Debian DLA-444-1 : php5 security update

Medium Nessus Plugin ID 89044

Synopsis

The remote Debian host is missing a security update.

Description

CVE-2015-2305 Integer overflow in the regcomp implementation in the Henry Spencer BSD regex library (aka rxspencer) alpha3.8.g5 on 32-bit platforms, as used in NetBSD through 6.1.5 and other products, might allow context-dependent attackers to execute arbitrary code via a large regular expression that leads to a heap-based buffer overflow.
CVE-2015-2348 The move_uploaded_file implementation in ext/standard/basic_functions.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 truncates a pathname upon encountering a \x00 character, which allows remote attackers to bypass intended extension restrictions and create files with unexpected names via a crafted second argument. NOTE: this vulnerability exists because of an incomplete fix for CVE-2006-7243. CVE-2016-tmp, Bug #71039 exec functions ignore length but look for NULL termination CVE-2016-tmp, Bug #71089 No check to duplicate zend_extension CVE-2016-tmp, Bug #71201 round() segfault on 64-bit builds CVE-2016-tmp, Bug #71459 Integer overflow in iptcembed() CVE-2016-tmp, Bug #71354 Heap corruption in tar/zip/phar parser CVE-2016-tmp, Bug #71391 NULL pointer Dereference in phar_tar_setupmetadata() CVE-2016-tmp, Bug #70979 Crash on bad SOAP request

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Solution

Upgrade the affected packages.

See Also

https://lists.debian.org/debian-lts-announce/2016/02/msg00035.html

https://packages.debian.org/source/squeeze-lts/php5

Plugin Details

Severity: Medium

ID: 89044

File Name: debian_DLA-444.nasl

Version: 2.3

Type: local

Agent: unix

Published: 2016/03/01

Updated: 2018/07/06

Dependencies: 12634

Risk Information

Risk Factor: Medium

CVSS v2.0

Base Score: 6.8

Temporal Score: 5

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P

Temporal Vector: CVSS2#E:U/RL:OF/RC:C

Vulnerability Information

CPE: p-cpe:/a:debian:debian_linux:libapache2-mod-php5, p-cpe:/a:debian:debian_linux:libapache2-mod-php5filter, p-cpe:/a:debian:debian_linux:php-pear, p-cpe:/a:debian:debian_linux:php5, p-cpe:/a:debian:debian_linux:php5-cgi, p-cpe:/a:debian:debian_linux:php5-cli, p-cpe:/a:debian:debian_linux:php5-common, p-cpe:/a:debian:debian_linux:php5-curl, p-cpe:/a:debian:debian_linux:php5-dbg, p-cpe:/a:debian:debian_linux:php5-dev, p-cpe:/a:debian:debian_linux:php5-enchant, p-cpe:/a:debian:debian_linux:php5-gd, p-cpe:/a:debian:debian_linux:php5-gmp, p-cpe:/a:debian:debian_linux:php5-imap, p-cpe:/a:debian:debian_linux:php5-interbase, p-cpe:/a:debian:debian_linux:php5-intl, p-cpe:/a:debian:debian_linux:php5-ldap, p-cpe:/a:debian:debian_linux:php5-mcrypt, p-cpe:/a:debian:debian_linux:php5-mysql, p-cpe:/a:debian:debian_linux:php5-odbc, p-cpe:/a:debian:debian_linux:php5-pgsql, p-cpe:/a:debian:debian_linux:php5-pspell, p-cpe:/a:debian:debian_linux:php5-recode, p-cpe:/a:debian:debian_linux:php5-snmp, p-cpe:/a:debian:debian_linux:php5-sqlite, p-cpe:/a:debian:debian_linux:php5-sybase, p-cpe:/a:debian:debian_linux:php5-tidy, p-cpe:/a:debian:debian_linux:php5-xmlrpc, p-cpe:/a:debian:debian_linux:php5-xsl, cpe:/o:debian:debian_linux:6.0

Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l

Exploit Available: false

Exploit Ease: No known exploits are available

Patch Publication Date: 2016/02/29

Reference Information

CVE: CVE-2015-2305, CVE-2015-2348

BID: 72611, 73434