Ubuntu 15.10 : php5 regression (USN-2952-2)

Ubuntu Security Notice (C) 2016 Canonical, Inc. / NASL script (C) 2016 Tenable Network Security, Inc.


Synopsis :

The remote Ubuntu host is missing one or more security-related
patches.

Description :

USN-2952-1 fixed vulnerabilities in PHP. One of the backported patches
caused a regression in the PHP Soap client. This update fixes the
problem.

We apologize for the inconvenience.

It was discovered that the PHP Zip extension incorrectly handled
directories when processing certain zip files. A remote attacker could
possibly use this issue to create arbitrary directories.
(CVE-2014-9767)

It was discovered that the PHP Soap client incorrectly
validated data types. A remote attacker could use this issue
to cause PHP to crash, resulting in a denial of service, or
possibly execute arbitrary code. (CVE-2015-8835,
CVE-2016-3185)

It was discovered that the PHP MySQL native driver
incorrectly handled TLS connections to MySQL databases. A
man in the middle attacker could possibly use this issue to
downgrade and snoop on TLS connections. This vulnerability
is known as BACKRONYM. (CVE-2015-8838)

It was discovered that PHP incorrectly handled the
imagerotate function. A remote attacker could use this issue
to cause PHP to crash, resulting in a denial of service, or
possibly obtain sensitive information. This issue only
applied to Ubuntu 14.04 LTS and Ubuntu 15.10.
(CVE-2016-1903)

Hans Jerry Illikainen discovered that the PHP phar extension
incorrectly handled certain tar archives. A remote attacker
could use this issue to cause PHP to crash, resulting in a
denial of service, or possibly execute arbitrary code.
(CVE-2016-2554)

It was discovered that the PHP WDDX extension incorrectly
handled certain malformed XML data. A remote attacker could
possibly use this issue to cause PHP to crash, resulting in
a denial of service, or possibly execute arbitrary code.
(CVE-2016-3141)

It was discovered that the PHP phar extension incorrectly
handled certain zip files. A remote attacker could use this
issue to cause PHP to crash, resulting in a denial of
service, or possibly obtain sensitive information.
(CVE-2016-3142)

It was discovered that the PHP
libxml_disable_entity_loader() setting was shared between
threads. When running under PHP-FPM, this could result in
XML external entity injection and entity expansion issues.
This issue only applied to Ubuntu 12.04 LTS and Ubuntu 14.04
LTS. (No CVE number)

It was discovered that the PHP openssl_random_pseudo_bytes()
function did not return cryptographically strong
pseudo-random bytes. (No CVE number)

It was discovered that the PHP Fileinfo component
incorrectly handled certain magic files. An attacker could
use this issue to cause PHP to crash, resulting in a denial
of service, or possibly execute arbitrary code. (CVE number
pending)

It was discovered that the PHP php_snmp_error() function
incorrectly handled string formatting. A remote attacker
could use this issue to cause PHP to crash, resulting in a
denial of service, or possibly execute arbitrary code. This
issue only applied to Ubuntu 14.04 LTS and Ubuntu 15.10.
(CVE number pending)

It was discovered that the PHP rawurlencode() function
incorrectly handled large strings. A remote attacker could
use this issue to cause PHP to crash, resulting in a denial
of service. (CVE number pending)

It was discovered that the PHP phar extension incorrectly
handled certain filenames in archives. A remote attacker
could use this issue to cause PHP to crash, resulting in a
denial of service, or possibly execute arbitrary code. (CVE
number pending)

It was discovered that the PHP mb_strcut() function
incorrectly handled string formatting. A remote attacker
could use this issue to cause PHP to crash, resulting in a
denial of service, or possibly execute arbitrary code. (CVE
number pending).

Note that Tenable Network Security has extracted the preceding
description block directly from the Ubuntu security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues.

Solution :

Update the affected packages.

Risk factor :

Critical / CVSS Base Score : 10.0
(CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C)
CVSS Temporal Score : 7.8
(CVSS2#E:POC/RL:OF/RC:ND)
Public Exploit Available : true

Family: Ubuntu Local Security Checks

Nessus Plugin ID: 90825 ()

Bugtraq ID:

CVE ID: CVE-2014-9767
CVE-2015-8835
CVE-2015-8838
CVE-2016-1903
CVE-2016-2554
CVE-2016-3141
CVE-2016-3142
CVE-2016-3185

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now