現已提供適用於 Slackware 14.0、14.1 和最新版本的新 php 套件，可修正安全性問題。

- CVE-2015-6831 在 unserialize() 函式中發現一個釋放後使用弱點。我們可以透過 Serializable::unserialize 建立並釋放 ZVAL。不過 unserialize() 仍會繼續允許使用 R: 或 r: 將參照設為已釋放記憶體的項目。這可能會導致從遠端發動釋放後使用攻擊並執行任意程式碼。

- CVE-2015-6832 ArrayObject 項目之未序列化中的懸置指標。

- CVE-2015-6833 從封存擷取的檔案可能放置在目的地目錄之外。

- CVE-2015-6834 在 unserialize() 函式中發現一個釋放後使用弱點。我們可以透過 Serializable::unserialize 建立並釋放 ZVAL。不過 unserialize() 仍會繼續允許使用 R: 或 r: 將參照設為已釋放記憶體的項目。這可能會導致從遠端發動釋放後使用攻擊並執行任意程式碼。

- CVE-2015-6836 SOAP serialize_function_call 內發生類型混淆，這是因對標頭欄位的驗證不足所致。在 SoapClient 的
__call 方法中，verify_soap_headers_array 檢查僅套用到從 zend_parse_parameters 擷取的標頭；問題是，在幾行之後，soap_headers 可能被更新，甚至是以來自 __default_headers 物件欄位的值取代。

- CVE-2015-6837 XSLTProcessor 類別對於從 libxslt 程式庫的輸入內容缺少數項檢查。valuePop() 函式呼叫可傳回 NULL 指標，而 php 並不會檢查該指標。

- CVE-2015-6838 XSLTProcessor 類別對於從 libxslt 程式庫的輸入內容缺少數項檢查。valuePop() 函式呼叫可傳回 NULL 指標，而 php 並不會檢查該指標。

- CVE-2015-7803 在 PHP 之 Phar 延伸模組剖析 Phar 封存的方式中，發現一個 NULL 指標解除參照瑕疵。利用特製的封存可造成 PHP 損毀。

- CVE-2015-7804 在 PHP 之 Phar 延伸模組的 phar_make_dirstream() 函式中，發現一個未初始化的指標使用瑕疵。利用 ZIP 格式且其中包含目錄項目檔案名稱為「/ZIP」的特製 phar 檔案，可造成 PHP 應用程式函式損毀。

注意：Tenable Network Security 已直接從 DLA 安全性公告擷取前置描述區塊。Tenable 已盡量在不造成其他問題的前提下，嘗試自動清理並將其格式化。

在 PHP 的 XSLTProcessor 類別中發現一個 NULL 指標解除參照瑕疵。如果 PHP 應用程式執行使用未受信任 XSLT 檔案的可延伸樣式表語言 (XSL) 轉換，且允許 PHP 功能在 XSL 樣式表中用作 XSLT 功能，攻擊者便可利用此瑕疵造成該 PHP 應用程式損毀。
(CVE-2015-6837、CVE-2015-6838)

在 PHP 執行物件未序列化的方式中發現一個瑕疵。
由 unserialize() 函式處理的特製輸入可能造成 PHP 應用程式損毀，或可能執行任意程式碼。
(CVE-2015-6834、CVE-2015-6835、CVE-2015-6836)

The remote host is running a version of Mac OS X version 10.11.x prior to 10.11.1 and is affected by multiple vulnerabilities in the following components :

 - Accelerate Framework (CVE-2015-5940)
 - apache_mod_php (CVE-2015-0235, CVE-2015-0273, CVE-2015-6834, CVE-2015-6835, CVE-2015-6836, CVE-2015-6837, CVE-2015-6838)
 - ATS (CVE-2015-6985)
 - Audio (CVE-2015-5933, CVE-2015-5934, CVE-2015-7003)
 - Bom (CVE-2015-7006)
 - CFNetwork (CVE-2015-7023)
 - configd (CVE-2015-7015)
 - CoreGraphics (CVE-2015-5925, CVE-2015-5926)
 - CoreText (CVE-2015-5944, CVE-2015-6975, CVE-2015-6992, CVE-2015-7017)
 - Directory Utility (CVE-2015-6980)
 - Disk Images (CVE-2015-6995)
 - EFI (CVE-2015-7035)
 - File Bookmark (CVE-2015-6987)
 - FontParser (CVE-2015-5927, CVE-2015-5942, CVE-2015-6976, CVE-2015-6977, CVE-2015-6978, CVE-2015-6990, CVE-2015-6991, CVE-2015-6993, CVE-2015-7008, CVE-2015-7009, CVE-2015-7010, CVE-2015-7018)
 - Grand Central Dispatch (CVE-2015-6989)
 - Graphics Drivers (CVE-2015-7019, CVE-2015-7020, CVE-2015-7021)
 - ImageIO (CVE-2015-5935, CVE-2015-5936, CVE-2015-5937, CVE-2015-5938, CVE-2015-5939)
 - IOAcceleratorFamily (CVE-2015-6996)
 - IOHIDFamily (CVE-2015-6974)
 - Kernel (CVE-2015-5932, CVE-2015-6988, CVE-2015-6994)
 - libarchive (CVE-2015-6984)
 - MCX Application Restrictions (CVE-2015-7016)
 - Net-SNMP (CVE-2014-3565, CVE-2012-6151)
 - OpenGL (CVE-2015-5924)
 - OpenSSH (CVE-2015-6563)
 - Sandbox (CVE-2015-5945)
 - Script Editor (CVE-2015-7007)
 - Security (CVE-2015-6983, CVE-2015-7024)
 - SecurityAgent (CVE-2015-5943)

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

Versions of PHP 5.4.x prior to 5.4.45, 5.5.x prior to 5.5.29, or 5.6.x prior to 5.6.13 are vulnerable to the following issues :

  - A use-after-free error exists in the unserialize() function in 'ext/spl/spl_observer.c'. The issue is triggered as user-supplied input is not sanitized. This may allow a remote attacker to dereference already freed memory and potentially execute arbitrary code.
 - A type confusion flaw affects the serialize_function_call() function in 'ext/soap/soap.c'. The issue is triggered when handling input passed via the header field. This may allow a remote attacker to execute arbitrary code.
 - A use-after-free error affects the object_custom() function in 'ext/standard/var_unserializer.c'. The issue is triggered when handling user-supplied input. This may allow a remote attacker to dereference already freed memory and potentially execute arbitrary code.
 - A use-after-free error affects the unserialize() function in 'ext/spl/spl_dllist.c'. The issue is triggered during the deserialization of user-supplied input. This may allow a remote attacker to dereference already freed memory and potentially execute arbitrary code.
 - An out-of-bounds read flaw in the exif_process_IFD_TAG() function in 'ext/exif/exif.c' that is triggered when handling TIFF IFD tags. This may allow a context-dependent attacker to crash an application linked against PHP or potentially disclose memory contents.
 - An overflow condition exists in the php_pcre_match_impl() function in 'ext/pcre/php_pcre.c'. The issue is triggered as user-supplied input is not properly validated. This may allow a remote attacker to cause a heap-based buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code.
 - A flaw exists in the php_pcre_split_impl() function in 'ext/pcre/php_pcre.c'. The flaw is triggered during the handling of offsets that consist of a start and end position within the subject string, which can cause an exhaustion of memory resources. This may allow a remote attacker to exhaust available memory.
 - An overflow condition affects the php_pcre_replace_impl() function in 'ext/pcre/php_pcre.c'. The issue is triggered as user-supplied input is not properly validated when handling offsets. This may allow a remote attacker to cause a heap-based buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code.
 - A use-after-free error exists in the php_var_unserialize() function of the session deserializer (php_binary/php_serialize). The issue is triggered when deserializing multiple forms of data. This may allow a remote attacker to dereference already freed memory and potentially execute arbitrary code.
 - A NULL pointer dereference flaw exists in the xsl_ext_function_php() function in 'ext/xsl/xsltprocessor.c' that is triggered as checks are not properly performed on user-supplied input. This may allow a remote attacker to cause a denial of service.
 - A flaw exists that allows traversing outside of a restricted path. The issue is due to the php_zip_extract_file() function in 'ext/zip/php_zip.c' not properly sanitizing user input, specifically path traversal style attacks (e.g. '../') passed to the ZipArchive::extractTo() method. This may allow a remote attacker to create arbitrary directories.

ID	Name	Product	Family	Published	Updated	Severity
86223	Slackware 14.0 / 14.1 / 最新版本：php (SSA:2015-274-02)	Nessus	Slackware Local Security Checks	10/2/2015	1/14/2021	critical
86794	Debian DLA-341-1：php5 安全性更新	Nessus	Debian Local Security Checks	11/9/2015	1/11/2021	critical
89967	Amazon Linux AMI：php54 (ALAS-2016-670)	Nessus	Amazon Linux Local Security Checks	3/17/2016	4/11/2019	critical
9324	Mac OS X 10.9.5 or later < 10.11.1 Multiple Vulnerabilities	Nessus Network Monitor	Operating System Detection	5/27/2016	3/6/2019	critical
8861	PHP 5.4.x < 5.4.45 / 5.5.x < 5.5.29 / 5.6.x < 5.6.13 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	9/14/2015	3/6/2019	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical