Mandriva Linux Security Advisory : php (MDVSA-2011:053)

high Nessus Plugin ID 52958
New! Plugin Severity Now Using CVSS v3

The calculated severity for Plugins has been updated to use CVSS v3 by default. Plugins that do not have a CVSS v3 score will fall back to CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.


The remote Mandriva Linux host is missing one or more security updates.


Multiple vulnerabilities has been identified and fixed in php :

The _zip_name_locate function in zip_name_locate.c in the Zip extension in PHP before 5.3.6 does not properly handle a ZIPARCHIVE::FL_UNCHANGED argument, which might allow context-dependent attackers to cause a denial of service (application crash) via an empty ZIP archive that is processed with a (1) locateName or (2) statName operation (CVE-2011-0421).

exif.c in the Exif extension in PHP before 5.3.6 on 64-bit platforms performs an incorrect cast, which allows remote attackers to cause a denial of service (application crash) via an image with a crafted Image File Directory (IFD) that triggers a buffer over-read (CVE-2011-0708).

Integer overflow in ext/shmop/shmop.c in PHP before 5.3.6 allows context-dependent attackers to cause a denial of service (crash) and possibly read sensitive memory via a large third argument to the shmop_read function (CVE-2011-1092).

Multiple format string vulnerabilities in phar_object.c in the phar extension in PHP 5.3.5 and earlier allow context-dependent attackers to obtain sensitive information from process memory, cause a denial of service (memory corruption), or possibly execute arbitrary code via format string specifiers in an argument to a class method, leading to an incorrect zend_throw_exception_ex call (CVE-2011-1153).

Buffer overflow in the strval function in PHP before 5.3.6, when the precision configuration option has a large value, might allow context-dependent attackers to cause a denial of service (application crash) via a small numerical value in the argument (CVE-2011-1464).

Integer overflow in the SdnToJulian function in the Calendar extension in PHP before 5.3.6 allows context-dependent attackers to cause a denial of service (application crash) via a large integer in the first argument to the cal_from_jd function (CVE-2011-1466).

Unspecified vulnerability in the NumberFormatter::setSymbol (aka numfmt_set_symbol) function in the Intl extension in PHP before 5.3.6 allows context-dependent attackers to cause a denial of service (application crash) via an invalid argument, a related issue to CVE-2010-4409 (CVE-2011-1467).

Multiple memory leaks in the OpenSSL extension in PHP before 5.3.6 might allow remote attackers to cause a denial of service (memory consumption) via (1) plaintext data to the openssl_encrypt function or (2) ciphertext data to the openssl_decrypt function (CVE-2011-1468).

Unspecified vulnerability in the Streams component in PHP before 5.3.6 allows context-dependent attackers to cause a denial of service (application crash) by accessing an ftp:// URL during use of an HTTP proxy with the FTP wrapper (CVE-2011-1469).

The Zip extension in PHP before 5.3.6 allows context-dependent attackers to cause a denial of service (application crash) via a ziparchive stream that is not properly handled by the stream_get_contents function (CVE-2011-1470).

Integer signedness error in zip_stream.c in the Zip extension in PHP before 5.3.6 allows context-dependent attackers to cause a denial of service (CPU consumption) via a malformed archive file that triggers errors in zip_fread function calls (CVE-2011-1471).

The updated php packages have been upgraded to 5.3.6 which is not vulnerable to these issues.

Additionally some of the PECL extensions has been upgraded and/or rebuilt for the new php version.


Update the affected packages.

Plugin Details

Severity: High

ID: 52958

File Name: mandriva_MDVSA-2011-053.nasl

Version: 1.13

Type: local

Published: 3/24/2011

Updated: 1/6/2021

Dependencies: ssh_get_info.nasl

Risk Information


Risk Factor: Medium

Score: 6.7


Risk Factor: High

Base Score: 7.5

Temporal Score: 5.9

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

Temporal Vector: E:POC/RL:OF/RC:C

Vulnerability Information

CPE: p-cpe:/a:mandriva:linux:apache-mod_php, p-cpe:/a:mandriva:linux:lib64php5_common5, p-cpe:/a:mandriva:linux:libphp5_common5, p-cpe:/a:mandriva:linux:php-apc, p-cpe:/a:mandriva:linux:php-apc-admin, p-cpe:/a:mandriva:linux:php-bcmath, p-cpe:/a:mandriva:linux:php-bz2, p-cpe:/a:mandriva:linux:php-calendar, p-cpe:/a:mandriva:linux:php-cgi, p-cpe:/a:mandriva:linux:php-cli, p-cpe:/a:mandriva:linux:php-ctype, p-cpe:/a:mandriva:linux:php-curl, p-cpe:/a:mandriva:linux:php-dba, p-cpe:/a:mandriva:linux:php-devel, p-cpe:/a:mandriva:linux:php-dio, p-cpe:/a:mandriva:linux:php-doc, p-cpe:/a:mandriva:linux:php-dom, p-cpe:/a:mandriva:linux:php-eaccelerator, p-cpe:/a:mandriva:linux:php-eaccelerator-admin, p-cpe:/a:mandriva:linux:php-enchant, p-cpe:/a:mandriva:linux:php-exif, p-cpe:/a:mandriva:linux:php-fam, p-cpe:/a:mandriva:linux:php-fileinfo, p-cpe:/a:mandriva:linux:php-filepro, p-cpe:/a:mandriva:linux:php-filter, p-cpe:/a:mandriva:linux:php-fpm, p-cpe:/a:mandriva:linux:php-ftp, p-cpe:/a:mandriva:linux:php-gd, p-cpe:/a:mandriva:linux:php-gearman, p-cpe:/a:mandriva:linux:php-gettext, p-cpe:/a:mandriva:linux:php-gmp, p-cpe:/a:mandriva:linux:php-hash, p-cpe:/a:mandriva:linux:php-iconv, p-cpe:/a:mandriva:linux:php-idn, p-cpe:/a:mandriva:linux:php-imap, p-cpe:/a:mandriva:linux:php-ini, p-cpe:/a:mandriva:linux:php-intl, p-cpe:/a:mandriva:linux:php-json, p-cpe:/a:mandriva:linux:php-ldap, p-cpe:/a:mandriva:linux:php-mailparse, p-cpe:/a:mandriva:linux:php-mbstring, p-cpe:/a:mandriva:linux:php-mcal, p-cpe:/a:mandriva:linux:php-mcrypt, p-cpe:/a:mandriva:linux:php-mssql, p-cpe:/a:mandriva:linux:php-mysql, p-cpe:/a:mandriva:linux:php-mysqli, p-cpe:/a:mandriva:linux:php-odbc, p-cpe:/a:mandriva:linux:php-openssl, p-cpe:/a:mandriva:linux:php-optimizer, p-cpe:/a:mandriva:linux:php-pcntl, p-cpe:/a:mandriva:linux:php-pdo, p-cpe:/a:mandriva:linux:php-pdo_dblib, p-cpe:/a:mandriva:linux:php-pdo_mysql, p-cpe:/a:mandriva:linux:php-pdo_odbc, p-cpe:/a:mandriva:linux:php-pdo_pgsql, p-cpe:/a:mandriva:linux:php-pdo_sqlite, p-cpe:/a:mandriva:linux:php-pgsql, p-cpe:/a:mandriva:linux:php-phar, p-cpe:/a:mandriva:linux:php-pinba, p-cpe:/a:mandriva:linux:php-posix, p-cpe:/a:mandriva:linux:php-pspell, p-cpe:/a:mandriva:linux:php-readline, p-cpe:/a:mandriva:linux:php-recode, p-cpe:/a:mandriva:linux:php-sasl, p-cpe:/a:mandriva:linux:php-session, p-cpe:/a:mandriva:linux:php-shmop, p-cpe:/a:mandriva:linux:php-snmp, p-cpe:/a:mandriva:linux:php-soap, p-cpe:/a:mandriva:linux:php-sockets, p-cpe:/a:mandriva:linux:php-sphinx, p-cpe:/a:mandriva:linux:php-sqlite3, p-cpe:/a:mandriva:linux:php-ssh2, p-cpe:/a:mandriva:linux:php-suhosin, p-cpe:/a:mandriva:linux:php-sybase_ct, p-cpe:/a:mandriva:linux:php-sysvmsg, p-cpe:/a:mandriva:linux:php-sysvsem, p-cpe:/a:mandriva:linux:php-sysvshm, p-cpe:/a:mandriva:linux:php-tclink, p-cpe:/a:mandriva:linux:php-tidy, p-cpe:/a:mandriva:linux:php-timezonedb, p-cpe:/a:mandriva:linux:php-tokenizer, p-cpe:/a:mandriva:linux:php-translit, p-cpe:/a:mandriva:linux:php-vld, p-cpe:/a:mandriva:linux:php-wddx, p-cpe:/a:mandriva:linux:php-xattr, p-cpe:/a:mandriva:linux:php-xdebug, p-cpe:/a:mandriva:linux:php-xml, p-cpe:/a:mandriva:linux:php-xmlreader, p-cpe:/a:mandriva:linux:php-xmlrpc, p-cpe:/a:mandriva:linux:php-xmlwriter, p-cpe:/a:mandriva:linux:php-xsl, p-cpe:/a:mandriva:linux:php-zip, p-cpe:/a:mandriva:linux:php-zlib, cpe:/o:mandriva:linux:2010.0, cpe:/o:mandriva:linux:2010.1

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/Mandrake/release, Host/Mandrake/rpm-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 3/23/2011

Reference Information

CVE: CVE-2011-0421, CVE-2011-0708, CVE-2011-1092, CVE-2011-1153, CVE-2011-1464, CVE-2011-1466, CVE-2011-1467, CVE-2011-1468, CVE-2011-1469, CVE-2011-1470, CVE-2011-1471

BID: 46354, 46365, 46786, 46854, 46967, 46968, 46969, 46970, 46975, 46977

MDVSA: 2011:053