ID CVE-2012-2386
Summary Integer overflow in the phar_parse_tarfile function in tar.c in the phar extension in PHP before 5.3.14 and 5.4.x before 5.4.4 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted tar file that triggers a heap-based buffer overflow.
References
Vulnerable Configurations
  • PHP 5.3.12
    cpe:2.3:a:php:php:5.3.12
  • PHP 5.3.11
    cpe:2.3:a:php:php:5.3.11
  • PHP 5.3.10
    cpe:2.3:a:php:php:5.3.10
  • PHP 5.3.8
    cpe:2.3:a:php:php:5.3.8
  • PHP 5.3.2
    cpe:2.3:a:php:php:5.3.2
  • PHP 5.3.6
    cpe:2.3:a:php:php:5.3.6
  • PHP 5.3.1
    cpe:2.3:a:php:php:5.3.1
  • PHP 5.3.5
    cpe:2.3:a:php:php:5.3.5
  • PHP 5.3.3
    cpe:2.3:a:php:php:5.3.3
  • PHP 5.3.7
    cpe:2.3:a:php:php:5.3.7
  • PHP 5.3.0
    cpe:2.3:a:php:php:5.3.0
  • PHP 5.3.4
    cpe:2.3:a:php:php:5.3.4
  • PHP 5.3.9
    cpe:2.3:a:php:php:5.3.9
  • PHP 5.2.5
    cpe:2.3:a:php:php:5.2.5
  • PHP 5.2.11
    cpe:2.3:a:php:php:5.2.11
  • PHP 5.2.8
    cpe:2.3:a:php:php:5.2.8
  • PHP 5.2.6
    cpe:2.3:a:php:php:5.2.6
  • PHP 5.2.9
    cpe:2.3:a:php:php:5.2.9
  • PHP 5.2.12
    cpe:2.3:a:php:php:5.2.12
  • PHP 5.2.13
    cpe:2.3:a:php:php:5.2.13
  • PHP 5.2.0
    cpe:2.3:a:php:php:5.2.0
  • PHP 5.2.3
    cpe:2.3:a:php:php:5.2.3
  • PHP 5.2.1
    cpe:2.3:a:php:php:5.2.1
  • PHP 5.2.2
    cpe:2.3:a:php:php:5.2.2
  • PHP 5.2.17
    cpe:2.3:a:php:php:5.2.17
  • PHP 5.2.10
    cpe:2.3:a:php:php:5.2.10
  • PHP 5.2.4
    cpe:2.3:a:php:php:5.2.4
  • PHP 5.2.7
    cpe:2.3:a:php:php:5.2.7
  • PHP 5.2.15
    cpe:2.3:a:php:php:5.2.15
  • PHP 5.2.16
    cpe:2.3:a:php:php:5.2.16
  • PHP 5.2.14
    cpe:2.3:a:php:php:5.2.14
  • PHP PHP 5.1.3
    cpe:2.3:a:php:php:5.1.3
  • PHP PHP 5.1.2
    cpe:2.3:a:php:php:5.1.2
  • PHP PHP 5.1.1
    cpe:2.3:a:php:php:5.1.1
  • PHP PHP 5.1.0
    cpe:2.3:a:php:php:5.1.0
  • PHP PHP 5.1.6
    cpe:2.3:a:php:php:5.1.6
  • PHP 5.1.4
    cpe:2.3:a:php:php:5.1.4
  • PHP PHP 5.1.5
    cpe:2.3:a:php:php:5.1.5
  • PHP PHP 5.0.0
    cpe:2.3:a:php:php:5.0.0
  • PHP PHP 5.0.0 Beta1
    cpe:2.3:a:php:php:5.0.0:beta1
  • PHP PHP 5.0.5
    cpe:2.3:a:php:php:5.0.5
  • PHP PHP 5.0.4
    cpe:2.3:a:php:php:5.0.4
  • PHP PHP 5.0.3
    cpe:2.3:a:php:php:5.0.3
  • PHP PHP 5.0.0 RC1
    cpe:2.3:a:php:php:5.0.0:rc1
  • PHP PHP 5.0.0 Beta4
    cpe:2.3:a:php:php:5.0.0:beta4
  • PHP PHP 5.0.0 Beta3
    cpe:2.3:a:php:php:5.0.0:beta3
  • PHP PHP 5.0.0 Beta2
    cpe:2.3:a:php:php:5.0.0:beta2
  • PHP PHP 5.0.2
    cpe:2.3:a:php:php:5.0.2
  • PHP PHP 5.0.1
    cpe:2.3:a:php:php:5.0.1
  • PHP PHP 5.0.0 RC3
    cpe:2.3:a:php:php:5.0.0:rc3
  • PHP PHP 5.0.0 RC2
    cpe:2.3:a:php:php:5.0.0:rc2
  • PHP PHP 4.3.10
    cpe:2.3:a:php:php:4.3.10
  • PHP PHP 4.3.1
    cpe:2.3:a:php:php:4.3.1
  • PHP PHP 4.3.2
    cpe:2.3:a:php:php:4.3.2
  • PHP PHP 4.3.11
    cpe:2.3:a:php:php:4.3.11
  • PHP PHP 4.3.4
    cpe:2.3:a:php:php:4.3.4
  • PHP PHP 4.3.3
    cpe:2.3:a:php:php:4.3.3
  • PHP PHP 4.3.6
    cpe:2.3:a:php:php:4.3.6
  • PHP PHP 4.3.5
    cpe:2.3:a:php:php:4.3.5
  • PHP PHP 4.2.1
    cpe:2.3:a:php:php:4.2.1
  • PHP PHP 4.2.0
    cpe:2.3:a:php:php:4.2.0
  • PHP PHP 4.2.3
    cpe:2.3:a:php:php:4.2.3
  • PHP PHP 4.2.2
    cpe:2.3:a:php:php:4.2.2
  • PHP PHP 4.4.5
    cpe:2.3:a:php:php:4.4.5
  • PHP PHP 4.4.6
    cpe:2.3:a:php:php:4.4.6
  • PHP PHP 4.4.7
    cpe:2.3:a:php:php:4.4.7
  • PHP PHP 4.3.7
    cpe:2.3:a:php:php:4.3.7
  • PHP PHP 4.3.8
    cpe:2.3:a:php:php:4.3.8
  • PHP PHP 4.3.9
    cpe:2.3:a:php:php:4.3.9
  • PHP PHP 4.4.0
    cpe:2.3:a:php:php:4.4.0
  • PHP PHP 4.4.1
    cpe:2.3:a:php:php:4.4.1
  • PHP PHP 4.4.2
    cpe:2.3:a:php:php:4.4.2
  • PHP PHP 4.4.3
    cpe:2.3:a:php:php:4.4.3
  • PHP PHP 4.4.4
    cpe:2.3:a:php:php:4.4.4
  • PHP 4.4.8
    cpe:2.3:a:php:php:4.4.8
  • PHP 4.4.9
    cpe:2.3:a:php:php:4.4.9
  • PHP PHP 4.3.0
    cpe:2.3:a:php:php:4.3.0
  • PHP PHP 4.0 Beta 1
    cpe:2.3:a:php:php:4.0:beta1
  • PHP PHP 4.0 Beta 2
    cpe:2.3:a:php:php:4.0:beta2
  • PHP PHP 4.0.1
    cpe:2.3:a:php:php:4.0.1
  • PHP PHP 4.0.0
    cpe:2.3:a:php:php:4.0.0
  • PHP PHP 4.0 Beta 4 Patch Level 1
    cpe:2.3:a:php:php:4.0:beta_4_patch1
  • PHP PHP 4.0 Beta 3
    cpe:2.3:a:php:php:4.0:beta3
  • PHP PHP 4.0 Beta 4
    cpe:2.3:a:php:php:4.0:beta4
  • PHP PHP 4.0.6
    cpe:2.3:a:php:php:4.0.6
  • PHP PHP 4.0.5
    cpe:2.3:a:php:php:4.0.5
  • PHP PHP 4.0.4
    cpe:2.3:a:php:php:4.0.4
  • PHP PHP 4.0.3
    cpe:2.3:a:php:php:4.0.3
  • PHP PHP 4.0.2
    cpe:2.3:a:php:php:4.0.2
  • PHP PHP 4.1.2
    cpe:2.3:a:php:php:4.1.2
  • PHP PHP 4.1.1
    cpe:2.3:a:php:php:4.1.1
  • PHP PHP 4.1.0
    cpe:2.3:a:php:php:4.1.0
  • PHP PHP 4.0.7
    cpe:2.3:a:php:php:4.0.7
  • PHP PHP 3.0.11
    cpe:2.3:a:php:php:3.0.11
  • PHP PHP 3.0.10
    cpe:2.3:a:php:php:3.0.10
  • PHP PHP 3.0.13
    cpe:2.3:a:php:php:3.0.13
  • PHP PHP 3.0.12
    cpe:2.3:a:php:php:3.0.12
  • PHP PHP 3.0.1
    cpe:2.3:a:php:php:3.0.1
  • PHP PHP 3.0
    cpe:2.3:a:php:php:3.0
  • PHP PHP 3.0.2
    cpe:2.3:a:php:php:3.0.2
  • PHP PHP 3.0.18
    cpe:2.3:a:php:php:3.0.18
  • PHP PHP 3.0.4
    cpe:2.3:a:php:php:3.0.4
  • PHP PHP 3.0.3
    cpe:2.3:a:php:php:3.0.3
  • PHP PHP 3.0.15
    cpe:2.3:a:php:php:3.0.15
  • PHP PHP 3.0.14
    cpe:2.3:a:php:php:3.0.14
  • PHP PHP 3.0.17
    cpe:2.3:a:php:php:3.0.17
  • PHP PHP 3.0.16
    cpe:2.3:a:php:php:3.0.16
  • PHP PHP 3.0.9
    cpe:2.3:a:php:php:3.0.9
  • PHP PHP 3.0.7
    cpe:2.3:a:php:php:3.0.7
  • PHP PHP 3.0.8
    cpe:2.3:a:php:php:3.0.8
  • PHP PHP 3.0.5
    cpe:2.3:a:php:php:3.0.5
  • PHP PHP 3.0.6
    cpe:2.3:a:php:php:3.0.6
  • PHP PHP_FI 2.0b10
    cpe:2.3:a:php:php:2.0b10
  • PHP PHP_FI 2.0
    cpe:2.3:a:php:php:2.0
  • PHP PHP_FI 1.0
    cpe:2.3:a:php:php:1.0
  • PHP 5.4.0
    cpe:2.3:a:php:php:5.4.0
  • cpe:2.3:a:php:php:5.4.0:beta2
    cpe:2.3:a:php:php:5.4.0:beta2
  • PHP 5.4.1
    cpe:2.3:a:php:php:5.4.1
  • PHP 5.4.2
    cpe:2.3:a:php:php:5.4.2
CVSS
Base: 7.5 (as of 09-07-2012 - 09:50)
Impact:
Exploitability:
CWE CWE-189
CAPEC
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL PARTIAL
exploit-db via4
description PHP phar extension 1.1.1 - Heap Overflow. CVE-2012-2386. Dos exploits for multiple platform
id EDB-ID:17201
last seen 2016-02-02
modified 2011-04-22
published 2011-04-22
reporter Alexander Gavrun
source https://www.exploit-db.com/download/17201/
title PHP phar extension 1.1.1 - Heap Overflow
nessus via4
  • NASL family MacOS X Local Security Checks
    NASL id MACOSX_10_7_5.NASL
    description The remote host is running a version of Mac OS X 10.7.x that is prior to 10.7.5. The newer version contains multiple security-related fixes for the following components : - Apache - BIND - CoreText - Data Security - ImageIO - Installer - International Components for Unicode - Kernel - Mail - PHP - Profile Manager - QuickLook - QuickTime - Ruby - USB
    last seen 2019-02-21
    modified 2018-07-16
    plugin id 62214
    published 2012-09-20
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=62214
    title Mac OS X 10.7.x < 10.7.5 Multiple Vulnerabilities (BEAST)
  • NASL family MacOS X Local Security Checks
    NASL id MACOSX_SECUPD2012-004.NASL
    description The remote host is running a version of Mac OS X 10.6 that does not have Security Update 2012-004 applied. This update contains multiple security-related fixes for the following components : - Apache - Data Security - DirectoryService - ImageIO - International Components for Unicode - Mail - PHP - QuickLook - QuickTime - Ruby
    last seen 2019-02-21
    modified 2018-07-16
    plugin id 62213
    published 2012-09-20
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=62213
    title Mac OS X Multiple Vulnerabilities (Security Update 2012-004) (BEAST)
  • NASL family SuSE Local Security Checks
    NASL id OPENSUSE-2012-311.NASL
    description Specially crafted tar archives could cause an integer overflow in the phar extension
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 74645
    published 2014-06-13
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=74645
    title openSUSE Security Update : php5 (openSUSE-SU-2012:0695-1)
  • NASL family Gentoo Local Security Checks
    NASL id GENTOO_GLSA-201209-03.NASL
    description The remote host is affected by the vulnerability described in GLSA-201209-03 (PHP: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in PHP. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could execute arbitrary code with the privileges of the process, cause a Denial of Service condition, obtain sensitive information, create arbitrary files, conduct directory traversal attacks, bypass protection mechanisms, or perform further attacks with unspecified impact. Workaround : There is no known workaround at this time.
    last seen 2019-02-21
    modified 2018-07-12
    plugin id 62236
    published 2012-09-24
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=62236
    title GLSA-201209-03 : PHP: Multiple vulnerabilities
  • NASL family CGI abuses
    NASL id PHP_5_4_4.NASL
    description According to its banner, the version of PHP installed on the remote host is 5.4.x earlier than 5.4.4, and as such is potentially affected the following vulnerabilities : - An integer overflow error exists in the function 'phar_parse_tarfile' in the file 'ext/phar/tar.c'. This error can lead to a heap-based buffer overflow when handling a maliciously crafted TAR files. Arbitrary code execution is possible due to this error. (CVE-2012-2386) - A weakness exists in the 'crypt' function related to the DES implementation that can allow brute-force attacks. (CVE-2012-2143) - Several design errors involving the incorrect parsing of PHP PDO prepared statements could lead to disclosure of sensitive information or denial of service. (CVE-2012-3450)
    last seen 2019-02-21
    modified 2018-11-15
    plugin id 59530
    published 2012-06-15
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=59530
    title PHP 5.4.x < 5.4.4 Multiple Vulnerabilities
  • NASL family Debian Local Security Checks
    NASL id DEBIAN_DSA-2492.NASL
    description The Phar extension for PHP does not properly handle crafted tar files, leading to a heap-based buffer overflow. PHP applications processing tar files could crash or, potentially, execute arbitrary code. In addition, this update addresses a regression which caused a crash when accessing a global object that is returned as $this from __get.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 59770
    published 2012-06-29
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=59770
    title Debian DSA-2492-1 : php5 - buffer overflow
  • NASL family CGI abuses
    NASL id PHP_5_3_14.NASL
    description According to its banner, the version of PHP installed on the remote host is 5.3.x earlier than 5.3.14, and is, therefore, potentially affected the following vulnerabilities : - An integer overflow error exists in the function 'phar_parse_tarfile' in the file 'ext/phar/tar.c'. This error can lead to a heap-based buffer overflow when handling a maliciously crafted TAR file. Arbitrary code execution is possible due to this error. (CVE-2012-2386) - A weakness exists in the 'crypt' function related to the DES implementation that can allow brute-force attacks. (CVE-2012-2143) - Several design errors involving the incorrect parsing of PHP PDO prepared statements could lead to disclosure of sensitive information or denial of service. (CVE-2012-3450) - A variable initialization error exists in the file 'ext/openssl/openssl.c' that can allow process memory contents to be disclosed when input data is of length zero. (CVE-2012-6113)
    last seen 2019-02-21
    modified 2018-11-15
    plugin id 59529
    published 2012-06-15
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=59529
    title PHP 5.3.x < 5.3.14 Multiple Vulnerabilities
  • NASL family Fedora Local Security Checks
    NASL id FEDORA_2012-9490.NASL
    description The PHP development team would like to announce the immediate availability of PHP 5.4.4. All users of PHP are encouraged to upgrade to PHP 5.4.4. The release fixes multiple security issues: A weakness in the DES implementation of crypt and a heap overflow issue in the phar extension. PHP 5.4.4 fixes over 30 bugs. Please note that the use of php://fd streams is now restricted to the CLI SAPI Changelog: http://www.php.net/ChangeLog-5.php#5.4.4 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2015-10-20
    plugin id 59801
    published 2012-07-01
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=59801
    title Fedora 17 : maniadrive-1.2-41.fc17 / php-5.4.4-1.fc17 (2012-9490)
  • NASL family Amazon Linux Local Security Checks
    NASL id ALA_ALAS-2012-95.NASL
    description Integer overflow in the phar_parse_tarfile function in tar.c in the phar extension in PHP before 5.3.14 and 5.4.x before 5.4.4 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted tar file that triggers a heap-based buffer overflow. The crypt_des (aka DES-based crypt) function in FreeBSD before 9.0-RELEASE-p2, as used in PHP, PostgreSQL, and other products, does not process the complete cleartext password if this password contains a 0x80 character, which makes it easier for context-dependent attackers to obtain access via an authentication attempt with an initial substring of the intended password, as demonstrated by a Unicode password.
    last seen 2019-02-21
    modified 2018-04-18
    plugin id 69702
    published 2013-09-04
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=69702
    title Amazon Linux AMI : php (ALAS-2012-95)
  • NASL family MacOS X Local Security Checks
    NASL id MACOSX_10_8_2.NASL
    description The remote host is running a version of Mac OS X 10.8.x that is prior to 10.8.2. The newer version contains multiple security-related fixes for the following components : - BIND - Data Security - LoginWindow - Mobile Accounts - PHP
    last seen 2019-02-21
    modified 2018-07-16
    plugin id 62215
    published 2012-09-20
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=62215
    title Mac OS X 10.8.x < 10.8.2 Multiple Vulnerabilities
  • NASL family SuSE Local Security Checks
    NASL id SUSE_11_APACHE2-MOD_PHP53-120618.NASL
    description PHP5 was updated with incremental fixes to the previous update. - Additional unsafe cgi wrapper scripts are also fixed now. (CVE-2012-2335) - Even more commandline option handling is filtered, which could lead to crashes of the php interpreter. (CVE-2012-2336) - heap-based buffer overflow in php's phar extension. (CVE-2012-2386) - The crypt() implementation ignored wide characters, leading to shorter effective password lengths. Note: With this update applied affected passwords will no longer work and need to be set again. (CVE-2012-2143)
    last seen 2019-02-21
    modified 2013-10-25
    plugin id 64104
    published 2013-01-25
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=64104
    title SuSE 11.2 Security Update : PHP5 (SAT Patch Number 6440)
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2012-1047.NASL
    description Updated php53 packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. It was discovered that the PHP XSL extension did not restrict the file writing capability of libxslt. A remote attacker could use this flaw to create or overwrite an arbitrary file that is writable by the user running PHP, if a PHP script processed untrusted eXtensible Style Sheet Language Transformations (XSLT) content. (CVE-2012-0057) Note: This update disables file writing by default. A new PHP configuration directive, 'xsl.security_prefs', can be used to enable file writing in XSLT. A flaw was found in the way PHP validated file names in file upload requests. A remote attacker could possibly use this flaw to bypass the sanitization of the uploaded file names, and cause a PHP script to store the uploaded file in an unexpected directory, by using a directory traversal attack. (CVE-2012-1172) Multiple integer overflow flaws, leading to heap-based buffer overflows, were found in the way the PHP phar extension processed certain fields of tar archive files. A remote attacker could provide a specially crafted tar archive file that, when processed by a PHP application using the phar extension, could cause the application to crash or, potentially, execute arbitrary code with the privileges of the user running PHP. (CVE-2012-2386) A format string flaw was found in the way the PHP phar extension processed certain PHAR files. A remote attacker could provide a specially crafted PHAR file, which once processed in a PHP application using the phar extension, could lead to information disclosure and possibly arbitrary code execution via a crafted phar:// URI. (CVE-2010-2950) A flaw was found in the DES algorithm implementation in the crypt() password hashing function in PHP. If the password string to be hashed contained certain characters, the remainder of the string was ignored when calculating the hash, significantly reducing the password strength. (CVE-2012-2143) Note: With this update, passwords are no longer truncated when performing DES hashing. Therefore, new hashes of the affected passwords will not match stored hashes generated using vulnerable PHP versions, and will need to be updated. It was discovered that the fix for CVE-2012-1823, released via RHSA-2012:0547, did not properly filter all php-cgi command line arguments. A specially crafted request to a PHP script could cause the PHP interpreter to execute the script in a loop, or output usage information that triggers an Internal Server Error. (CVE-2012-2336) A memory leak flaw was found in the PHP strtotime() function call. A remote attacker could possibly use this flaw to cause excessive memory consumption by triggering many strtotime() function calls. (CVE-2012-0789) It was found that PHP did not check the zend_strndup() function's return value in certain cases. A remote attacker could possibly use this flaw to crash a PHP application. (CVE-2011-4153) Upstream acknowledges Rubin Xu and Joseph Bonneau as the original reporters of CVE-2012-2143. All php53 users should upgrade to these updated packages, which contain backported patches to resolve these issues. After installing the updated packages, the httpd daemon must be restarted for the update to take effect.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 59753
    published 2012-06-28
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=59753
    title RHEL 5 : php53 (RHSA-2012:1047)
  • NASL family Scientific Linux Local Security Checks
    NASL id SL_20120627_PHP53_ON_SL5_X.NASL
    description PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. It was discovered that the PHP XSL extension did not restrict the file writing capability of libxslt. A remote attacker could use this flaw to create or overwrite an arbitrary file that is writable by the user running PHP, if a PHP script processed untrusted eXtensible Style Sheet Language Transformations (XSLT) content. (CVE-2012-0057) Note: This update disables file writing by default. A new PHP configuration directive, 'xsl.security_prefs', can be used to enable file writing in XSLT. A flaw was found in the way PHP validated file names in file upload requests. A remote attacker could possibly use this flaw to bypass the sanitization of the uploaded file names, and cause a PHP script to store the uploaded file in an unexpected directory, by using a directory traversal attack. (CVE-2012-1172) Multiple integer overflow flaws, leading to heap-based buffer overflows, were found in the way the PHP phar extension processed certain fields of tar archive files. A remote attacker could provide a specially crafted tar archive file that, when processed by a PHP application using the phar extension, could cause the application to crash or, potentially, execute arbitrary code with the privileges of the user running PHP. (CVE-2012-2386) A format string flaw was found in the way the PHP phar extension processed certain PHAR files. A remote attacker could provide a specially crafted PHAR file, which once processed in a PHP application using the phar extension, could lead to information disclosure and possibly arbitrary code execution via a crafted phar:// URI. (CVE-2010-2950) A flaw was found in the DES algorithm implementation in the crypt() password hashing function in PHP. If the password string to be hashed contained certain characters, the remainder of the string was ignored when calculating the hash, significantly reducing the password strength. (CVE-2012-2143) Note: With this update, passwords are no longer truncated when performing DES hashing. Therefore, new hashes of the affected passwords will not match stored hashes generated using vulnerable PHP versions, and will need to be updated. It was discovered that the fix for CVE-2012-1823, released via a previous update, did not properly filter all php-cgi command line arguments. A specially crafted request to a PHP script could cause the PHP interpreter to execute the script in a loop, or output usage information that triggers an Internal Server Error. (CVE-2012-2336) A memory leak flaw was found in the PHP strtotime() function call. A remote attacker could possibly use this flaw to cause excessive memory consumption by triggering many strtotime() function calls. (CVE-2012-0789) It was found that PHP did not check the zend_strndup() function's return value in certain cases. A remote attacker could possibly use this flaw to crash a PHP application. (CVE-2011-4153) All php53 users should upgrade to these updated packages, which contain backported patches to resolve these issues. After installing the updated packages, the httpd daemon must be restarted for the update to take effect.
    last seen 2019-02-21
    modified 2018-12-31
    plugin id 61356
    published 2012-08-01
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=61356
    title Scientific Linux Security Update : php53 on SL5.x i386/x86_64
  • NASL family Ubuntu Local Security Checks
    NASL id UBUNTU_USN-1481-1.NASL
    description It was discovered that PHP incorrectly handled certain Tidy::diagnose operations on invalid objects. A remote attacker could use this flaw to cause PHP to crash, leading to a denial of service. (CVE-2012-0781) It was discovered that PHP incorrectly handled certain multi-file upload filenames. A remote attacker could use this flaw to cause a denial of service, or to perform a directory traversal attack. (CVE-2012-1172) Rubin Xu and Joseph Bonneau discovered that PHP incorrectly handled certain Unicode characters in passwords passed to the crypt() function. A remote attacker could possibly use this flaw to bypass authentication. (CVE-2012-2143) It was discovered that a Debian/Ubuntu specific patch caused PHP to incorrectly handle empty salt strings. A remote attacker could possibly use this flaw to bypass authentication. This issue only affected Ubuntu 10.04 LTS and Ubuntu 11.04. (CVE-2012-2317) It was discovered that PHP, when used as a stand alone CGI processor for the Apache Web Server, did not properly parse and filter query strings. This could allow a remote attacker to execute arbitrary code running with the privilege of the web server, or to perform a denial of service. Configurations using mod_php5 and FastCGI were not vulnerable. (CVE-2012-2335, CVE-2012-2336) Alexander Gavrun discovered that the PHP Phar extension incorrectly handled certain malformed TAR files. A remote attacker could use this flaw to perform a denial of service, or possibly execute arbitrary code. (CVE-2012-2386). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-01
    plugin id 59603
    published 2012-06-20
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=59603
    title Ubuntu 8.04 LTS / 10.04 LTS / 11.04 / 11.10 / 12.04 LTS : php5 vulnerabilities (USN-1481-1)
  • NASL family Oracle Linux Local Security Checks
    NASL id ORACLELINUX_ELSA-2012-1046.NASL
    description From Red Hat Security Advisory 2012:1046 : Updated php packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. It was discovered that the PHP XSL extension did not restrict the file writing capability of libxslt. A remote attacker could use this flaw to create or overwrite an arbitrary file that is writable by the user running PHP, if a PHP script processed untrusted eXtensible Style Sheet Language Transformations (XSLT) content. (CVE-2012-0057) Note: This update disables file writing by default. A new PHP configuration directive, 'xsl.security_prefs', can be used to enable file writing in XSLT. A flaw was found in the way PHP validated file names in file upload requests. A remote attacker could possibly use this flaw to bypass the sanitization of the uploaded file names, and cause a PHP script to store the uploaded file in an unexpected directory, by using a directory traversal attack. (CVE-2012-1172) Multiple integer overflow flaws, leading to heap-based buffer overflows, were found in the way the PHP phar extension processed certain fields of tar archive files. A remote attacker could provide a specially crafted tar archive file that, when processed by a PHP application using the phar extension, could cause the application to crash or, potentially, execute arbitrary code with the privileges of the user running PHP. (CVE-2012-2386) A format string flaw was found in the way the PHP phar extension processed certain PHAR files. A remote attacker could provide a specially crafted PHAR file, which once processed in a PHP application using the phar extension, could lead to information disclosure and possibly arbitrary code execution via a crafted phar:// URI. (CVE-2010-2950) A flaw was found in the DES algorithm implementation in the crypt() password hashing function in PHP. If the password string to be hashed contained certain characters, the remainder of the string was ignored when calculating the hash, significantly reducing the password strength. (CVE-2012-2143) Note: With this update, passwords are no longer truncated when performing DES hashing. Therefore, new hashes of the affected passwords will not match stored hashes generated using vulnerable PHP versions, and will need to be updated. It was discovered that the fix for CVE-2012-1823, released via RHSA-2012:0546, did not properly filter all php-cgi command line arguments. A specially crafted request to a PHP script could cause the PHP interpreter to execute the script in a loop, or output usage information that triggers an Internal Server Error. (CVE-2012-2336) A memory leak flaw was found in the PHP strtotime() function call. A remote attacker could possibly use this flaw to cause excessive memory consumption by triggering many strtotime() function calls. (CVE-2012-0789) A NULL pointer dereference flaw was found in the PHP tidy_diagnose() function. A remote attacker could use specially crafted input to crash an application that uses tidy::diagnose. (CVE-2012-0781) It was found that PHP did not check the zend_strndup() function's return value in certain cases. A remote attacker could possibly use this flaw to crash a PHP application. (CVE-2011-4153) Upstream acknowledges Rubin Xu and Joseph Bonneau as the original reporters of CVE-2012-2143. All php users should upgrade to these updated packages, which contain backported patches to resolve these issues. After installing the updated packages, the httpd daemon must be restarted for the update to take effect.
    last seen 2019-02-21
    modified 2018-07-26
    plugin id 68570
    published 2013-07-12
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=68570
    title Oracle Linux 6 : php (ELSA-2012-1046)
  • NASL family CentOS Local Security Checks
    NASL id CENTOS_RHSA-2012-1046.NASL
    description Updated php packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. It was discovered that the PHP XSL extension did not restrict the file writing capability of libxslt. A remote attacker could use this flaw to create or overwrite an arbitrary file that is writable by the user running PHP, if a PHP script processed untrusted eXtensible Style Sheet Language Transformations (XSLT) content. (CVE-2012-0057) Note: This update disables file writing by default. A new PHP configuration directive, 'xsl.security_prefs', can be used to enable file writing in XSLT. A flaw was found in the way PHP validated file names in file upload requests. A remote attacker could possibly use this flaw to bypass the sanitization of the uploaded file names, and cause a PHP script to store the uploaded file in an unexpected directory, by using a directory traversal attack. (CVE-2012-1172) Multiple integer overflow flaws, leading to heap-based buffer overflows, were found in the way the PHP phar extension processed certain fields of tar archive files. A remote attacker could provide a specially crafted tar archive file that, when processed by a PHP application using the phar extension, could cause the application to crash or, potentially, execute arbitrary code with the privileges of the user running PHP. (CVE-2012-2386) A format string flaw was found in the way the PHP phar extension processed certain PHAR files. A remote attacker could provide a specially crafted PHAR file, which once processed in a PHP application using the phar extension, could lead to information disclosure and possibly arbitrary code execution via a crafted phar:// URI. (CVE-2010-2950) A flaw was found in the DES algorithm implementation in the crypt() password hashing function in PHP. If the password string to be hashed contained certain characters, the remainder of the string was ignored when calculating the hash, significantly reducing the password strength. (CVE-2012-2143) Note: With this update, passwords are no longer truncated when performing DES hashing. Therefore, new hashes of the affected passwords will not match stored hashes generated using vulnerable PHP versions, and will need to be updated. It was discovered that the fix for CVE-2012-1823, released via RHSA-2012:0546, did not properly filter all php-cgi command line arguments. A specially crafted request to a PHP script could cause the PHP interpreter to execute the script in a loop, or output usage information that triggers an Internal Server Error. (CVE-2012-2336) A memory leak flaw was found in the PHP strtotime() function call. A remote attacker could possibly use this flaw to cause excessive memory consumption by triggering many strtotime() function calls. (CVE-2012-0789) A NULL pointer dereference flaw was found in the PHP tidy_diagnose() function. A remote attacker could use specially crafted input to crash an application that uses tidy::diagnose. (CVE-2012-0781) It was found that PHP did not check the zend_strndup() function's return value in certain cases. A remote attacker could possibly use this flaw to crash a PHP application. (CVE-2011-4153) Upstream acknowledges Rubin Xu and Joseph Bonneau as the original reporters of CVE-2012-2143. All php users should upgrade to these updated packages, which contain backported patches to resolve these issues. After installing the updated packages, the httpd daemon must be restarted for the update to take effect.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 59938
    published 2012-07-11
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=59938
    title CentOS 6 : php (CESA-2012:1046)
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2012-1046.NASL
    description Updated php packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. It was discovered that the PHP XSL extension did not restrict the file writing capability of libxslt. A remote attacker could use this flaw to create or overwrite an arbitrary file that is writable by the user running PHP, if a PHP script processed untrusted eXtensible Style Sheet Language Transformations (XSLT) content. (CVE-2012-0057) Note: This update disables file writing by default. A new PHP configuration directive, 'xsl.security_prefs', can be used to enable file writing in XSLT. A flaw was found in the way PHP validated file names in file upload requests. A remote attacker could possibly use this flaw to bypass the sanitization of the uploaded file names, and cause a PHP script to store the uploaded file in an unexpected directory, by using a directory traversal attack. (CVE-2012-1172) Multiple integer overflow flaws, leading to heap-based buffer overflows, were found in the way the PHP phar extension processed certain fields of tar archive files. A remote attacker could provide a specially crafted tar archive file that, when processed by a PHP application using the phar extension, could cause the application to crash or, potentially, execute arbitrary code with the privileges of the user running PHP. (CVE-2012-2386) A format string flaw was found in the way the PHP phar extension processed certain PHAR files. A remote attacker could provide a specially crafted PHAR file, which once processed in a PHP application using the phar extension, could lead to information disclosure and possibly arbitrary code execution via a crafted phar:// URI. (CVE-2010-2950) A flaw was found in the DES algorithm implementation in the crypt() password hashing function in PHP. If the password string to be hashed contained certain characters, the remainder of the string was ignored when calculating the hash, significantly reducing the password strength. (CVE-2012-2143) Note: With this update, passwords are no longer truncated when performing DES hashing. Therefore, new hashes of the affected passwords will not match stored hashes generated using vulnerable PHP versions, and will need to be updated. It was discovered that the fix for CVE-2012-1823, released via RHSA-2012:0546, did not properly filter all php-cgi command line arguments. A specially crafted request to a PHP script could cause the PHP interpreter to execute the script in a loop, or output usage information that triggers an Internal Server Error. (CVE-2012-2336) A memory leak flaw was found in the PHP strtotime() function call. A remote attacker could possibly use this flaw to cause excessive memory consumption by triggering many strtotime() function calls. (CVE-2012-0789) A NULL pointer dereference flaw was found in the PHP tidy_diagnose() function. A remote attacker could use specially crafted input to crash an application that uses tidy::diagnose. (CVE-2012-0781) It was found that PHP did not check the zend_strndup() function's return value in certain cases. A remote attacker could possibly use this flaw to crash a PHP application. (CVE-2011-4153) Upstream acknowledges Rubin Xu and Joseph Bonneau as the original reporters of CVE-2012-2143. All php users should upgrade to these updated packages, which contain backported patches to resolve these issues. After installing the updated packages, the httpd daemon must be restarted for the update to take effect.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 59752
    published 2012-06-28
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=59752
    title RHEL 6 : php (RHSA-2012:1046)
  • NASL family CentOS Local Security Checks
    NASL id CENTOS_RHSA-2012-1047.NASL
    description Updated php53 packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. It was discovered that the PHP XSL extension did not restrict the file writing capability of libxslt. A remote attacker could use this flaw to create or overwrite an arbitrary file that is writable by the user running PHP, if a PHP script processed untrusted eXtensible Style Sheet Language Transformations (XSLT) content. (CVE-2012-0057) Note: This update disables file writing by default. A new PHP configuration directive, 'xsl.security_prefs', can be used to enable file writing in XSLT. A flaw was found in the way PHP validated file names in file upload requests. A remote attacker could possibly use this flaw to bypass the sanitization of the uploaded file names, and cause a PHP script to store the uploaded file in an unexpected directory, by using a directory traversal attack. (CVE-2012-1172) Multiple integer overflow flaws, leading to heap-based buffer overflows, were found in the way the PHP phar extension processed certain fields of tar archive files. A remote attacker could provide a specially crafted tar archive file that, when processed by a PHP application using the phar extension, could cause the application to crash or, potentially, execute arbitrary code with the privileges of the user running PHP. (CVE-2012-2386) A format string flaw was found in the way the PHP phar extension processed certain PHAR files. A remote attacker could provide a specially crafted PHAR file, which once processed in a PHP application using the phar extension, could lead to information disclosure and possibly arbitrary code execution via a crafted phar:// URI. (CVE-2010-2950) A flaw was found in the DES algorithm implementation in the crypt() password hashing function in PHP. If the password string to be hashed contained certain characters, the remainder of the string was ignored when calculating the hash, significantly reducing the password strength. (CVE-2012-2143) Note: With this update, passwords are no longer truncated when performing DES hashing. Therefore, new hashes of the affected passwords will not match stored hashes generated using vulnerable PHP versions, and will need to be updated. It was discovered that the fix for CVE-2012-1823, released via RHSA-2012:0547, did not properly filter all php-cgi command line arguments. A specially crafted request to a PHP script could cause the PHP interpreter to execute the script in a loop, or output usage information that triggers an Internal Server Error. (CVE-2012-2336) A memory leak flaw was found in the PHP strtotime() function call. A remote attacker could possibly use this flaw to cause excessive memory consumption by triggering many strtotime() function calls. (CVE-2012-0789) It was found that PHP did not check the zend_strndup() function's return value in certain cases. A remote attacker could possibly use this flaw to crash a PHP application. (CVE-2011-4153) Upstream acknowledges Rubin Xu and Joseph Bonneau as the original reporters of CVE-2012-2143. All php53 users should upgrade to these updated packages, which contain backported patches to resolve these issues. After installing the updated packages, the httpd daemon must be restarted for the update to take effect.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 67089
    published 2013-06-29
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=67089
    title CentOS 5 : php53 (CESA-2012:1047)
  • NASL family Oracle Linux Local Security Checks
    NASL id ORACLELINUX_ELSA-2012-1047.NASL
    description From Red Hat Security Advisory 2012:1047 : Updated php53 packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. It was discovered that the PHP XSL extension did not restrict the file writing capability of libxslt. A remote attacker could use this flaw to create or overwrite an arbitrary file that is writable by the user running PHP, if a PHP script processed untrusted eXtensible Style Sheet Language Transformations (XSLT) content. (CVE-2012-0057) Note: This update disables file writing by default. A new PHP configuration directive, 'xsl.security_prefs', can be used to enable file writing in XSLT. A flaw was found in the way PHP validated file names in file upload requests. A remote attacker could possibly use this flaw to bypass the sanitization of the uploaded file names, and cause a PHP script to store the uploaded file in an unexpected directory, by using a directory traversal attack. (CVE-2012-1172) Multiple integer overflow flaws, leading to heap-based buffer overflows, were found in the way the PHP phar extension processed certain fields of tar archive files. A remote attacker could provide a specially crafted tar archive file that, when processed by a PHP application using the phar extension, could cause the application to crash or, potentially, execute arbitrary code with the privileges of the user running PHP. (CVE-2012-2386) A format string flaw was found in the way the PHP phar extension processed certain PHAR files. A remote attacker could provide a specially crafted PHAR file, which once processed in a PHP application using the phar extension, could lead to information disclosure and possibly arbitrary code execution via a crafted phar:// URI. (CVE-2010-2950) A flaw was found in the DES algorithm implementation in the crypt() password hashing function in PHP. If the password string to be hashed contained certain characters, the remainder of the string was ignored when calculating the hash, significantly reducing the password strength. (CVE-2012-2143) Note: With this update, passwords are no longer truncated when performing DES hashing. Therefore, new hashes of the affected passwords will not match stored hashes generated using vulnerable PHP versions, and will need to be updated. It was discovered that the fix for CVE-2012-1823, released via RHSA-2012:0547, did not properly filter all php-cgi command line arguments. A specially crafted request to a PHP script could cause the PHP interpreter to execute the script in a loop, or output usage information that triggers an Internal Server Error. (CVE-2012-2336) A memory leak flaw was found in the PHP strtotime() function call. A remote attacker could possibly use this flaw to cause excessive memory consumption by triggering many strtotime() function calls. (CVE-2012-0789) It was found that PHP did not check the zend_strndup() function's return value in certain cases. A remote attacker could possibly use this flaw to crash a PHP application. (CVE-2011-4153) Upstream acknowledges Rubin Xu and Joseph Bonneau as the original reporters of CVE-2012-2143. All php53 users should upgrade to these updated packages, which contain backported patches to resolve these issues. After installing the updated packages, the httpd daemon must be restarted for the update to take effect.
    last seen 2019-02-21
    modified 2018-07-26
    plugin id 68571
    published 2013-07-12
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=68571
    title Oracle Linux 5 : php53 (ELSA-2012-1047)
  • NASL family Mandriva Local Security Checks
    NASL id MANDRIVA_MDVSA-2012-093.NASL
    description Multiple vulnerabilities has been identified and fixed in php : There is a programming error in the DES implementation used in crypt() in ext/standard/crypt_freesec.c when handling input which contains characters that can not be represented with 7-bit ASCII. When the input contains characters with only the most significant bit set (0x80), that character and all characters after it will be ignored (CVE-2012-2143). An integer overflow, leading to heap-based buffer overflow was found in the way Phar extension of the PHP scripting language processed certain fields by manipulating TAR files. A remote attacker could provide a specially crafted TAR archive file, which once processed in an PHP application using the Phar extension could lead to denial of service (application crash), or, potentially arbitary code execution with the privileges of the user running the application (CVE-2012-2386). The updated php packages have been upgraded to the 5.3.14 version which is not vulnerable to these issues.
    last seen 2019-02-21
    modified 2018-11-15
    plugin id 59519
    published 2012-06-15
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=59519
    title Mandriva Linux Security Advisory : php (MDVSA-2012:093)
  • NASL family Fedora Local Security Checks
    NASL id FEDORA_2012-9762.NASL
    description The PHP development team would like to announce the immediate availability of PHP 5.3.14. All users of PHP are encouraged to upgrade to PHP 5.3.14. The release fixes multiple security issues: A weakness in the DES implementation of crypt and a heap overflow issue in the phar extension. PHP 5.3.14 fixes over 30 bugs. Please note that the use of php://fd streams is now restricted to the CLI SAPI Changelog: http://www.php.net/ChangeLog-5.php#5.3.14 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2015-10-20
    plugin id 59827
    published 2012-07-03
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=59827
    title Fedora 16 : maniadrive-1.2-32.fc16.6 / php-5.3.14-1.fc16 / php-eaccelerator-0.9.6.1-9.fc16.6 (2012-9762)
  • NASL family Scientific Linux Local Security Checks
    NASL id SL_20120627_PHP_ON_SL6_X.NASL
    description PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. It was discovered that the PHP XSL extension did not restrict the file writing capability of libxslt. A remote attacker could use this flaw to create or overwrite an arbitrary file that is writable by the user running PHP, if a PHP script processed untrusted eXtensible Style Sheet Language Transformations (XSLT) content. (CVE-2012-0057) Note: This update disables file writing by default. A new PHP configuration directive, 'xsl.security_prefs', can be used to enable file writing in XSLT. A flaw was found in the way PHP validated file names in file upload requests. A remote attacker could possibly use this flaw to bypass the sanitization of the uploaded file names, and cause a PHP script to store the uploaded file in an unexpected directory, by using a directory traversal attack. (CVE-2012-1172) Multiple integer overflow flaws, leading to heap-based buffer overflows, were found in the way the PHP phar extension processed certain fields of tar archive files. A remote attacker could provide a specially crafted tar archive file that, when processed by a PHP application using the phar extension, could cause the application to crash or, potentially, execute arbitrary code with the privileges of the user running PHP. (CVE-2012-2386) A format string flaw was found in the way the PHP phar extension processed certain PHAR files. A remote attacker could provide a specially crafted PHAR file, which once processed in a PHP application using the phar extension, could lead to information disclosure and possibly arbitrary code execution via a crafted phar:// URI. (CVE-2010-2950) A flaw was found in the DES algorithm implementation in the crypt() password hashing function in PHP. If the password string to be hashed contained certain characters, the remainder of the string was ignored when calculating the hash, significantly reducing the password strength. (CVE-2012-2143) Note: With this update, passwords are no longer truncated when performing DES hashing. Therefore, new hashes of the affected passwords will not match stored hashes generated using vulnerable PHP versions, and will need to be updated. It was discovered that the fix for CVE-2012-1823, released via a previous update, did not properly filter all php-cgi command line arguments. A specially crafted request to a PHP script could cause the PHP interpreter to execute the script in a loop, or output usage information that triggers an Internal Server Error. (CVE-2012-2336) A memory leak flaw was found in the PHP strtotime() function call. A remote attacker could possibly use this flaw to cause excessive memory consumption by triggering many strtotime() function calls. (CVE-2012-0789) A NULL pointer dereference flaw was found in the PHP tidy_diagnose() function. A remote attacker could use specially crafted input to crash an application that uses tidy::diagnose. (CVE-2012-0781) It was found that PHP did not check the zend_strndup() function's return value in certain cases. A remote attacker could possibly use this flaw to crash a PHP application. (CVE-2011-4153) All php users should upgrade to these updated packages, which contain backported patches to resolve these issues. After installing the updated packages, the httpd daemon must be restarted for the update to take effect.
    last seen 2019-02-21
    modified 2018-12-31
    plugin id 61358
    published 2012-08-01
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=61358
    title Scientific Linux Security Update : php on SL6.x i386/x86_64
redhat via4
advisories
  • bugzilla
    id 835024
    title CVE-2010-2950 php: Format string flaw in phar extension via phar_stream_flush() (MOPS-2010-024)
    oval
    AND
    • OR
      • comment Red Hat Enterprise Linux 6 Client is installed
        oval oval:com.redhat.rhsa:tst:20100842001
      • comment Red Hat Enterprise Linux 6 Server is installed
        oval oval:com.redhat.rhsa:tst:20100842002
      • comment Red Hat Enterprise Linux 6 Workstation is installed
        oval oval:com.redhat.rhsa:tst:20100842003
      • comment Red Hat Enterprise Linux 6 ComputeNode is installed
        oval oval:com.redhat.rhsa:tst:20100842004
    • OR
      • AND
        • comment php is earlier than 0:5.3.3-14.el6_3
          oval oval:com.redhat.rhsa:tst:20121046005
        • comment php is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20110195006
      • AND
        • comment php-bcmath is earlier than 0:5.3.3-14.el6_3
          oval oval:com.redhat.rhsa:tst:20121046027
        • comment php-bcmath is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20110195048
      • AND
        • comment php-cli is earlier than 0:5.3.3-14.el6_3
          oval oval:com.redhat.rhsa:tst:20121046013
        • comment php-cli is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20110195044
      • AND
        • comment php-common is earlier than 0:5.3.3-14.el6_3
          oval oval:com.redhat.rhsa:tst:20121046031
        • comment php-common is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20110195010
      • AND
        • comment php-dba is earlier than 0:5.3.3-14.el6_3
          oval oval:com.redhat.rhsa:tst:20121046025
        • comment php-dba is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20110195054
      • AND
        • comment php-devel is earlier than 0:5.3.3-14.el6_3
          oval oval:com.redhat.rhsa:tst:20121046055
        • comment php-devel is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20110195032
      • AND
        • comment php-embedded is earlier than 0:5.3.3-14.el6_3
          oval oval:com.redhat.rhsa:tst:20121046035
        • comment php-embedded is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20110195038
      • AND
        • comment php-enchant is earlier than 0:5.3.3-14.el6_3
          oval oval:com.redhat.rhsa:tst:20121046039
        • comment php-enchant is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20110195026
      • AND
        • comment php-gd is earlier than 0:5.3.3-14.el6_3
          oval oval:com.redhat.rhsa:tst:20121046011
        • comment php-gd is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20110195056
      • AND
        • comment php-imap is earlier than 0:5.3.3-14.el6_3
          oval oval:com.redhat.rhsa:tst:20121046017
        • comment php-imap is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20110195040
      • AND
        • comment php-intl is earlier than 0:5.3.3-14.el6_3
          oval oval:com.redhat.rhsa:tst:20121046023
        • comment php-intl is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20110195030
      • AND
        • comment php-ldap is earlier than 0:5.3.3-14.el6_3
          oval oval:com.redhat.rhsa:tst:20121046051
        • comment php-ldap is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20110195046
      • AND
        • comment php-mbstring is earlier than 0:5.3.3-14.el6_3
          oval oval:com.redhat.rhsa:tst:20121046033
        • comment php-mbstring is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20110195042
      • AND
        • comment php-mysql is earlier than 0:5.3.3-14.el6_3
          oval oval:com.redhat.rhsa:tst:20121046041
        • comment php-mysql is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20110195008
      • AND
        • comment php-odbc is earlier than 0:5.3.3-14.el6_3
          oval oval:com.redhat.rhsa:tst:20121046007
        • comment php-odbc is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20110195020
      • AND
        • comment php-pdo is earlier than 0:5.3.3-14.el6_3
          oval oval:com.redhat.rhsa:tst:20121046043
        • comment php-pdo is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20110195018
      • AND
        • comment php-pgsql is earlier than 0:5.3.3-14.el6_3
          oval oval:com.redhat.rhsa:tst:20121046019
        • comment php-pgsql is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20110195014
      • AND
        • comment php-process is earlier than 0:5.3.3-14.el6_3
          oval oval:com.redhat.rhsa:tst:20121046045
        • comment php-process is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20110195016
      • AND
        • comment php-pspell is earlier than 0:5.3.3-14.el6_3
          oval oval:com.redhat.rhsa:tst:20121046053
        • comment php-pspell is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20110195028
      • AND
        • comment php-recode is earlier than 0:5.3.3-14.el6_3
          oval oval:com.redhat.rhsa:tst:20121046037
        • comment php-recode is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20110195050
      • AND
        • comment php-snmp is earlier than 0:5.3.3-14.el6_3
          oval oval:com.redhat.rhsa:tst:20121046029
        • comment php-snmp is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20110195036
      • AND
        • comment php-soap is earlier than 0:5.3.3-14.el6_3
          oval oval:com.redhat.rhsa:tst:20121046015
        • comment php-soap is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20110195024
      • AND
        • comment php-tidy is earlier than 0:5.3.3-14.el6_3
          oval oval:com.redhat.rhsa:tst:20121046021
        • comment php-tidy is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20110195012
      • AND
        • comment php-xml is earlier than 0:5.3.3-14.el6_3
          oval oval:com.redhat.rhsa:tst:20121046049
        • comment php-xml is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20110195022
      • AND
        • comment php-xmlrpc is earlier than 0:5.3.3-14.el6_3
          oval oval:com.redhat.rhsa:tst:20121046009
        • comment php-xmlrpc is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20110195052
      • AND
        • comment php-zts is earlier than 0:5.3.3-14.el6_3
          oval oval:com.redhat.rhsa:tst:20121046047
        • comment php-zts is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20110195034
    rhsa
    id RHSA-2012:1046
    released 2012-06-27
    severity Moderate
    title RHSA-2012:1046: php security update (Moderate)
  • bugzilla
    id 835024
    title CVE-2010-2950 php: Format string flaw in phar extension via phar_stream_flush() (MOPS-2010-024)
    oval
    AND
    • comment Red Hat Enterprise Linux 5 is installed
      oval oval:com.redhat.rhsa:tst:20070055001
    • OR
      • AND
        • comment php53 is earlier than 0:5.3.3-13.el5_8
          oval oval:com.redhat.rhsa:tst:20121047002
        • comment php53 is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20110196003
      • AND
        • comment php53-bcmath is earlier than 0:5.3.3-13.el5_8
          oval oval:com.redhat.rhsa:tst:20121047028
        • comment php53-bcmath is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20110196015
      • AND
        • comment php53-cli is earlier than 0:5.3.3-13.el5_8
          oval oval:com.redhat.rhsa:tst:20121047040
        • comment php53-cli is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20110196025
      • AND
        • comment php53-common is earlier than 0:5.3.3-13.el5_8
          oval oval:com.redhat.rhsa:tst:20121047034
        • comment php53-common is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20110196023
      • AND
        • comment php53-dba is earlier than 0:5.3.3-13.el5_8
          oval oval:com.redhat.rhsa:tst:20121047020
        • comment php53-dba is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20110196019
      • AND
        • comment php53-devel is earlier than 0:5.3.3-13.el5_8
          oval oval:com.redhat.rhsa:tst:20121047032
        • comment php53-devel is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20110196033
      • AND
        • comment php53-gd is earlier than 0:5.3.3-13.el5_8
          oval oval:com.redhat.rhsa:tst:20121047012
        • comment php53-gd is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20110196021
      • AND
        • comment php53-imap is earlier than 0:5.3.3-13.el5_8
          oval oval:com.redhat.rhsa:tst:20121047038
        • comment php53-imap is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20110196005
      • AND
        • comment php53-intl is earlier than 0:5.3.3-13.el5_8
          oval oval:com.redhat.rhsa:tst:20121047008
        • comment php53-intl is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20110196043
      • AND
        • comment php53-ldap is earlier than 0:5.3.3-13.el5_8
          oval oval:com.redhat.rhsa:tst:20121047024
        • comment php53-ldap is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20110196031
      • AND
        • comment php53-mbstring is earlier than 0:5.3.3-13.el5_8
          oval oval:com.redhat.rhsa:tst:20121047022
        • comment php53-mbstring is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20110196029
      • AND
        • comment php53-mysql is earlier than 0:5.3.3-13.el5_8
          oval oval:com.redhat.rhsa:tst:20121047006
        • comment php53-mysql is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20110196013
      • AND
        • comment php53-odbc is earlier than 0:5.3.3-13.el5_8
          oval oval:com.redhat.rhsa:tst:20121047036
        • comment php53-odbc is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20110196037
      • AND
        • comment php53-pdo is earlier than 0:5.3.3-13.el5_8
          oval oval:com.redhat.rhsa:tst:20121047004
        • comment php53-pdo is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20110196011
      • AND
        • comment php53-pgsql is earlier than 0:5.3.3-13.el5_8
          oval oval:com.redhat.rhsa:tst:20121047016
        • comment php53-pgsql is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20110196007
      • AND
        • comment php53-process is earlier than 0:5.3.3-13.el5_8
          oval oval:com.redhat.rhsa:tst:20121047014
        • comment php53-process is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20110196027
      • AND
        • comment php53-pspell is earlier than 0:5.3.3-13.el5_8
          oval oval:com.redhat.rhsa:tst:20121047042
        • comment php53-pspell is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20110196039
      • AND
        • comment php53-snmp is earlier than 0:5.3.3-13.el5_8
          oval oval:com.redhat.rhsa:tst:20121047018
        • comment php53-snmp is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20110196009
      • AND
        • comment php53-soap is earlier than 0:5.3.3-13.el5_8
          oval oval:com.redhat.rhsa:tst:20121047010
        • comment php53-soap is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20110196041
      • AND
        • comment php53-xml is earlier than 0:5.3.3-13.el5_8
          oval oval:com.redhat.rhsa:tst:20121047026
        • comment php53-xml is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20110196035
      • AND
        • comment php53-xmlrpc is earlier than 0:5.3.3-13.el5_8
          oval oval:com.redhat.rhsa:tst:20121047030
        • comment php53-xmlrpc is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20110196017
    rhsa
    id RHSA-2012:1047
    released 2012-06-27
    severity Moderate
    title RHSA-2012:1047: php53 security update (Moderate)
rpms
  • php-0:5.3.3-14.el6_3
  • php-bcmath-0:5.3.3-14.el6_3
  • php-cli-0:5.3.3-14.el6_3
  • php-common-0:5.3.3-14.el6_3
  • php-dba-0:5.3.3-14.el6_3
  • php-devel-0:5.3.3-14.el6_3
  • php-embedded-0:5.3.3-14.el6_3
  • php-enchant-0:5.3.3-14.el6_3
  • php-gd-0:5.3.3-14.el6_3
  • php-imap-0:5.3.3-14.el6_3
  • php-intl-0:5.3.3-14.el6_3
  • php-ldap-0:5.3.3-14.el6_3
  • php-mbstring-0:5.3.3-14.el6_3
  • php-mysql-0:5.3.3-14.el6_3
  • php-odbc-0:5.3.3-14.el6_3
  • php-pdo-0:5.3.3-14.el6_3
  • php-pgsql-0:5.3.3-14.el6_3
  • php-process-0:5.3.3-14.el6_3
  • php-pspell-0:5.3.3-14.el6_3
  • php-recode-0:5.3.3-14.el6_3
  • php-snmp-0:5.3.3-14.el6_3
  • php-soap-0:5.3.3-14.el6_3
  • php-tidy-0:5.3.3-14.el6_3
  • php-xml-0:5.3.3-14.el6_3
  • php-xmlrpc-0:5.3.3-14.el6_3
  • php-zts-0:5.3.3-14.el6_3
  • php53-0:5.3.3-13.el5_8
  • php53-bcmath-0:5.3.3-13.el5_8
  • php53-cli-0:5.3.3-13.el5_8
  • php53-common-0:5.3.3-13.el5_8
  • php53-dba-0:5.3.3-13.el5_8
  • php53-devel-0:5.3.3-13.el5_8
  • php53-gd-0:5.3.3-13.el5_8
  • php53-imap-0:5.3.3-13.el5_8
  • php53-intl-0:5.3.3-13.el5_8
  • php53-ldap-0:5.3.3-13.el5_8
  • php53-mbstring-0:5.3.3-13.el5_8
  • php53-mysql-0:5.3.3-13.el5_8
  • php53-odbc-0:5.3.3-13.el5_8
  • php53-pdo-0:5.3.3-13.el5_8
  • php53-pgsql-0:5.3.3-13.el5_8
  • php53-process-0:5.3.3-13.el5_8
  • php53-pspell-0:5.3.3-13.el5_8
  • php53-snmp-0:5.3.3-13.el5_8
  • php53-soap-0:5.3.3-13.el5_8
  • php53-xml-0:5.3.3-13.el5_8
  • php53-xmlrpc-0:5.3.3-13.el5_8
refmap via4
apple APPLE-SA-2012-09-19-2
confirm
misc http://0x1byte.blogspot.com/2011/04/php-phar-extension-heap-overflow.html
mlist [oss-security] 20120522 Re: CVE request: PHP Phar - arbitrary code execution
suse SUSE-SU-2012:0840
Last major update 21-09-2012 - 23:32
Published 07-07-2012 - 06:21
Back to Top