According to its banner, the version of PHP installed on the remote host is older than 4.4.7 / 5.2.2.  Such versions may be affected by several issues, including buffer overflows in the GD library.

A buffer overflow was discovered in libgd2's font renderer. By tricking an application using libgd2 into rendering a specially crafted string with a JIS encoded font, a remote attacker could read heap memory or crash the application, leading to a denial of service.
(CVE-2007-0455)

Xavier Roche discovered that libgd2 did not correctly validate PNG callback results. If an application were tricked into processing a specially crafted PNG image, it would monopolize CPU resources. Since libgd2 is often used in PHP and Perl web applications, this could lead to a remote denial of service. (CVE-2007-2756).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated PHP packages that fix several security issues are now available for Red Hat Enterprise Linux 3 and 4.

This update has been rated as having important security impact by the Red Hat Security Response Team.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Web server.

A denial of service flaw was found in the way PHP processed a deeply nested array. A remote attacker could cause the PHP interpreter to crash by submitting an input variable with a deeply nested array.
(CVE-2007-1285)

A flaw was found in the way PHP's unserialize() function processed data. If a remote attacker was able to pass arbitrary data to PHP's unserialize() function, they could possibly execute arbitrary code as the apache user. (CVE-2007-1286)

A flaw was found in the way the mbstring extension set global variables. A script which used the mb_parse_str() function to set global variables could be forced to enable the register_globals configuration option, possibly resulting in global variable injection.
(CVE-2007-1583)

A double free flaw was found in PHP's session_decode() function. If a remote attacker was able to pass arbitrary data to PHP's session_decode() function, they could possibly execute arbitrary code as the apache user. (CVE-2007-1711)

A flaw was discovered in the way PHP's mail() function processed header data. If a script sent mail using a Subject header containing a string from an untrusted source, a remote attacker could send bulk e-mail to unintended recipients. (CVE-2007-1718)

A heap based buffer overflow flaw was discovered in PHP's gd extension. A script that could be forced to process WBMP images from an untrusted source could result in arbitrary code execution.
(CVE-2007-1001)

A buffer over-read flaw was discovered in PHP's gd extension. A script that could be forced to write arbitrary string using a JIS font from an untrusted source could cause the PHP interpreter to crash.
(CVE-2007-0455)

Users of PHP should upgrade to these updated packages which contain backported patches to correct these issues.

- Mon Dec 6 2010 Caolan McNamara <caolanm at redhat.com> -     0.2.8.4-22

    - Resolves: rhbz#660161 security issues

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Buffer overflow in the gdImageStringFTEx function in gdft.c in the GD Graphics Library 2.0.33 and earlier allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted string with a JIS encoded font.

Packages have been patched to correct this issue.

PHP 5.2.0 and 4.4 allows local users to bypass safe_mode and open_basedir restrictions via a malicious path and a null byte before a ';' in a session_save_path argument, followed by an allowed path, which causes a parsing inconsistency in which PHP validates the allowed path but sets session.save_path to the malicious path.
(CVE-2006-6383)

Buffer overflow in the gdImageStringFTEx function in gdft.c in GD Graphics Library 2.0.33 and earlier allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted string with a JIS encoded font. PHP uses an embedded copy of GD and may be susceptible to the same issue.
(CVE-2007-0455)

Updated packages have been patched to correct these issues. Users must restart Apache for the changes to take effect.

- Mon Jan 29 2007 Ivana Varekova <varekova at redhat.com>
    - 2.0.33-7

    - Resolves: #224610 CVE-2007-0455 gd buffer overrun

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2008-0146 advisory.

    [2.0.28-5.E4.1]
     - security fixes
     - Resolves: #432784

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
25159	PHP < 4.4.7 / 5.2.2 Multiple Vulnerabilities	Nessus	CGI abuses	5/4/2007	5/26/2025	high
28074	Ubuntu 6.06 LTS / 6.10 / 7.04 : libgd2 vulnerabilities (USN-473-1)	Nessus	Ubuntu Local Security Checks	11/10/2007	1/19/2021	high
25043	CentOS 3 / 4 : php (CESA-2007:0155)	Nessus	CentOS Local Security Checks	4/19/2007	1/4/2021	high
25068	RHEL 3 / 4 : php (RHSA-2007:0155)	Nessus	Red Hat Local Security Checks	4/19/2007	1/14/2021	high
51414	Fedora 13 : libwmf-0.2.8.4-22.fc13 (2010-19022)	Nessus	Fedora Local Security Checks	1/5/2011	1/11/2021	high
24648	Mandrake Linux Security Advisory : gd (MDKSA-2007:035)	Nessus	Mandriva Local Security Checks	2/18/2007	1/6/2021	high
24651	Mandrake Linux Security Advisory : php (MDKSA-2007:038)	Nessus	Mandriva Local Security Checks	2/18/2007	1/6/2021	high
24325	Fedora Core 5 : gd-2.0.33-7.fc5 (2007-150)	Nessus	Fedora Local Security Checks	2/13/2007	1/11/2021	high
67657	Oracle Linux 5 : Moderate: / gd (ELSA-2008-0146)	Nessus	Oracle Linux Local Security Checks	7/12/2013	10/22/2024	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high

high

high

high