远程 Scientific Linux 7 主机上安装的程序包受到 SLSA-2020: 5443-1 公告提及的一个漏洞的影响。

  - gd：_gd2GetHeader() 中导致堆溢出的整数溢出 (CVE-2016-5766)。

请注意，Nessus 尚未测试此问题，而是只依赖于应用程序自我报告的版本号。

远程 CentOS Linux 7 主机上安装的多个程序包受到 RHSA-2020:5443 公告中提及的一个漏洞影响。

  - PHP 5.5.37 之前版本、5.6.23 之前的 5.6.x 版本和 7.0.8 之前的 7.x 版本使用的 GD 图形库（又称为 libgd）2.2.3 之前版本中，gd_gd2.c 内的 _gd2GetHeader 函数存在整数溢出，这使得远程攻击者能够通过图像中构建的区块尺寸造成拒绝服务（基于堆的缓冲区溢出和应用程序崩溃）或可能造成其他不明影响。(CVE-2016-5766)

请注意，Nessus 尚未测试此问题，而是只依据应用程序自我报告的版本号进行判断。

PHP 的 GD 中存在一个堆栈消耗漏洞，可允许远程攻击者通过特别构建的 imagefilltoborder 调用造成拒绝服务。
(CVE-2015-8874)

在 PHP 的 gd 扩展内，imagecreatefromgd2() 函数中发生整数溢出，进而导致基于堆的缓冲区溢出。远程攻击者可利用此缺陷，经由特别构建的 GD2 图像来使用 gd，造成 PHP 应用程序崩溃或以运行该 PHP 应用程序的用户权限执行任意代码。
(CVE-2016-5766)

在 PHP 的 gd 扩展内，gdImagePaletteToTrueColor() 函数中发生整数溢出，进而导致基于堆的缓冲区溢出。远程攻击者可利用此缺陷，经由特别构建的图像缓冲区来使用 gd，造成 PHP 应用程序崩溃或以运行该 PHP 应用程序的用户权限执行任意代码。
(CVE-2016-5767)

在 php 的 mb_ereg_replace_callback() 函数中发现一个用来执行 regex 搜索的双重释放缺陷。此缺陷可能导致 PHP 应用程序崩溃。(CVE-2016-5768)

mcrypt_generic() 和 mdecrypt_generic() 函数容易受到整数溢出影响，进而导致基于堆的溢出。远程攻击者可利用此缺陷造成 PHP 应用程序崩溃，或可能以运行该 PHP 应用程序的用户权限执行任意代码。(CVE-2016-5769)

在 SPLFileObject fread() 函数中发现一个类型混淆问题。如果远程攻击者能够向使用此功能的 PHP 应用程序提交特别构建的输入，则可利用此缺陷，以运行该 PHP 应用程序的用户权限执行任意代码。(CVE-2016-5770)

已发现一个释放后使用漏洞，针对不受信任的输入调用 unserialize() 将触发此漏洞。远程攻击者可利用此缺陷造成 PHP 应用程序崩溃，如果该 PHP 应用程序未序列化不受信任的输入，则还能以运行该应用程序的用户权限执行任意代码。（CVE-2016-5771、CVE-2016-5773）

当尝试从用户的请求中反序列化恶意 XML 输入时，wddx_deserialize() 可发生双重释放。此缺陷可能导致 PHP 应用程序崩溃。(CVE-2016-5772)

已发现 PHP 未正确保护 HTTP_PROXY 变量名称，使其不发生冲突。远程攻击者可能利用此缺陷，通过恶意 HTTP 请求，将 PHP 脚本执行的 HTTP 请求重定向至受攻击者控制的代理。
(CVE-2016-5385)

（更新于 2016 年 8 月 17 日：CVE-2016-5385 已在此版本中修复，但先前不是此勘误表的一部分）

Versions of PHP 5.5.x prior to 5.5.37, or 5.6.x prior to 5.6.23, or 7.0.x prior to 7.0.8 are vulnerable to the following issues :

 - PHP 'ext/mysqlnd/mysqlnd.c' contains a flaw that is due to the program failing to properly enforce the requirement of an SSL/TLS connection when the '--ssl client' option is used. This may allow a MitM (Man-in-the-Middle) attacker to downgrade the connection to plain HTTP when expected to be HTTPS. (CVE-2015-8838)
 - An integer overflow condition exists in the 'getFromIndex()'' and 'getFromName()' methods of 'ZipArchive'. The issue is triggered as user-supplied input is not properly validated when handling a specially crafted ZIP file. This may allow an attacker to cause a heap-based buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code. (CVE-2016-3078)
 - An XXE (Xml eXternal Entity) injection and expansion flaw affects the 'libxml_disable_entity_loader()' function in the source file 'ext/libxml/libxml.c' in PHP-FPM that is triggered during the parsing of XML data. The issue is due to an incorrectly configured XML parser accepting XML external entities from an untrusted source. By sending specially crafted XML data, a remote attacker can gain access to sensitive information or cause a denial of service. (CVE-2015-8866)
 - An integer overflow condition exists in the 'php_filter_encode_url()' function in 'ext/filter/sanitizing_filters.c'. The issue is triggered as user-supplied input is not properly validated. This may allow a remote attacker to cause a heap-based buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code. (CVE-2016-4345)
 - An integer overflow condition exists in 'ext/standard/string.c'. The issue is triggered as user-supplied input is not properly validated. This may allow a remote attacker to cause a heap-based buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code. (CVE-2016-4346)
 - The program contains an out-of-bounds read flaw in 'ext/intl/grapheme/grapheme_string.c' that is triggered when handling negative offsets in 'zif_grapheme_stripos'. This may allow a remote attacker to crash a process utilizing the language or potentially disclose memory contents. (CVE-2016-4540, CVE-2016-4541)
 - An out-of-bounds read flaw exists in the 'php_str2num()' function in 'ext/bcmath/bcmath.c' that is triggered when accepting negative scales. This may allow a remote attacker to crash a process utilizing the language or potentially disclose memory contents. (CVE-2016-4537, CVE-2016-4538)
 - An out-of-bounds read flaw exists in the 'exif_read_data()' function in 'ext/exif/exif.c' that is triggered when handling exif headers. This may allow a remote attacker to crash a process utilizing the language or potentially disclose memory contents. (CVE-2016-4542, CVE-2016-4543, CVE-2016-4544)
 - A flaw in the 'xml_parse_into_struct()' function in 'ext/xml/xml.c' is triggered during the handling of a specially crafted XML content. This may allow a remote attacker to cause a denial of service. (CVE-2016-4539)
 - A double-free flaw exists in the 'php_formatted_print()' function in 'ext/standard/formatted_print.c'. This may allow an attacker to have an unspecified impact. (CVE-2015-8880)
 - A flaw exists in 'main/php_open_temporary_file.c' that is triggered as thread safety is not ensured during the handling of temporary directories. This may allow a remote attacker to cause a denial of service. (CVE-2015-8878)
 - An integer overflow flaw exists in the 'php_html_entities()' and 'php_filter_full_special_chars()' functions in 'ext/standard/html.c' that is triggered as input is not properly validated. This may allow a remote attacker to have an unspecified impact. No further details have been provided. (CVE-2016-5094, CVE-2016-5095)
 - An integer underflow issue exists in 'ext/standard/file.c' that is triggered as input is not properly validated. This may allow a remote attacker to cause a NULL write and cause a process linked against PHP to crash. (CVE-2016-5096)
 - An out-of-bounds read flaw exists in the '_gdContributionsCalc()' function in 'ext/gd/libgd/gd_interpolation.c'. This may allow a context-dependent attacker to crash a process linked against the library or potentially disclose memory contents. (CVE-2013-7456)
 - An out-of-bounds read flaw exists in the 'get_icu_value_internal()' function within 'ext/intl/locale/locale_methods.c' that is triggered when handling user-supplied input. This may allow a remote attacker to crash a process linked against the library or potentially disclose memory contents. (CVE-2016-5093)
 - A flaw exists that allows a cross-site scripting (XSS) attack. This flaw exists because the 'header()' function does not filter input passed via HTTP headers before returning it to users. This may allow a remote attacker to create a specially crafted request that would execute arbitrary script code in a user's browser session within the trust relationship between their browser and the server. (CVE-2015-8935)
 - A use-after-free error exists in the garbage collection algorithm in 'ext/zip/php_zip.c'. This may allow a remote attacker to dereference already freed memory and potentially execute arbitrary code. (CVE-2016-5773)
 - An integer overflow condition exists in the 'json_decode()' and 'json_utf8_to_utf16()' functions in 'ext/standard/php_smart_str.h'. The issue is triggered as user-supplied input is not properly validated. This may allow a remote attacker to cause a heap-based buffer overflow, causing a denial of service in a process linked against PHP or potentially allowing the execution of arbitrary code.
 - An out-of-bounds read flaw exists within the 'pass2_no_dither()' function inside 'ext/gd/libgd/gd_topal.c' that may allow a remote attacker to crash a process utilizing PHP or potentially disclose memory contents.
 - An integer overflow condition exists in 'ext/standard/string.c'. The issue is triggered as user-supplied input is not properly validated when handling string lengths. This may allow a remote attacker to have an unspecified impact.
 - A double-free flaw exists within the '_php_mb_regex_ereg_replace_exec()' function inside 'ext/mbstring/php_mbregex.c' that is triggered when handling a failed callback execution. This may allow a remote attacker to potentially execute arbitrary code. (CVE-2016-5768)
 - An integer overflow condition exists in 'ext/spl/spl_directory.c'. The issue is triggered by an 'int/size_t' confusion issue. This may allow a remote attacker to have an unspecified impact. (CVE-2016-5770)
 - An integer overflow condition exists in 'ext/mcrypt/mcrypt.c'. The issue is triggered as user-supplied input is not properly validated when handling data values. This may allow a remote attacker to cause a heap-based buffer overflow, resulting in a denial of service in a process linked against PHP or potentially allowing the execution of arbitrary code. (CVE-2016-5769)
 - An integer overflow condition exists within the 'nl2br()' function inside 'ext/standard/string.c'. The issue is triggered as user-supplied input is not properly validated when handling new_length values. This may allow a remote attacker to have an unspecified impact.
 - An integer overflow condition exists within multiple functions in 'ext/standard/string.c'. The issue is triggered as user-supplied input is not properly validated when handling string values. This may allow a remote attacker to have an unspecified impact.
 - A double-free flaw within the 'php_wddx_process_data()' function inside 'ext/wddx/wddx.c' that is triggered during the handling of specially crafted XML content. This may allow a remote attacker to potentially execute arbitrary code. (CVE-2016-5772)
 - An integer overflow condition exists witin the 'gdImagePaletteToTrueColor()' function inside 'ext/gd/libgd/gd.c'. The issue is triggered as user-supplied input is not properly validated. This may allow a remote attacker to cause a heap-based buffer overflow, resulting in a denial of service in a process linked against PHP or potentially allowing the execution of arbitrary code. (CVE-2016-5767)
 - An invalid free flaw exists within the 'phar_extract_file()' function inside 'ext/phar/phar_object.c'. This may allow a remote attacker to have an unspecified impact. (CVE-2016-4473)
 - An integer overflow condition exists within the '_gd2GetHeader()' function inside 'ext/gd/libgd/gd_gd2.c'. The issue is triggered as user-supplied input is not properly validated. This may allow a remote attacker to cause a heap-based buffer overflow, resulting in a denial of service in a process linked against PHP or potentially allowing the execution of arbitrary code. (CVE-2016-5766)
 - A use-after-free error exists within the garbage collection algorithm inside 'ext/spl/spl_array.c'. This may allow a remote attacker to dereference already freed memory and potentially execute arbitrary code. (CVE-2016-5771)

ID	Name	Product	Family	Published	Updated	Severity
144294	Scientific Linux 安全更新：SL7.x i686/x86_64 上的 gd (2020:5443)	Nessus	Scientific Linux Local Security Checks	12/15/2020	2/1/2024	high
144370	CentOS 7：gd (RHSA-2020:5443)	Nessus	CentOS Local Security Checks	12/17/2020	10/9/2024	high
92663	Amazon Linux AMI：php55 / php56 (ALAS-2016-728)	Nessus	Amazon Linux Local Security Checks	8/2/2016	4/18/2018	critical
9393	PHP 5.5.x < 5.5.37 / 5.6.x < 5.6.23 / 7.0.x < 7.0.8 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	7/13/2016	3/6/2019	high

Detections

Analytics

Plugins Search

high

high

critical

high