High Nessus Plugin ID 24412
SynopsisThe remote host is missing a vendor-supplied security patch
DescriptionThe remote host is missing the patch for the advisory SUSE-SA:2006:031 (PHP4,PHP5).
This update fixes the following security issues in the PHP scripting language, both version 4 and 5:
- Invalid characters in session names were not blocked.
- CVE-2006-2657: A bug in zend_hash_del() allowed attackers to prevent unsetting of some variables
- CVE-2006-1991, CVE-2006-1990: Bugs in the substr_compare() and wordwrap function could crash the php interpreter.
- CVE-2006-2906: A CPU consumption denial of service attack in php-gd was fixed.