12 :

- Fixed a safe_mode bypass in tempnam() identified by Grzegorz
Stachowiak. (CVE-2009-3557, Rasmus)

- Fixed a open_basedir bypass in posix_mkfifo() identified by Grzegorz
Stachowiak. (CVE-2009-3558, Rasmus)

- Added 'max_file_uploads' INI directive, which can be set to limit
the number of file uploads per-request to 20 by default, to prevent
possible DOS via temporary file exhaustion, identified by Bogdan
Calin. (CVE-2009-4017, Ilia)

- Added protection for $_SESSION from interrupt corruption and
improved 'session.save_path' check, identified by Stefan Esser.
(CVE-2009-4143, Stas)

- Fixed bug #49785 (insufficient input string validation of
htmlspecialchars()). (CVE-2009-4142, Moriyoshi, hello at iwamot dot
com)

See also :

http://www.php.net/releases/5_2_12.php
http://www.nessus.org/u?1c6c9f21

Solution :

Update the affected package.

Risk factor :

Critical / CVSS Base Score : 10.0
(CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C)

Family: FreeBSD Local Security Checks

Nessus Plugin ID: 43342 (freebsd_pkg_39a25a63eb5c11deb65000215c6a37bb.nasl)

Bugtraq ID:

CVE ID: CVE-2009-3557
CVE-2009-3558
CVE-2009-4017
CVE-2009-4142
CVE-2009-4143

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now