PHP 5.4.x < 5.4.18 Multiple Vulnerabilities
High Nessus Network Monitor Plugin ID 6996
SynopsisThe remote web server uses a version of PHP that is affected by multiple vulnerabilities.
DescriptionPHP versions 5.4.x earlier than 5.4.18 are affected by the following vulnerabilities : - A heap corruption error exists in numerous functions in the file 'ext/xml/xml.c'. (CVE-2013-4113 / Bug #65236)
- An error exists related to certificate validation, the 'subjectAltName' field and certificates containing NULL bytes. This error can allow spoofing attacks. (CVE-2013-4248)
SolutionApply the vendor patch or upgrade to PHP version 5.4.18 or later.