FreeBSD : php -- multiple vulnerabilities (85eb4e46-cf16-11e5-840f-485d605f4717)

Critical Nessus Plugin ID 88671

New! Vulnerability Priority Rating (VPR)

Tenable calculates a dynamic VPR for every vulnerability. VPR combines vulnerability information with threat intelligence and machine learning algorithms to predict which vulnerabilities are most likely to be exploited in attacks. Read more about what VPR is and how it's different from CVSS.

VPR Score: 5.9

Synopsis

The remote FreeBSD host is missing one or more security-related updates.

Description

PHP reports :

- Core :

- Fixed bug #71039 (exec functions ignore length but look for NULL termination).

- Fixed bug #71323 (Output of stream_get_meta_data can be falsified by its input).

- Fixed bug #71459 (Integer overflow in iptcembed()).

- PCRE :

- Upgraded bundled PCRE library to 8.38.(CVE-2015-8383, CVE-2015-8386, CVE-2015-8387, CVE-2015-8389, CVE-2015-8390, CVE-2015-8391, CVE-2015-8393, CVE-2015-8394)

- Phar :

- Fixed bug #71354 (Heap corruption in tar/zip/phar parser).

- Fixed bug #71391 (NULL pointer Dereference in phar_tar_setupmetadata()).

- Fixed bug #71488 (Stack overflow when decompressing tar archives).
(CVE-2016-2554)

- WDDX :

- Fixed bug #71335 (Type Confusion in WDDX Packet Deserialization).

Solution

Update the affected packages.

See Also

http://php.net/ChangeLog-5.php#5.6.18

http://php.net/ChangeLog-5.php#5.5.32

http://www.nessus.org/u?2937fd20

Plugin Details

Severity: Critical

ID: 88671

File Name: freebsd_pkg_85eb4e46cf1611e5840f485d605f4717.nasl

Version: 2.9

Type: local

Published: 2016/02/10

Updated: 2018/11/10

Dependencies: 12634

Risk Information

Risk Factor: Critical

VPR Score: 5.9

CVSS v2.0

Base Score: 10

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS v3.0

Base Score: 9.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Vulnerability Information

CPE: p-cpe:/a:freebsd:freebsd:php55, p-cpe:/a:freebsd:freebsd:php55-phar, p-cpe:/a:freebsd:freebsd:php55-wddx, p-cpe:/a:freebsd:freebsd:php56, p-cpe:/a:freebsd:freebsd:php56-phar, p-cpe:/a:freebsd:freebsd:php56-wddx, cpe:/o:freebsd:freebsd

Required KB Items: Host/local_checks_enabled, Host/FreeBSD/release, Host/FreeBSD/pkg_info

Patch Publication Date: 2016/02/09

Vulnerability Publication Date: 2016/02/04

Reference Information

CVE: CVE-2015-8383, CVE-2015-8386, CVE-2015-8387, CVE-2015-8389, CVE-2015-8390, CVE-2015-8391, CVE-2015-8393, CVE-2015-8394, CVE-2016-2554