Ubuntu Security Notice (C) 2012-2016 Canonical, Inc. / NASL script (C) 2012-2016 Tenable Network Security, Inc.
The remote Ubuntu host is missing a security-related patch.
It was discovered that PHP incorrectly handled certain Tidy::diagnose
operations on invalid objects. A remote attacker could use this flaw
to cause PHP to crash, leading to a denial of service. (CVE-2012-0781)
It was discovered that PHP incorrectly handled certain multi-file
upload filenames. A remote attacker could use this flaw to cause a
denial of service, or to perform a directory traversal attack.
Rubin Xu and Joseph Bonneau discovered that PHP incorrectly handled
certain Unicode characters in passwords passed to the crypt()
function. A remote attacker could possibly use this flaw to bypass
It was discovered that a Debian/Ubuntu specific patch caused PHP to
incorrectly handle empty salt strings. A remote attacker could
possibly use this flaw to bypass authentication. This issue only
affected Ubuntu 10.04 LTS and Ubuntu 11.04. (CVE-2012-2317)
It was discovered that PHP, when used as a stand alone CGI processor
for the Apache Web Server, did not properly parse and filter query
strings. This could allow a remote attacker to execute arbitrary code
running with the privilege of the web server, or to perform a denial
of service. Configurations using mod_php5 and FastCGI were not
vulnerable. (CVE-2012-2335, CVE-2012-2336)
Alexander Gavrun discovered that the PHP Phar extension incorrectly
handled certain malformed TAR files. A remote attacker could use this
flaw to perform a denial of service, or possibly execute arbitrary
Note that Tenable Network Security has extracted the preceding
description block directly from the Ubuntu security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues.
Update the affected php5 package.
Risk factor :
High / CVSS Base Score : 7.5
CVSS Temporal Score : 6.5
Public Exploit Available : true
Family: Ubuntu Local Security Checks
Nessus Plugin ID: 59603 ()
Get Nessus Professional to scan unlimited IPs, run compliance checks & moreBuy Nessus Professional Now