FreeBSD : php -- multiple vulnerabilities (057bf770-cac4-11e0-aea3-00215c6a37bb)

This script is Copyright (C) 2011-2016 Tenable Network Security, Inc.


Synopsis :

The remote FreeBSD host is missing one or more security-related
updates.

Description :

PHP development team reports :

Security Enhancements and Fixes in PHP 5.3.7 :

- Updated crypt_blowfish to 1.2. (CVE-2011-2483)

- Fixed crash in error_log(). Reported by Mateusz Kocielski

- Fixed buffer overflow on overlog salt in crypt().

- Fixed bug #54939 (File path injection vulnerability in RFC1867 File
upload filename). Reported by Krzysztof Kotowicz. (CVE-2011-2202)

- Fixed stack-based buffer overflow in socket_connect(). (CVE-2011-1938)

- Fixed bug #54238 (use-after-free in substr_replace()).
(CVE-2011-1148)

See also :

http://www.nessus.org/u?c37f0025

Solution :

Update the affected packages.

Risk factor :

High / CVSS Base Score : 7.5
(CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS Temporal Score : 6.5
(CVSS2#E:ND/RL:OF/RC:C)
Public Exploit Available : false

Family: FreeBSD Local Security Checks

Nessus Plugin ID: 55912 ()

Bugtraq ID: 49241

CVE ID: CVE-2011-1148
CVE-2011-1938
CVE-2011-2202
CVE-2011-2483

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now