Multiple vulnerabilities have been discovered in PHP :

  - CVE-2015-4025 / CVE-2015-4026     Multiple function didn't check for NULL bytes in path     names.

  - CVE-2015-4024     Denial of service when processing multipart/form-data     requests.

  - CVE-2015-4022     Integer overflow in the ftp_genlist() function may     result in denial of service or potentially the execution     of arbitrary code.

  - CVE-2015-4021 CVE-2015-3329 CVE-2015-2783     Multiple vulnerabilities in the phar extension may     result in denial of service or potentially the execution     of arbitrary code when processing malformed archives.

PHP 5.3 was updated to fix multiple security issues :

bnc#931776: pcntl_exec() does not check path validity (CVE-2015-4026)

bnc#931772: overflow in ftp_genlist() resulting in heap overflow (CVE-2015-4022)

bnc#931769: memory corruption in phar_parse_tarfile when entry filename starts with NULL (CVE-2015-4021)

bnc#931421: multipart/form-data remote denial-of-service vulnerability (CVE-2015-4024)

bnc#928511: buffer over-read in unserialize when parsing Phar (CVE-2015-2783)

bnc#928506: buffer over flow when parsing tar/zip/phar in phar_set_inode() (CVE-2015-3329)

bnc#925109: SoapClient's __call() type confusion through unserialize()

bnc#924972: use-after-free vulnerability in the process_nested_data function (CVE-2015-2787)

bnc#923946: embedded gd copy: buffer read overflow in gd_gif_in.c (CVE-2014-9709)

bnc#922452: built-in regular expression (regex) library contains a heap overflow vulnerability (CVE-2015-2305)

bnc#922451: heap buffer overflow in enchant_broker_request_dict() (CVE-2014-9705)

bnc#922022: php's built-in regular expression (regex) library contains a heap overflow vulnerability (CVE-2015-2301)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2015-1135 advisory.

    - core: fix multipart/form-data request can use excessive       amount of CPU usage CVE-2015-4024
    - fix various functions accept paths with NUL character       CVE-2015-4025, CVE-2015-4026, #1213407
    - ftp: fix integer overflow leading to heap overflow when       reading FTP file listing CVE-2015-4022
    - phar: fix buffer over-read in metadata parsing CVE-2015-2783
    - phar: invalid pointer free() in phar_tar_process_metadata()       CVE-2015-3307
    - phar: fix buffer overflow in phar_set_inode() CVE-2015-3329
    - phar: fix memory corruption in phar_parse_tarfile caused by       empty entry file name CVE-2015-4021
    - apache2handler: fix pipelined request executed in deinitialized       interpreter under httpd 2.4 CVE-2015-3330
    - core: use after free vulnerability in unserialize()       CVE-2014-8142 and CVE-2015-0231
    - core: fix use-after-free in unserialize CVE-2015-2787
    - core: fix NUL byte injection in file name argument of       move_uploaded_file() CVE-2015-2348
    - date: use after free vulnerability in unserialize CVE-2015-0273
    - enchant: fix heap buffer overflow in enchant_broker_request_dict       CVE-2014-9705
    - exif: free called on unitialized pointer CVE-2015-0232
    - fileinfo: fix out of bounds read in mconvert CVE-2014-9652
    - gd: fix buffer read overflow in gd_gif_in.c CVE-2014-9709
    - phar: use after free in phar_object.c CVE-2015-2301
    - fileinfo: fix out-of-bounds read in elf note headers. CVE-2014-3710
    - xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
    - core: fix integer overflow in unserialize() CVE-2014-3669
    - exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670
    - gd: fix NULL pointer dereference in gdImageCreateFromXpm().
      CVE-2014-2497
    - gd: fix NUL byte injection in file names. CVE-2014-5120
    - fileinfo: fix extensive backtracking in regular expression       (incomplete fix for CVE-2013-7345). CVE-2014-3538
    - fileinfo: fix mconvert incorrect handling of truncated       pascal string size. CVE-2014-3478
    - fileinfo: fix cdf_read_property_info       (incomplete fix for CVE-2012-1571). CVE-2014-3587
    - spl: fix use-after-free in ArrayIterator due to object       change during sorting. CVE-2014-4698
    - spl: fix use-after-free in SPL Iterators. CVE-2014-4670
    - network: fix segfault in dns_get_record       (incomplete fix for CVE-2014-4049). CVE-2014-3597

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is running a version of Mac OS X 10.10.x that is prior to 10.10.5. It is, therefore, affected by multiple vulnerabilities in the following components :

  - apache
  - apache_mod_php
  - Apple ID OD Plug-in
  - AppleGraphicsControl
  - Bluetooth
  - bootp
  - CloudKit
  - CoreMedia Playback
  - CoreText
  - curl
  - Data Detectors Engine
  - Date & Time pref pane
  - Dictionary Application
  - DiskImages
  - dyld
  - FontParser
  - groff
  - ImageIO
  - Install Framework Legacy
  - IOFireWireFamily
  - IOGraphics
  - IOHIDFamily
  - Kernel
  - Libc
  - Libinfo
  - libpthread
  - libxml2
  - libxpc
  - mail_cmds
  - Notification Center OSX
  - ntfs
  - OpenSSH
  - OpenSSL
  - perl
  - PostgreSQL
  - python
  - QL Office
  - Quartz Composer Framework
  - Quick Look
  - QuickTime 7
  - SceneKit
  - Security
  - SMBClient
  - Speech UI
  - sudo
  - tcpdump
  - Text Formats
  - udf 

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

ID	Name	Product	Family	Published	Updated	Severity
84025	Debian DSA-3280-1 : php5 - security update	Nessus	Debian Local Security Checks	6/9/2015	1/11/2021	high
84082	SUSE SLES11 Security Update : php53 (SUSE-SU-2015:1018-1)	Nessus	SuSE Local Security Checks	6/10/2015	1/19/2021	high
84351	Oracle Linux 7 : php (ELSA-2015-1135)	Nessus	Oracle Linux Local Security Checks	6/24/2015	10/22/2024	critical
85408	Mac OS X 10.10.x < 10.10.5 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	8/17/2015	5/28/2024	high

Detections

Analytics

Plugins Search

high

high

critical

high