openSUSE Security Update : php5 (openSUSE-2015-609)

This script is Copyright (C) 2015-2016 Tenable Network Security, Inc.


Synopsis :

The remote openSUSE host is missing a security update.

Description :

The PHP5 script interpreter was updated to fix various security
issues :

- CVE-2015-6831: A use after free vulnerability in
unserialize() has been fixed which could be used to
crash php or potentially execute code. [bnc#942291]
[bnc#942294] [bnc#942295]

- CVE-2015-6832: A dangling pointer in the unserialization
of ArrayObject items could be used to crash php or
potentially execute code. [bnc#942293]

- CVE-2015-6833: A directory traversal when extracting ZIP
files could be used to overwrite files outside of
intended area. [bnc#942296]

- CVE-2015-6834: A Use After Free Vulnerability in
unserialize() has been fixed which could be used to
crash php or potentially execute code. [bnc#945403]

- CVE-2015-6835: A Use After Free Vulnerability in session
unserialize() has been fixed which could be used to
crash php or potentially execute code. [bnc#945402]

- CVE-2015-6836: A SOAP serialize_function_call() type
confusion leading to remote code execution problem was
fixed. [bnc#945428]

- CVE-2015-6837 CVE-2015-6838: Two NULL pointer
dereferences in the XSLTProcessor class were fixed.
[bnc#945412]

See also :

https://bugzilla.opensuse.org/show_bug.cgi?id=942291
https://bugzilla.opensuse.org/show_bug.cgi?id=942293
https://bugzilla.opensuse.org/show_bug.cgi?id=942294
https://bugzilla.opensuse.org/show_bug.cgi?id=942295
https://bugzilla.opensuse.org/show_bug.cgi?id=942296
https://bugzilla.opensuse.org/show_bug.cgi?id=945402
https://bugzilla.opensuse.org/show_bug.cgi?id=945403
https://bugzilla.opensuse.org/show_bug.cgi?id=945412
https://bugzilla.opensuse.org/show_bug.cgi?id=945428

Solution :

Update the affected php5 packages.

Risk factor :

High / CVSS Base Score : 7.5
(CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P)

Family: SuSE Local Security Checks

Nessus Plugin ID: 86183 ()

Bugtraq ID:

CVE ID: CVE-2015-6831
CVE-2015-6832
CVE-2015-6833
CVE-2015-6834
CVE-2015-6835
CVE-2015-6836
CVE-2015-6837
CVE-2015-6838

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now