ID CVE-2014-0238
Summary The cdf_read_property_info function in cdf.c in the Fileinfo component in PHP before 5.4.29 and 5.5.x before 5.5.13 allows remote attackers to cause a denial of service (infinite loop or out-of-bounds memory access) via a vector that (1) has zero length or (2) is too long.
References
Vulnerable Configurations
  • PHP 5.5.12 -
    cpe:2.3:a:php:php:5.5.12
  • PHP 5.5.11 -
    cpe:2.3:a:php:php:5.5.11
  • PHP 5.5.10 -
    cpe:2.3:a:php:php:5.5.10
  • PHP 5.5.9 -
    cpe:2.3:a:php:php:5.5.9
  • PHP 5.5.8 -
    cpe:2.3:a:php:php:5.5.8
  • PHP 5.5.7 -
    cpe:2.3:a:php:php:5.5.7
  • PHP 5.5.0 alpha1
    cpe:2.3:a:php:php:5.5.0:alpha1
  • PHP 5.5.0 alpha2
    cpe:2.3:a:php:php:5.5.0:alpha2
  • PHP 5.5.0 alpha3
    cpe:2.3:a:php:php:5.5.0:alpha3
  • PHP 5.5.0 alpha4
    cpe:2.3:a:php:php:5.5.0:alpha4
  • PHP 5.5.0 alpha5
    cpe:2.3:a:php:php:5.5.0:alpha5
  • PHP 5.5.0 alpha6
    cpe:2.3:a:php:php:5.5.0:alpha6
  • PHP 5.5.0 beta1
    cpe:2.3:a:php:php:5.5.0:beta1
  • PHP 5.5.0 beta2
    cpe:2.3:a:php:php:5.5.0:beta2
  • PHP 5.5.0 beta3
    cpe:2.3:a:php:php:5.5.0:beta3
  • PHP 5.5.0 beta4
    cpe:2.3:a:php:php:5.5.0:beta4
  • PHP 5.5.0 release candidate 1
    cpe:2.3:a:php:php:5.5.0:rc1
  • PHP 5.5.0 release candidate 2
    cpe:2.3:a:php:php:5.5.0:rc2
  • PHP 5.5.1
    cpe:2.3:a:php:php:5.5.1
  • PHP 5.5.2 -
    cpe:2.3:a:php:php:5.5.2
  • PHP 5.5.3
    cpe:2.3:a:php:php:5.5.3
  • PHP 5.5.4 -
    cpe:2.3:a:php:php:5.5.4
  • PHP 5.5.5 -
    cpe:2.3:a:php:php:5.5.5
  • PHP 5.5.6 -
    cpe:2.3:a:php:php:5.5.6
  • PHP 5.3.28
    cpe:2.3:a:php:php:5.3.28
  • PHP 5.4.9 -
    cpe:2.3:a:php:php:5.4.9
  • PHP 5.4.8 -
    cpe:2.3:a:php:php:5.4.8
  • PHP 5.4.7 -
    cpe:2.3:a:php:php:5.4.7
  • PHP 5.4.6 -
    cpe:2.3:a:php:php:5.4.6
  • PHP 5.4.5 -
    cpe:2.3:a:php:php:5.4.5
  • PHP 5.4.4 -
    cpe:2.3:a:php:php:5.4.4
  • PHP 5.4.3
    cpe:2.3:a:php:php:5.4.3
  • PHP 5.4.26 -
    cpe:2.3:a:php:php:5.4.26
  • PHP 5.4.25 -
    cpe:2.3:a:php:php:5.4.25
  • PHP 5.4.24 -
    cpe:2.3:a:php:php:5.4.24
  • PHP 5.4.23 -
    cpe:2.3:a:php:php:5.4.23
  • PHP 5.4.22 -
    cpe:2.3:a:php:php:5.4.22
  • PHP 5.4.21 -
    cpe:2.3:a:php:php:5.4.21
  • PHP 5.4.20 -
    cpe:2.3:a:php:php:5.4.20
  • PHP 5.4.2
    cpe:2.3:a:php:php:5.4.2
  • PHP 5.4.19
    cpe:2.3:a:php:php:5.4.19
  • PHP 5.4.18 -
    cpe:2.3:a:php:php:5.4.18
  • PHP 5.4.17 -
    cpe:2.3:a:php:php:5.4.17
  • PHP 5.4.16 release candidate 1
    cpe:2.3:a:php:php:5.4.16:rc1
  • PHP 5.4.15 release candidate 1
    cpe:2.3:a:php:php:5.4.15:rc1
  • PHP 5.4.14 release candidate 1
    cpe:2.3:a:php:php:5.4.14:rc1
  • PHP 5.4.14 -
    cpe:2.3:a:php:php:5.4.14
  • PHP 5.4.13 release candidate 1
    cpe:2.3:a:php:php:5.4.13:rc1
  • PHP 5.4.13 -
    cpe:2.3:a:php:php:5.4.13
  • PHP 5.4.12 release candidate 2
    cpe:2.3:a:php:php:5.4.12:rc2
  • PHP 5.4.12 release candidate 1
    cpe:2.3:a:php:php:5.4.12:rc1
  • PHP 5.4.12 -
    cpe:2.3:a:php:php:5.4.12
  • PHP 5.4.11 -
    cpe:2.3:a:php:php:5.4.11
  • PHP 5.4.10 -
    cpe:2.3:a:php:php:5.4.10
  • PHP 5.4.1
    cpe:2.3:a:php:php:5.4.1
  • PHP 5.4.0 -
    cpe:2.3:a:php:php:5.4.0
  • PHP 5.3.9 -
    cpe:2.3:a:php:php:5.3.9
  • PHP 5.3.8
    cpe:2.3:a:php:php:5.3.8
  • PHP 5.3.7 -
    cpe:2.3:a:php:php:5.3.7
  • PHP 5.3.6
    cpe:2.3:a:php:php:5.3.6
  • PHP 5.3.5
    cpe:2.3:a:php:php:5.3.5
  • PHP 5.3.4 -
    cpe:2.3:a:php:php:5.3.4
  • PHP 5.3.3 -
    cpe:2.3:a:php:php:5.3.3
  • PHP 5.3.27 -
    cpe:2.3:a:php:php:5.3.27
  • PHP 5.3.26 -
    cpe:2.3:a:php:php:5.3.26
  • PHP 5.3.25 -
    cpe:2.3:a:php:php:5.3.25
  • PHP 5.3.24 -
    cpe:2.3:a:php:php:5.3.24
  • PHP 5.3.23 -
    cpe:2.3:a:php:php:5.3.23
  • PHP 5.3.22 -
    cpe:2.3:a:php:php:5.3.22
  • PHP 5.3.21 -
    cpe:2.3:a:php:php:5.3.21
  • PHP 5.3.20 -
    cpe:2.3:a:php:php:5.3.20
  • PHP 5.3.2 -
    cpe:2.3:a:php:php:5.3.2
  • PHP 5.3.19 -
    cpe:2.3:a:php:php:5.3.19
  • PHP 5.3.18 -
    cpe:2.3:a:php:php:5.3.18
  • PHP 5.3.17
    cpe:2.3:a:php:php:5.3.17
  • PHP 5.3.16
    cpe:2.3:a:php:php:5.3.16
  • PHP 5.3.15 -
    cpe:2.3:a:php:php:5.3.15
  • PHP 5.3.14 -
    cpe:2.3:a:php:php:5.3.14
  • PHP 5.3.13
    cpe:2.3:a:php:php:5.3.13
  • PHP 5.3.12
    cpe:2.3:a:php:php:5.3.12
  • PHP 5.3.11 -
    cpe:2.3:a:php:php:5.3.11
  • PHP 5.3.10
    cpe:2.3:a:php:php:5.3.10
  • PHP 5.3.1 -
    cpe:2.3:a:php:php:5.3.1
  • PHP 5.3.0
    cpe:2.3:a:php:php:5.3.0
  • PHP 5.2.9 -
    cpe:2.3:a:php:php:5.2.9
  • PHP 5.2.8
    cpe:2.3:a:php:php:5.2.8
  • PHP 5.2.7 -
    cpe:2.3:a:php:php:5.2.7
  • PHP 5.2.6 -
    cpe:2.3:a:php:php:5.2.6
  • PHP 5.2.5 -
    cpe:2.3:a:php:php:5.2.5
  • PHP 5.2.4 -
    cpe:2.3:a:php:php:5.2.4
  • PHP 5.2.3 -
    cpe:2.3:a:php:php:5.2.3
  • PHP 5.2.2 -
    cpe:2.3:a:php:php:5.2.2
  • PHP 5.2.17
    cpe:2.3:a:php:php:5.2.17
  • PHP 5.2.16
    cpe:2.3:a:php:php:5.2.16
  • PHP 5.2.15 -
    cpe:2.3:a:php:php:5.2.15
  • PHP 5.2.14 -
    cpe:2.3:a:php:php:5.2.14
  • PHP 5.2.13 -
    cpe:2.3:a:php:php:5.2.13
  • PHP 5.2.12 -
    cpe:2.3:a:php:php:5.2.12
  • PHP 5.2.11 -
    cpe:2.3:a:php:php:5.2.11
  • PHP 5.2.10 -
    cpe:2.3:a:php:php:5.2.10
  • PHP 5.2.1 -
    cpe:2.3:a:php:php:5.2.1
  • PHP 5.2.0
    cpe:2.3:a:php:php:5.2.0
  • PHP PHP 5.1.6
    cpe:2.3:a:php:php:5.1.6
  • PHP 5.1.5 -
    cpe:2.3:a:php:php:5.1.5
  • PHP 5.1.4
    cpe:2.3:a:php:php:5.1.4
  • PHP PHP 5.1.3
    cpe:2.3:a:php:php:5.1.3
  • PHP 5.1.2 -
    cpe:2.3:a:php:php:5.1.2
  • PHP PHP 5.1.1
    cpe:2.3:a:php:php:5.1.1
  • PHP 5.1.0 -
    cpe:2.3:a:php:php:5.1.0
  • PHP 5.0.5 -
    cpe:2.3:a:php:php:5.0.5
  • PHP 5.0.4 -
    cpe:2.3:a:php:php:5.0.4
  • PHP 5.0.3 -
    cpe:2.3:a:php:php:5.0.3
  • PHP 5.0.2 -
    cpe:2.3:a:php:php:5.0.2
  • PHP 5.0.1 -
    cpe:2.3:a:php:php:5.0.1
  • PHP PHP 5.0.0 RC3
    cpe:2.3:a:php:php:5.0.0:rc3
  • PHP PHP 5.0.0 RC2
    cpe:2.3:a:php:php:5.0.0:rc2
  • PHP PHP 5.0.0 RC1
    cpe:2.3:a:php:php:5.0.0:rc1
  • PHP PHP 5.0.0 Beta4
    cpe:2.3:a:php:php:5.0.0:beta4
  • PHP PHP 5.0.0 Beta3
    cpe:2.3:a:php:php:5.0.0:beta3
  • PHP PHP 5.0.0 Beta2
    cpe:2.3:a:php:php:5.0.0:beta2
  • PHP PHP 5.0.0 Beta1
    cpe:2.3:a:php:php:5.0.0:beta1
  • PHP 5.0.0 -
    cpe:2.3:a:php:php:5.0.0
CVSS
Base: 5.0 (as of 02-06-2014 - 14:44)
Impact:
Exploitability:
CWE CWE-119
CAPEC
  • Buffer Overflow via Environment Variables
    This attack pattern involves causing a buffer overflow through manipulation of environment variables. Once the attacker finds that they can modify an environment variable, they may try to overflow associated buffers. This attack leverages implicit trust often placed in environment variables.
  • Overflow Buffers
    Buffer Overflow attacks target improper or missing bounds checking on buffer operations, typically triggered by input injected by an attacker. As a consequence, an attacker is able to write past the boundaries of allocated buffer regions in memory, causing a program crash or potentially redirection of execution as per the attackers' choice.
  • Client-side Injection-induced Buffer Overflow
    This type of attack exploits a buffer overflow vulnerability in targeted client software through injection of malicious content from a custom-built hostile service.
  • Filter Failure through Buffer Overflow
    In this attack, the idea is to cause an active filter to fail by causing an oversized transaction. An attacker may try to feed overly long input strings to the program in an attempt to overwhelm the filter (by causing a buffer overflow) and hoping that the filter does not fail securely (i.e. the user input is let into the system unfiltered).
  • MIME Conversion
    An attacker exploits a weakness in the MIME conversion routine to cause a buffer overflow and gain control over the mail server machine. The MIME system is designed to allow various different information formats to be interpreted and sent via e-mail. Attack points exist when data are converted to MIME compatible format and back.
  • Overflow Binary Resource File
    An attack of this type exploits a buffer overflow vulnerability in the handling of binary resources. Binary resources may include music files like MP3, image files like JPEG files, and any other binary file. These attacks may pass unnoticed to the client machine through normal usage of files, such as a browser loading a seemingly innocent JPEG file. This can allow the attacker access to the execution stack and execute arbitrary code in the target process. This attack pattern is a variant of standard buffer overflow attacks using an unexpected vector (binary files) to wrap its attack and open up a new attack vector. The attacker is required to either directly serve the binary content to the victim, or place it in a locale like a MP3 sharing application, for the victim to download. The attacker then is notified upon the download or otherwise locates the vulnerability opened up by the buffer overflow.
  • Buffer Overflow via Symbolic Links
    This type of attack leverages the use of symbolic links to cause buffer overflows. An attacker can try to create or manipulate a symbolic link file such that its contents result in out of bounds data. When the target software processes the symbolic link file, it could potentially overflow internal buffers with insufficient bounds checking.
  • Overflow Variables and Tags
    This type of attack leverages the use of tags or variables from a formatted configuration data to cause buffer overflow. The attacker crafts a malicious HTML page or configuration file that includes oversized strings, thus causing an overflow.
  • Buffer Overflow via Parameter Expansion
    In this attack, the target software is given input that the attacker knows will be modified and expanded in size during processing. This attack relies on the target software failing to anticipate that the expanded data may exceed some internal limit, thereby creating a buffer overflow.
  • Buffer Overflow in an API Call
    This attack targets libraries or shared code modules which are vulnerable to buffer overflow attacks. An attacker who has access to an API may try to embed malicious code in the API function call and exploit a buffer overflow vulnerability in the function's implementation. All clients that make use of the code library thus become vulnerable by association. This has a very broad effect on security across a system, usually affecting more than one software process.
  • Buffer Overflow in Local Command-Line Utilities
    This attack targets command-line utilities available in a number of shells. An attacker can leverage a vulnerability found in a command-line utility to escalate privilege to root.
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
NONE NONE PARTIAL
nessus via4
  • NASL family Scientific Linux Local Security Checks
    NASL id SL_20151119_FILE_ON_SL7_X.NASL
    description Multiple denial of service flaws were found in the way file parsed certain Composite Document Format (CDF) files. A remote attacker could use either of these flaws to crash file, or an application using file, via a specially crafted CDF file. (CVE-2014-0207, CVE-2014-0237, CVE-2014-0238, CVE-2014-3479, CVE-2014-3480, CVE-2014-3487, CVE-2014-3587) Two flaws were found in the way file processed certain Pascal strings. A remote attacker could cause file to crash if it was used to identify the type of the attacker-supplied file. (CVE-2014-3478, CVE-2014-9652) Multiple flaws were found in the file regular expression rules for detecting various files. A remote attacker could use these flaws to cause file to consume an excessive amount of CPU. (CVE-2014-3538) Multiple flaws were found in the way file parsed Executable and Linkable Format (ELF) files. A remote attacker could use these flaws to cause file to crash, disclose portions of its memory, or consume an excessive amount of system resources. (CVE-2014-3710, CVE-2014-8116, CVE-2014-8117, CVE-2014-9653) The file packages have been updated to ensure correct operation on Power little endian and ARM 64-bit hardware architectures.
    last seen 2019-02-21
    modified 2018-12-28
    plugin id 87555
    published 2015-12-22
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=87555
    title Scientific Linux Security Update : file on SL7.x x86_64
  • NASL family Slackware Local Security Checks
    NASL id SLACKWARE_SSA_2014-160-01.NASL
    description New php packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, and -current to fix security issues.
    last seen 2019-02-21
    modified 2019-01-02
    plugin id 74380
    published 2014-06-10
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=74380
    title Slackware 13.0 / 13.1 / 13.37 / 14.0 / 14.1 / current : php (SSA:2014-160-01)
  • NASL family MacOS X Local Security Checks
    NASL id MACOSX_SECUPD2015-004.NASL
    description The remote host is running a version of Mac OS X 10.8.5 or 10.9.5 that is missing Security Update 2015-004. It is, therefore, affected multiple vulnerabilities in the following components : - Apache - ATS - Certificate Trust Policy - CoreAnimation - FontParser - Graphics Driver - ImageIO - IOHIDFamily - Kernel - LaunchServices - Open Directory Client - OpenLDAP - OpenSSL - PHP - QuickLook - SceneKit - Security - Code SIgning - UniformTypeIdentifiers Note that successful exploitation of the most serious issues can result in arbitrary code execution.
    last seen 2019-02-21
    modified 2018-07-14
    plugin id 82700
    published 2015-04-10
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=82700
    title Mac OS X Multiple Vulnerabilities (Security Update 2015-004) (FREAK)
  • NASL family Mandriva Local Security Checks
    NASL id MANDRIVA_MDVSA-2015-080.NASL
    description Multiple vulnerabilities has been discovered and corrected in php : It was discovered that the file utility contains a flaw in the handling of indirect magic rules in the libmagic library, which leads to an infinite recursion when trying to determine the file type of certain files (CVE-2014-1943). A flaw was found in the way the file utility determined the type of Portable Executable (PE) format files, the executable format used on Windows. A malicious PE file could cause the file utility to crash or, potentially, execute arbitrary code (CVE-2014-2270). The BEGIN regular expression in the awk script detector in magic/Magdir/commands in file before 5.15 uses multiple wildcards with unlimited repetitions, which allows context-dependent attackers to cause a denial of service (CPU consumption) via a crafted ASCII file that triggers a large amount of backtracking, as demonstrated via a file with many newline characters (CVE-2013-7345). PHP FPM in PHP versions before 5.4.28 and 5.5.12 uses a UNIX domain socket with world-writable permissions by default, which allows any local user to connect to it and execute PHP scripts as the apache user (CVE-2014-0185). A flaw was found in the way file's Composite Document Files (CDF) format parser handle CDF files with many summary info entries. The cdf_unpack_summary_info() function unnecessarily repeatedly read the info from the same offset. This led to many file_printf() calls in cdf_file_property_info(), which caused file to use an excessive amount of CPU time when parsing a specially crafted CDF file (CVE-2014-0237). A flaw was found in the way file parsed property information from Composite Document Files (CDF) files. A property entry with 0 elements triggers an infinite loop (CVE-2014-0238). The unserialize() function in PHP before 5.4.30 and 5.5.14 has a Type Confusion issue related to the SPL ArrayObject and SPLObjectStorage Types (CVE-2014-3515). It was discovered that PHP is vulnerable to a heap-based buffer overflow in the DNS TXT record parsing. A malicious server or man-in-the-middle attacker could possibly use this flaw to execute arbitrary code as the PHP interpreter if a PHP application uses dns_get_record() to perform a DNS query (CVE-2014-4049). A flaw was found in the way file parsed property information from Composite Document Files (CDF) files, where the mconvert() function did not correctly compute the truncated pascal string size (CVE-2014-3478). Multiple flaws were found in the way file parsed property information from Composite Document Files (CDF) files, due to insufficient boundary checks on buffers (CVE-2014-0207, CVE-2014-3479, CVE-2014-3480, CVE-2014-3487). The phpinfo() function in PHP before 5.4.30 and 5.5.14 has a Type Confusion issue that can cause it to leak arbitrary process memory (CVE-2014-4721). Use-after-free vulnerability in ext/spl/spl_array.c in the SPL component in PHP through 5.5.14 allows context-dependent attackers to cause a denial of service or possibly have unspecified other impact via crafted ArrayIterator usage within applications in certain web-hosting environments (CVE-2014-4698). Use-after-free vulnerability in ext/spl/spl_dllist.c in the SPL component in PHP through 5.5.14 allows context-dependent attackers to cause a denial of service or possibly have unspecified other impact via crafted iterator usage within applications in certain web-hosting environments (CVE-2014-4670). file before 5.19 does not properly restrict the amount of data read during a regex search, which allows remote attackers to cause a denial of service (CPU consumption) via a crafted file that triggers backtracking during processing of an awk rule, due to an incomplete fix for CVE-2013-7345 (CVE-2014-3538). Integer overflow in the cdf_read_property_info function in cdf.c in file through 5.19, as used in the Fileinfo component in PHP before 5.4.32 and 5.5.x before 5.5.16, allows remote attackers to cause a denial of service (application crash) via a crafted CDF file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-1571 (CVE-2014-3587). Multiple buffer overflows in the php_parserr function in ext/standard/dns.c in PHP before 5.4.32 and 5.5.x before 5.5.16 allow remote DNS servers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted DNS record, related to the dns_get_record function and the dn_expand function. NOTE: this issue exists because of an incomplete fix for CVE-2014-4049 (CVE-2014-3597). An integer overflow flaw in PHP's unserialize() function was reported. If unserialize() were used on untrusted data, this issue could lead to a crash or potentially information disclosure (CVE-2014-3669). A heap corruption issue was reported in PHP's exif_thumbnail() function. A specially crafted JPEG image could cause the PHP interpreter to crash or, potentially, execute arbitrary code (CVE-2014-3670). If client-supplied input was passed to PHP's cURL client as a URL to download, it could return local files from the server due to improper handling of null bytes (PHP#68089). An out-of-bounds read flaw was found in file's donote() function in the way the file utility determined the note headers of a elf file. This could possibly lead to file executable crash (CVE-2014-3710). A use-after-free flaw was found in PHP unserialize(). An untrusted input could cause PHP interpreter to crash or, possibly, execute arbitrary code when processed using unserialize() (CVE-2014-8142). Double free vulnerability in the zend_ts_hash_graceful_destroy function in zend_ts_hash.c in the Zend Engine in PHP before 5.5.21 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors (CVE-2014-9425). sapi/cgi/cgi_main.c in the CGI component in PHP before 5.5.21, when mmap is used to read a .php file, does not properly consider the mapping's length during processing of an invalid file that begins with a # character and lacks a newline character, which causes an out-of-bounds read and might allow remote attackers to obtain sensitive information from php-cgi process memory by leveraging the ability to upload a .php file or trigger unexpected code execution if a valid PHP script is present in memory locations adjacent to the mapping (CVE-2014-9427). Use after free vulnerability in unserialize() in PHP before 5.5.21 (CVE-2015-0231). Free called on an uninitialized pointer in php-exif in PHP before 5.5.21 (CVE-2015-0232). The readelf.c source file has been removed from PHP's bundled copy of file's libmagic, eliminating exposure to denial of service issues in ELF file parsing such as CVE-2014-8116, CVE-2014-8117, CVE-2014-9620 and CVE-2014-9621 in PHP's fileinfo module. S. Paraschoudis discovered that PHP incorrectly handled memory in the enchant binding. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code (CVE-2014-9705). Taoguang Chen discovered that PHP incorrectly handled unserializing objects. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code (CVE-2015-0273). It was discovered that PHP incorrectly handled memory in the phar extension. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code (CVE-2015-2301). Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5 allows remote attackers to execute arbitrary code via a crafted unserialize call that leverages improper handling of duplicate numerical keys within the serialized properties of an object. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-8142 (CVE-2015-0231). The exif_process_unicode function in ext/exif/exif.c in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5 allows remote attackers to execute arbitrary code or cause a denial of service (uninitialized pointer free and application crash) via crafted EXIF data in a JPEG image (CVE-2015-0232). An integer overflow flaw, leading to a heap-based buffer overflow, was found in the way libzip, which is embedded in PHP, processed certain ZIP archives. If an attacker were able to supply a specially crafted ZIP archive to an application using libzip, it could cause the application to crash or, possibly, execute arbitrary code (CVE-2015-2331). It was discovered that the PHP opcache component incorrectly handled memory. A remote attacker could possibly use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code (CVE-2015-1351). It was discovered that the PHP PostgreSQL database extension incorrectly handled certain pointers. A remote attacker could possibly use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code (CVE-2015-1352). PHP contains a bundled copy of the file utility's libmagic library, so it was vulnerable to the libmagic issues. The updated php packages have been patched and upgraded to the 5.5.23 version which is not vulnerable to these issues. The libzip packages has been patched to address the CVE-2015-2331 flaw. A bug in the php zip extension that could cause a crash has been fixed (mga#13820) Additionally the jsonc and timezonedb packages has been upgraded to the latest versions and the PECL packages which requires so has been rebuilt for php-5.5.23.
    last seen 2019-02-21
    modified 2018-11-15
    plugin id 82333
    published 2015-03-30
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=82333
    title Mandriva Linux Security Advisory : php (MDVSA-2015:080)
  • NASL family Gentoo Local Security Checks
    NASL id GENTOO_GLSA-201408-11.NASL
    description The remote host is affected by the vulnerability described in GLSA-201408-11 (PHP: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in PHP. Please review the CVE identifiers referenced below for details. Impact : A context-dependent attacker can cause arbitrary code execution, create a Denial of Service condition, read or write arbitrary files, impersonate other servers, hijack a web session, or have other unspecified impact. Additionally, a local attacker could gain escalated privileges. Workaround : There is no known workaround at this time.
    last seen 2019-02-21
    modified 2018-07-12
    plugin id 77455
    published 2014-08-30
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=77455
    title GLSA-201408-11 : PHP: Multiple vulnerabilities
  • NASL family MacOS X Local Security Checks
    NASL id MACOSX_10_9_5.NASL
    description The remote host is running a version of Mac OS X 10.9.x that is prior to version 10.9.5. This update contains several security-related fixes for the following components : - apache_mod_php - Bluetooth - CoreGraphics - Foundation - Intel Graphics Driver - IOAcceleratorFamily - IOHIDFamily - IOKit - Kernel - Libnotify - OpenSSL - QT Media Foundation - ruby Note that successful exploitation of the most serious issues can result in arbitrary code execution.
    last seen 2019-02-21
    modified 2018-07-14
    plugin id 77748
    published 2014-09-18
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=77748
    title Mac OS X 10.9.x < 10.9.5 Multiple Vulnerabilities
  • NASL family Oracle Linux Local Security Checks
    NASL id ORACLELINUX_ELSA-2015-2155.NASL
    description From Red Hat Security Advisory 2015:2155 : Updated file packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. The file command is used to identify a particular file according to the type of data the file contains. It can identify many different file types, including Executable and Linkable Format (ELF) binary files, system libraries, RPM packages, and different graphics formats. Multiple denial of service flaws were found in the way file parsed certain Composite Document Format (CDF) files. A remote attacker could use either of these flaws to crash file, or an application using file, via a specially crafted CDF file. (CVE-2014-0207, CVE-2014-0237, CVE-2014-0238, CVE-2014-3479, CVE-2014-3480, CVE-2014-3487, CVE-2014-3587) Two flaws were found in the way file processed certain Pascal strings. A remote attacker could cause file to crash if it was used to identify the type of the attacker-supplied file. (CVE-2014-3478, CVE-2014-9652) Multiple flaws were found in the file regular expression rules for detecting various files. A remote attacker could use these flaws to cause file to consume an excessive amount of CPU. (CVE-2014-3538) Multiple flaws were found in the way file parsed Executable and Linkable Format (ELF) files. A remote attacker could use these flaws to cause file to crash, disclose portions of its memory, or consume an excessive amount of system resources. (CVE-2014-3710, CVE-2014-8116, CVE-2014-8117, CVE-2014-9653) Red Hat would like to thank Thomas Jarosch of Intra2net AG for reporting the CVE-2014-8116 and CVE-2014-8117 issues. The CVE-2014-0207, CVE-2014-0237, CVE-2014-0238, CVE-2014-3478, CVE-2014-3479, CVE-2014-3480, CVE-2014-3487, CVE-2014-3710 issues were discovered by Francisco Alonso of Red Hat Product Security; the CVE-2014-3538 issue was discovered by Jan Kaluza of the Red Hat Web Stack Team The file packages have been updated to ensure correct operation on Power little endian and ARM 64-bit hardware architectures. (BZ#1224667, BZ#1224668, BZ#1157850, BZ#1067688). All file users are advised to upgrade to these updated packages, which contain backported patches to correct these issues.
    last seen 2019-02-21
    modified 2018-07-24
    plugin id 87027
    published 2015-11-24
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=87027
    title Oracle Linux 7 : file (ELSA-2015-2155)
  • NASL family CentOS Local Security Checks
    NASL id CENTOS_RHSA-2015-2155.NASL
    description Updated file packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. The file command is used to identify a particular file according to the type of data the file contains. It can identify many different file types, including Executable and Linkable Format (ELF) binary files, system libraries, RPM packages, and different graphics formats. Multiple denial of service flaws were found in the way file parsed certain Composite Document Format (CDF) files. A remote attacker could use either of these flaws to crash file, or an application using file, via a specially crafted CDF file. (CVE-2014-0207, CVE-2014-0237, CVE-2014-0238, CVE-2014-3479, CVE-2014-3480, CVE-2014-3487, CVE-2014-3587) Two flaws were found in the way file processed certain Pascal strings. A remote attacker could cause file to crash if it was used to identify the type of the attacker-supplied file. (CVE-2014-3478, CVE-2014-9652) Multiple flaws were found in the file regular expression rules for detecting various files. A remote attacker could use these flaws to cause file to consume an excessive amount of CPU. (CVE-2014-3538) Multiple flaws were found in the way file parsed Executable and Linkable Format (ELF) files. A remote attacker could use these flaws to cause file to crash, disclose portions of its memory, or consume an excessive amount of system resources. (CVE-2014-3710, CVE-2014-8116, CVE-2014-8117, CVE-2014-9653) Red Hat would like to thank Thomas Jarosch of Intra2net AG for reporting the CVE-2014-8116 and CVE-2014-8117 issues. The CVE-2014-0207, CVE-2014-0237, CVE-2014-0238, CVE-2014-3478, CVE-2014-3479, CVE-2014-3480, CVE-2014-3487, CVE-2014-3710 issues were discovered by Francisco Alonso of Red Hat Product Security; the CVE-2014-3538 issue was discovered by Jan Kaluza of the Red Hat Web Stack Team The file packages have been updated to ensure correct operation on Power little endian and ARM 64-bit hardware architectures. (BZ#1224667, BZ#1224668, BZ#1157850, BZ#1067688). All file users are advised to upgrade to these updated packages, which contain backported patches to correct these issues.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 87137
    published 2015-12-02
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=87137
    title CentOS 7 : file (CESA-2015:2155)
  • NASL family FreeBSD Local Security Checks
    NASL id FREEBSD_PKG_D2A892B9260511E49DA000A0986F28C4.NASL
    description The PHP Team reports : insecure temporary file use in the configure script unserialize() SPL ArrayObject / SPLObjectStorage Type Confusion Heap buffer over-read in DateInterval fileinfo: cdf_read_short_sector insufficient boundary check fileinfo: CDF infinite loop in nelements DoS fileinfo: fileinfo: numerous file_printf calls resulting in performance degradation) Fix potential segfault in dns_check_record()
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 77241
    published 2014-08-19
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=77241
    title FreeBSD : PHP multiple vulnerabilities (d2a892b9-2605-11e4-9da0-00a0986f28c4)
  • NASL family Ubuntu Local Security Checks
    NASL id UBUNTU_USN-2254-2.NASL
    description USN-2254-1 fixed vulnerabilities in PHP. The fix for CVE-2014-0185 further restricted the permissions on the PHP FastCGI Process Manager (FPM) UNIX socket. This update grants socket access to the www-data user and group so installations and documentation relying on the previous socket permissions will continue to function. Christian Hoffmann discovered that the PHP FastCGI Process Manager (FPM) set incorrect permissions on the UNIX socket. A local attacker could use this issue to possibly elevate their privileges. This issue only affected Ubuntu 12.04 LTS, Ubuntu 13.10, and Ubuntu 14.04 LTS. (CVE-2014-0185) Francisco Alonso discovered that the PHP Fileinfo component incorrectly handled certain CDF documents. A remote attacker could use this issue to cause PHP to hang or crash, resulting in a denial of service. (CVE-2014-0237, CVE-2014-0238) Stefan Esser discovered that PHP incorrectly handled DNS TXT records. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2014-4049). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-01
    plugin id 76249
    published 2014-06-26
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=76249
    title Ubuntu 13.10 / 14.04 LTS : php5 updates (USN-2254-2)
  • NASL family CGI abuses
    NASL id PHP_5_4_29.NASL
    description According to its banner, the version of PHP 5.4.x installed on the remote host is a version prior to 5.4.29. It is, therefore, affected by the following vulnerabilities : - A flaw exists with the 'cdf_unpack_summary_info()' function within 'src/cdf.c' where multiple file_printf calls occur when handling specially crafted CDF files. This could allow a context dependent attacker to crash the web application using PHP. (CVE-2014-0237) - A flaw exists with the 'cdf_read_property_info()' function within 'src/cdf.c' where an infinite loop occurs when handling specially crafted CDF files. This could allow a context dependent attacker to crash the web application using PHP. (CVE-2014-0238) - An out-of-bounds read exists in printf. (Bug #67249) Note that Nessus has not attempted to exploit these issues, but has instead relied only on the application's self-reported version number.
    last seen 2019-02-21
    modified 2018-07-24
    plugin id 74291
    published 2014-06-03
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=74291
    title PHP 5.4.x < 5.4.29 'src/cdf.c' Multiple Vulnerabilities
  • NASL family Ubuntu Local Security Checks
    NASL id UBUNTU_USN-2254-1.NASL
    description Christian Hoffmann discovered that the PHP FastCGI Process Manager (FPM) set incorrect permissions on the UNIX socket. A local attacker could use this issue to possibly elevate their privileges. This issue only affected Ubuntu 12.04 LTS, Ubuntu 13.10, and Ubuntu 14.04 LTS. (CVE-2014-0185) Francisco Alonso discovered that the PHP Fileinfo component incorrectly handled certain CDF documents. A remote attacker could use this issue to cause PHP to hang or crash, resulting in a denial of service. (CVE-2014-0237, CVE-2014-0238) Stefan Esser discovered that PHP incorrectly handled DNS TXT records. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2014-4049). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-01
    plugin id 76201
    published 2014-06-24
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=76201
    title Ubuntu 10.04 LTS / 12.04 LTS / 13.10 / 14.04 LTS : php5 vulnerabilities (USN-2254-1)
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2014-1012.NASL
    description Updated php53 and php packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5 and 6 respectively. The Red Hat Security Response Team has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. PHP's fileinfo module provides functions used to identify a particular file according to the type of data contained by the file. Multiple denial of service flaws were found in the way the File Information (fileinfo) extension parsed certain Composite Document Format (CDF) files. A remote attacker could use either of these flaws to crash a PHP application using fileinfo via a specially crafted CDF file. (CVE-2014-0237, CVE-2014-0238, CVE-2014-3479, CVE-2014-3480, CVE-2012-1571) Two denial of service flaws were found in the way the File Information (fileinfo) extension handled indirect and search rules. A remote attacker could use either of these flaws to cause a PHP application using fileinfo to crash or consume an excessive amount of CPU. (CVE-2014-1943, CVE-2014-2270) A heap-based buffer overflow flaw was found in the way PHP parsed DNS TXT records. A malicious DNS server or a man-in-the-middle attacker could possibly use this flaw to execute arbitrary code as the PHP interpreter if a PHP application used the dns_get_record() function to perform a DNS query. (CVE-2014-4049) A type confusion issue was found in PHP's phpinfo() function. A malicious script author could possibly use this flaw to disclose certain portions of server memory. (CVE-2014-4721) A buffer over-read flaw was found in the way the DateInterval class parsed interval specifications. An attacker able to make a PHP application parse a specially crafted specification using DateInterval could possibly cause the PHP interpreter to crash. (CVE-2013-6712) A type confusion issue was found in the SPL ArrayObject and SPLObjectStorage classes' unserialize() method. A remote attacker able to submit specially crafted input to a PHP application, which would then unserialize this input using one of the aforementioned methods, could use this flaw to execute arbitrary code with the privileges of the user running that PHP application. (CVE-2014-3515) The CVE-2014-0237, CVE-2014-0238, CVE-2014-3479, and CVE-2014-3480 issues were discovered by Francisco Alonso of Red Hat Product Security. All php53 and php users are advised to upgrade to these updated packages, which contain backported patches to correct these issues.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 77015
    published 2014-08-06
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=77015
    title RHEL 5 / 6 : php53 and php (RHSA-2014:1012)
  • NASL family CentOS Local Security Checks
    NASL id CENTOS_RHSA-2014-1606.NASL
    description Updated file packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. The 'file' command is used to identify a particular file according to the type of data contained in the file. The command can identify various file types, including ELF binaries, system libraries, RPM packages, and different graphics formats. Multiple denial of service flaws were found in the way file parsed certain Composite Document Format (CDF) files. A remote attacker could use either of these flaws to crash file, or an application using file, via a specially crafted CDF file. (CVE-2014-0237, CVE-2014-0238, CVE-2014-3479, CVE-2014-3480, CVE-2012-1571) Two denial of service flaws were found in the way file handled indirect and search rules. A remote attacker could use either of these flaws to cause file, or an application using file, to crash or consume an excessive amount of CPU. (CVE-2014-1943, CVE-2014-2270) This update also fixes the following bugs : * Previously, the output of the 'file' command contained redundant white spaces. With this update, the new STRING_TRIM flag has been introduced to remove the unnecessary white spaces. (BZ#664513) * Due to a bug, the 'file' command could incorrectly identify an XML document as a LaTex document. The underlying source code has been modified to fix this bug and the command now works as expected. (BZ#849621) * Previously, the 'file' command could not recognize .JPG files and incorrectly labeled them as 'Minix filesystem'. This bug has been fixed and the command now properly detects .JPG files. (BZ#873997) * Under certain circumstances, the 'file' command incorrectly detected NETpbm files as 'x86 boot sector'. This update applies a patch to fix this bug and the command now detects NETpbm files as expected. (BZ#884396) * Previously, the 'file' command incorrectly identified ASCII text files as a .PIC image file. With this update, a patch has been provided to address this bug and the command now correctly recognizes ASCII text files. (BZ#980941) * On 32-bit PowerPC systems, the 'from' field was missing from the output of the 'file' command. The underlying source code has been modified to fix this bug and 'file' output now contains the 'from' field as expected. (BZ#1037279) * The 'file' command incorrectly detected text files as 'RRDTool DB version ool - Round Robin Database Tool'. This update applies a patch to fix this bug and the command now correctly detects text files. (BZ#1064463) * Previously, the 'file' command supported only version 1 and 2 of the QCOW format. As a consequence, file was unable to detect a 'qcow2 compat=1.1' file created on Red Hat Enterprise Linux 7. With this update, support for QCOW version 3 has been added so that the command now detects such files as expected. (BZ#1067771) All file users are advised to upgrade to these updated packages, which contain backported patches to correct these issues.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 79185
    published 2014-11-12
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=79185
    title CentOS 6 : file (CESA-2014:1606)
  • NASL family Debian Local Security Checks
    NASL id DEBIAN_DSA-3021.NASL
    description Multiple security issues have been found in file, a tool to determine a file type. These vulnerabilities allow remote attackers to cause a denial of service, via resource consumption or application crash.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 77585
    published 2014-09-10
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=77585
    title Debian DSA-3021-1 : file - security update
  • NASL family Oracle Linux Local Security Checks
    NASL id ORACLELINUX_ELSA-2014-1012.NASL
    description From Red Hat Security Advisory 2014:1012 : Updated php53 and php packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5 and 6 respectively. The Red Hat Security Response Team has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. PHP's fileinfo module provides functions used to identify a particular file according to the type of data contained by the file. Multiple denial of service flaws were found in the way the File Information (fileinfo) extension parsed certain Composite Document Format (CDF) files. A remote attacker could use either of these flaws to crash a PHP application using fileinfo via a specially crafted CDF file. (CVE-2014-0237, CVE-2014-0238, CVE-2014-3479, CVE-2014-3480, CVE-2012-1571) Two denial of service flaws were found in the way the File Information (fileinfo) extension handled indirect and search rules. A remote attacker could use either of these flaws to cause a PHP application using fileinfo to crash or consume an excessive amount of CPU. (CVE-2014-1943, CVE-2014-2270) A heap-based buffer overflow flaw was found in the way PHP parsed DNS TXT records. A malicious DNS server or a man-in-the-middle attacker could possibly use this flaw to execute arbitrary code as the PHP interpreter if a PHP application used the dns_get_record() function to perform a DNS query. (CVE-2014-4049) A type confusion issue was found in PHP's phpinfo() function. A malicious script author could possibly use this flaw to disclose certain portions of server memory. (CVE-2014-4721) A buffer over-read flaw was found in the way the DateInterval class parsed interval specifications. An attacker able to make a PHP application parse a specially crafted specification using DateInterval could possibly cause the PHP interpreter to crash. (CVE-2013-6712) A type confusion issue was found in the SPL ArrayObject and SPLObjectStorage classes' unserialize() method. A remote attacker able to submit specially crafted input to a PHP application, which would then unserialize this input using one of the aforementioned methods, could use this flaw to execute arbitrary code with the privileges of the user running that PHP application. (CVE-2014-3515) The CVE-2014-0237, CVE-2014-0238, CVE-2014-3479, and CVE-2014-3480 issues were discovered by Francisco Alonso of Red Hat Product Security. All php53 and php users are advised to upgrade to these updated packages, which contain backported patches to correct these issues.
    last seen 2019-02-21
    modified 2015-12-01
    plugin id 77043
    published 2014-08-07
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=77043
    title Oracle Linux 5 / 6 : php / php53 (ELSA-2014-1012)
  • NASL family Oracle Linux Local Security Checks
    NASL id ORACLELINUX_ELSA-2014-1606.NASL
    description From Red Hat Security Advisory 2014:1606 : Updated file packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. The 'file' command is used to identify a particular file according to the type of data contained in the file. The command can identify various file types, including ELF binaries, system libraries, RPM packages, and different graphics formats. Multiple denial of service flaws were found in the way file parsed certain Composite Document Format (CDF) files. A remote attacker could use either of these flaws to crash file, or an application using file, via a specially crafted CDF file. (CVE-2014-0237, CVE-2014-0238, CVE-2014-3479, CVE-2014-3480, CVE-2012-1571) Two denial of service flaws were found in the way file handled indirect and search rules. A remote attacker could use either of these flaws to cause file, or an application using file, to crash or consume an excessive amount of CPU. (CVE-2014-1943, CVE-2014-2270) This update also fixes the following bugs : * Previously, the output of the 'file' command contained redundant white spaces. With this update, the new STRING_TRIM flag has been introduced to remove the unnecessary white spaces. (BZ#664513) * Due to a bug, the 'file' command could incorrectly identify an XML document as a LaTex document. The underlying source code has been modified to fix this bug and the command now works as expected. (BZ#849621) * Previously, the 'file' command could not recognize .JPG files and incorrectly labeled them as 'Minix filesystem'. This bug has been fixed and the command now properly detects .JPG files. (BZ#873997) * Under certain circumstances, the 'file' command incorrectly detected NETpbm files as 'x86 boot sector'. This update applies a patch to fix this bug and the command now detects NETpbm files as expected. (BZ#884396) * Previously, the 'file' command incorrectly identified ASCII text files as a .PIC image file. With this update, a patch has been provided to address this bug and the command now correctly recognizes ASCII text files. (BZ#980941) * On 32-bit PowerPC systems, the 'from' field was missing from the output of the 'file' command. The underlying source code has been modified to fix this bug and 'file' output now contains the 'from' field as expected. (BZ#1037279) * The 'file' command incorrectly detected text files as 'RRDTool DB version ool - Round Robin Database Tool'. This update applies a patch to fix this bug and the command now correctly detects text files. (BZ#1064463) * Previously, the 'file' command supported only version 1 and 2 of the QCOW format. As a consequence, file was unable to detect a 'qcow2 compat=1.1' file created on Red Hat Enterprise Linux 7. With this update, support for QCOW version 3 has been added so that the command now detects such files as expected. (BZ#1067771) All file users are advised to upgrade to these updated packages, which contain backported patches to correct these issues.
    last seen 2019-02-21
    modified 2018-07-18
    plugin id 78527
    published 2014-10-17
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=78527
    title Oracle Linux 6 : file (ELSA-2014-1606)
  • NASL family CentOS Local Security Checks
    NASL id CENTOS_RHSA-2014-1012.NASL
    description Updated php53 and php packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5 and 6 respectively. The Red Hat Security Response Team has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. PHP's fileinfo module provides functions used to identify a particular file according to the type of data contained by the file. Multiple denial of service flaws were found in the way the File Information (fileinfo) extension parsed certain Composite Document Format (CDF) files. A remote attacker could use either of these flaws to crash a PHP application using fileinfo via a specially crafted CDF file. (CVE-2014-0237, CVE-2014-0238, CVE-2014-3479, CVE-2014-3480, CVE-2012-1571) Two denial of service flaws were found in the way the File Information (fileinfo) extension handled indirect and search rules. A remote attacker could use either of these flaws to cause a PHP application using fileinfo to crash or consume an excessive amount of CPU. (CVE-2014-1943, CVE-2014-2270) A heap-based buffer overflow flaw was found in the way PHP parsed DNS TXT records. A malicious DNS server or a man-in-the-middle attacker could possibly use this flaw to execute arbitrary code as the PHP interpreter if a PHP application used the dns_get_record() function to perform a DNS query. (CVE-2014-4049) A type confusion issue was found in PHP's phpinfo() function. A malicious script author could possibly use this flaw to disclose certain portions of server memory. (CVE-2014-4721) A buffer over-read flaw was found in the way the DateInterval class parsed interval specifications. An attacker able to make a PHP application parse a specially crafted specification using DateInterval could possibly cause the PHP interpreter to crash. (CVE-2013-6712) A type confusion issue was found in the SPL ArrayObject and SPLObjectStorage classes' unserialize() method. A remote attacker able to submit specially crafted input to a PHP application, which would then unserialize this input using one of the aforementioned methods, could use this flaw to execute arbitrary code with the privileges of the user running that PHP application. (CVE-2014-3515) The CVE-2014-0237, CVE-2014-0238, CVE-2014-3479, and CVE-2014-3480 issues were discovered by Francisco Alonso of Red Hat Product Security. All php53 and php users are advised to upgrade to these updated packages, which contain backported patches to correct these issues.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 77032
    published 2014-08-07
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=77032
    title CentOS 5 / 6 : php / php53 (CESA-2014:1012)
  • NASL family Debian Local Security Checks
    NASL id DEBIAN_DSA-2943.NASL
    description Several vulnerabilities were found in PHP, a general-purpose scripting language commonly used for web application development : - CVE-2014-0185 The default PHP FPM socket permission has been changed from 0666 to 0660 to mitigate a security vulnerability ( CVE-2014-0185 ) in PHP FPM that allowed any local user to run a PHP code under the active user of FPM process via crafted FastCGI client. The default Debian setup now correctly sets the listen.owner and listen.group to www-data:www-data in default php-fpm.conf. If you have more FPM instances or a webserver not running under www-data user you need to adjust the configuration of FPM pools in /etc/php5/fpm/pool.d/ so the accessing process has rights to access the socket. - CVE-2014-0237 / CVE-2014-0238 Denial of service in the CDF parser of the fileinfo module. - CVE-2014-2270 Denial of service in the fileinfo module.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 74279
    published 2014-06-03
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=74279
    title Debian DSA-2943-1 : php5 - security update
  • NASL family Fedora Local Security Checks
    NASL id FEDORA_2014-6901.NASL
    description 29 May 2014, PHP 5.5.13 CLI server : - Fixed bug #67079 (Missing MIME types for XML/XSL files). (Anatol) COM : - Fixed bug #66431 (Special Character via COM Interface (CP_UTF8)). (Anatol) Core : - Fixed bug #65701 (copy() doesn't work when destination filename is created by tempnam()). (Boro Sitnikovski) - Fixed bug #67072 (Echoing unserialized 'SplFileObject' crash). (Anatol) - Fixed bug #67245 (usage of memcpy() with overlapping src and dst in zend_exceptions.c). (Bob) - Fixed bug #67247 (spl_fixedarray_resize integer overflow). (Stas) - Fixed bug #67249 (printf out-of-bounds read). (Stas) - Fixed bug #67250 (iptcparse out-of-bounds read). (Stas) - Fixed bug #67252 (convert_uudecode out-of-bounds read). (Stas) Curl : - Fixed bug #64247 (CURLOPT_INFILE doesn't allow reset). (Mike) Date : - Fixed bug #67118 (DateTime constructor crash with invalid data). (Anatol) - Fixed bug #67251 (date_parse_from_format out-of-bounds read). (Stas) - Fixed bug #67253 (timelib_meridian_with_check out-of-bounds read). (Stas) DOM : - Fixed bug #67081 (DOMDocumentType->internalSubset returns entire DOCTYPE tag, not only the subset). (Anatol) Fileinfo : - Fixed bug #66307 (Fileinfo crashes with powerpoint files). (Anatol) - Fixed bug #67327 (fileinfo: CDF infinite loop in nelements DoS) (CVE-2014-0238). - Fixed bug #67328 (fileinfo: fileinfo: numerous file_printf calls resulting in performance degradation) (CVE-2014-0237). FPM : - Fixed bug #66908 (php-fpm reload leaks epoll_create() file descriptor). (Julio Pintos) GD : - Fixed bug #67248 (imageaffinematrixget missing check of parameters). (Stas) PCRE : - Fixed bug #67238 (Ungreedy and min/max quantifier bug, applied patch from the upstream). (Anatol) Phar : - Fix bug #64498 ($phar->buildFromDirectory can't compress file with an accent in its name). (PR #588) Backported from 5.5.14 : - Fileinfo: Fixed bug #67326 (fileinfo: cdf_read_short_sector insufficient boundary check). - Core: workaround regression introduce in fix for #67072 - Date: Fixed regression in fix for bug #67118 (constructor can't be called twice). Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2015-10-19
    plugin id 76093
    published 2014-06-18
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=76093
    title Fedora 20 : php-phpunit-PHPUnit-MockObject-1.2.3-4.fc20 / php-5.5.13-3.fc20 / etc (2014-6901)
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2014-1013.NASL
    description Updated php packages that fix multiple security issues are now available for Red Hat Enterprise Linux 7. The Red Hat Security Response Team has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. PHP's fileinfo module provides functions used to identify a particular file according to the type of data contained by the file. A denial of service flaw was found in the File Information (fileinfo) extension rules for detecting AWK files. A remote attacker could use this flaw to cause a PHP application using fileinfo to consume an excessive amount of CPU. (CVE-2013-7345) Multiple denial of service flaws were found in the way the File Information (fileinfo) extension parsed certain Composite Document Format (CDF) files. A remote attacker could use either of these flaws to crash a PHP application using fileinfo via a specially crafted CDF file. (CVE-2014-0207, CVE-2014-0237, CVE-2014-0238, CVE-2014-3479, CVE-2014-3480, CVE-2014-3487) A heap-based buffer overflow flaw was found in the way PHP parsed DNS TXT records. A malicious DNS server or a man-in-the-middle attacker could possibly use this flaw to execute arbitrary code as the PHP interpreter if a PHP application used the dns_get_record() function to perform a DNS query. (CVE-2014-4049) A type confusion issue was found in PHP's phpinfo() function. A malicious script author could possibly use this flaw to disclose certain portions of server memory. (CVE-2014-4721) A type confusion issue was found in the SPL ArrayObject and SPLObjectStorage classes' unserialize() method. A remote attacker able to submit specially crafted input to a PHP application, which would then unserialize this input using one of the aforementioned methods, could use this flaw to execute arbitrary code with the privileges of the user running that PHP application. (CVE-2014-3515) The CVE-2014-0207, CVE-2014-0237, CVE-2014-0238, CVE-2014-3479, CVE-2014-3480, and CVE-2014-3487 issues were discovered by Francisco Alonso of Red Hat Product Security. All php users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. After installing the updated packages, the httpd daemon must be restarted for the update to take effect.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 77016
    published 2014-08-06
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=77016
    title RHEL 7 : php (RHSA-2014:1013)
  • NASL family CentOS Local Security Checks
    NASL id CENTOS_RHSA-2014-1013.NASL
    description Updated php packages that fix multiple security issues are now available for Red Hat Enterprise Linux 7. The Red Hat Security Response Team has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. PHP's fileinfo module provides functions used to identify a particular file according to the type of data contained by the file. A denial of service flaw was found in the File Information (fileinfo) extension rules for detecting AWK files. A remote attacker could use this flaw to cause a PHP application using fileinfo to consume an excessive amount of CPU. (CVE-2013-7345) Multiple denial of service flaws were found in the way the File Information (fileinfo) extension parsed certain Composite Document Format (CDF) files. A remote attacker could use either of these flaws to crash a PHP application using fileinfo via a specially crafted CDF file. (CVE-2014-0207, CVE-2014-0237, CVE-2014-0238, CVE-2014-3479, CVE-2014-3480, CVE-2014-3487) A heap-based buffer overflow flaw was found in the way PHP parsed DNS TXT records. A malicious DNS server or a man-in-the-middle attacker could possibly use this flaw to execute arbitrary code as the PHP interpreter if a PHP application used the dns_get_record() function to perform a DNS query. (CVE-2014-4049) A type confusion issue was found in PHP's phpinfo() function. A malicious script author could possibly use this flaw to disclose certain portions of server memory. (CVE-2014-4721) A type confusion issue was found in the SPL ArrayObject and SPLObjectStorage classes' unserialize() method. A remote attacker able to submit specially crafted input to a PHP application, which would then unserialize this input using one of the aforementioned methods, could use this flaw to execute arbitrary code with the privileges of the user running that PHP application. (CVE-2014-3515) The CVE-2014-0207, CVE-2014-0237, CVE-2014-0238, CVE-2014-3479, CVE-2014-3480, and CVE-2014-3487 issues were discovered by Francisco Alonso of Red Hat Product Security. All php users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. After installing the updated packages, the httpd daemon must be restarted for the update to take effect.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 77033
    published 2014-08-07
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=77033
    title CentOS 7 : php (CESA-2014:1013)
  • NASL family CGI abuses
    NASL id PHP_5_5_13.NASL
    description According to its banner, the version of PHP 5.5.x installed on the remote host is a version prior to 5.5.13. It is, therefore, affected by the following vulnerabilities : - A flaw exists with the 'cdf_unpack_summary_info()' function within 'src/cdf.c' where multiple file_printf calls occur when handling specially crafted CDF files. This could allow a context dependent attacker to crash the web application using PHP. (CVE-2014-0237) - A flaw exists with the 'cdf_read_property_info()' function within 'src/cdf.c' where an infinite loop occurs when handling specially crafted CDF files. This could allow a context dependent attacker to crash the web application using PHP. (CVE-2014-0238) - An out-of-bounds read exists in printf. (Bug #67249) Note that Nessus has not attempted to exploit these issues, but has instead relied only on the application's self-reported version number.
    last seen 2019-02-21
    modified 2018-07-24
    plugin id 74292
    published 2014-06-03
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=74292
    title PHP 5.5.x < 5.5.13 'src/cdf.c' Multiple Vulnerabilities
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2014-1606.NASL
    description Updated file packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. The 'file' command is used to identify a particular file according to the type of data contained in the file. The command can identify various file types, including ELF binaries, system libraries, RPM packages, and different graphics formats. Multiple denial of service flaws were found in the way file parsed certain Composite Document Format (CDF) files. A remote attacker could use either of these flaws to crash file, or an application using file, via a specially crafted CDF file. (CVE-2014-0237, CVE-2014-0238, CVE-2014-3479, CVE-2014-3480, CVE-2012-1571) Two denial of service flaws were found in the way file handled indirect and search rules. A remote attacker could use either of these flaws to cause file, or an application using file, to crash or consume an excessive amount of CPU. (CVE-2014-1943, CVE-2014-2270) This update also fixes the following bugs : * Previously, the output of the 'file' command contained redundant white spaces. With this update, the new STRING_TRIM flag has been introduced to remove the unnecessary white spaces. (BZ#664513) * Due to a bug, the 'file' command could incorrectly identify an XML document as a LaTex document. The underlying source code has been modified to fix this bug and the command now works as expected. (BZ#849621) * Previously, the 'file' command could not recognize .JPG files and incorrectly labeled them as 'Minix filesystem'. This bug has been fixed and the command now properly detects .JPG files. (BZ#873997) * Under certain circumstances, the 'file' command incorrectly detected NETpbm files as 'x86 boot sector'. This update applies a patch to fix this bug and the command now detects NETpbm files as expected. (BZ#884396) * Previously, the 'file' command incorrectly identified ASCII text files as a .PIC image file. With this update, a patch has been provided to address this bug and the command now correctly recognizes ASCII text files. (BZ#980941) * On 32-bit PowerPC systems, the 'from' field was missing from the output of the 'file' command. The underlying source code has been modified to fix this bug and 'file' output now contains the 'from' field as expected. (BZ#1037279) * The 'file' command incorrectly detected text files as 'RRDTool DB version ool - Round Robin Database Tool'. This update applies a patch to fix this bug and the command now correctly detects text files. (BZ#1064463) * Previously, the 'file' command supported only version 1 and 2 of the QCOW format. As a consequence, file was unable to detect a 'qcow2 compat=1.1' file created on Red Hat Enterprise Linux 7. With this update, support for QCOW version 3 has been added so that the command now detects such files as expected. (BZ#1067771) All file users are advised to upgrade to these updated packages, which contain backported patches to correct these issues.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 78414
    published 2014-10-14
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=78414
    title RHEL 6 : file (RHSA-2014:1606)
  • NASL family Mandriva Local Security Checks
    NASL id MANDRIVA_MDVSA-2014-116.NASL
    description Updated file packages fix security vulnerabilities : A flaw was found in the way file's Composite Document Files (CDF) format parser handle CDF files with many summary info entries. The cdf_unpack_summary_info() function unnecessarily repeatedly read the info from the same offset. This led to many file_printf() calls in cdf_file_property_info(), which caused file to use an excessive amount of CPU time when parsing a specially crafted CDF file (CVE-2014-0237). A flaw was found in the way file parsed property information from Composite Document Files (CDF) files. A property entry with 0 elements triggers an infinite loop (CVE-2014-0238).
    last seen 2019-02-21
    modified 2018-07-19
    plugin id 74449
    published 2014-06-11
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=74449
    title Mandriva Linux Security Advisory : file (MDVSA-2014:116)
  • NASL family Amazon Linux Local Security Checks
    NASL id ALA_ALAS-2014-362.NASL
    description The cdf_unpack_summary_info function in cdf.c in the Fileinfo component in PHP before 5.4.29 and 5.5.x before 5.5.13 allows remote attackers to cause a denial of service (performance degradation) by triggering many file_printf calls. The cdf_read_property_info function in cdf.c in the Fileinfo component in PHP before 5.4.29 and 5.5.x before 5.5.13 allows remote attackers to cause a denial of service (infinite loop or out-of-bounds memory access) via a vector that (1) has zero length or (2) is too long.
    last seen 2019-02-21
    modified 2018-04-18
    plugin id 78305
    published 2014-10-12
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=78305
    title Amazon Linux AMI : php55 (ALAS-2014-362)
  • NASL family F5 Networks Local Security Checks
    NASL id F5_BIGIP_SOL16954.NASL
    description The cdf_unpack_summary_info function in cdf.c in the Fileinfo component in PHP before 5.4.29 and 5.5.x before 5.5.13 allows remote attackers to cause a denial of service (performance degradation) by triggering many file_printf calls.
    last seen 2019-02-21
    modified 2019-01-04
    plugin id 86014
    published 2015-09-18
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=86014
    title F5 Networks BIG-IP : Multiple PHP CDF vulnerabilities (SOL16954)
  • NASL family MacOS X Local Security Checks
    NASL id MACOSX_10_10_3.NASL
    description The remote host is running a version of Mac OS X 10.10.x that is prior to 10.10.3. It is, therefore, affected multiple vulnerabilities in the following components : - Admin Framework - Apache - ATS - Certificate Trust Policy - CFNetwork HTTPProtocol - CFNetwork Session - CFURL - CoreAnimation - FontParser - Graphics Driver - Hypervisor - ImageIO - IOHIDFamily - Kernel - LaunchServices - libnetcore - ntp - Open Directory Client - OpenLDAP - OpenSSL - PHP - QuickLook - SceneKit - ScreenSharing - Security - Code SIgning - UniformTypeIdentifiers - WebKit Note that successful exploitation of the most serious issues can result in arbitrary code execution.
    last seen 2019-02-21
    modified 2018-07-14
    plugin id 82699
    published 2015-04-10
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=82699
    title Mac OS X 10.10.x < 10.10.3 Multiple Vulnerabilities (FREAK)
  • NASL family SuSE Local Security Checks
    NASL id OPENSUSE-2014-419.NASL
    description php5 was updated to fix several security issues. These issues were fixed : - Performance degradation by too many file_printf calls (CVE-2014-0237) - DoS in Fileinfo component (CVE-2014-0238) - NULL pointer dereference in GD XPM decoder (CVE-2014-2497) - Privilege escalation due to insecure default config (CVE-2014-0185)
    last seen 2019-02-21
    modified 2019-01-02
    plugin id 75385
    published 2014-06-13
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=75385
    title openSUSE Security Update : php5 (openSUSE-SU-2014:0784-1)
  • NASL family Amazon Linux Local Security Checks
    NASL id ALA_ALAS-2014-393.NASL
    description A denial of service flaw was found in the way the File Information (fileinfo) extension parsed certain Composite Document Format (CDF) files. A remote attacker could use this flaw to crash a PHP application using fileinfo via a specially crafted CDF file. acinclude.m4, as used in the configure script in PHP 5.5.13 and earlier, allows local users to overwrite arbitrary files via a symlink attack on the /tmp/phpglibccheck file. A buffer over-read flaw was found in the way the DateInterval class parsed interval specifications. An attacker able to make a PHP application parse a specially crafted specification using DateInterval could possibly cause the PHP interpreter to crash. A heap-based buffer overflow flaw was found in the way PHP parsed DNS TXT records. A malicious DNS server or a man-in-the-middle attacker could possibly use this flaw to execute arbitrary code as the PHP interpreter if a PHP application used the dns_get_record() function to perform a DNS query. A type confusion issue was found in the SPL ArrayObject and SPLObjectStorage classes' unserialize() method. A remote attacker able to submit specially crafted input to a PHP application, which would then unserialize this input using one of the aforementioned methods, could use this flaw to execute arbitrary code with the privileges of the user running that PHP application.
    last seen 2019-02-21
    modified 2018-04-18
    plugin id 78336
    published 2014-10-12
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=78336
    title Amazon Linux AMI : php (ALAS-2014-393)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_11_APACHE2-MOD_PHP53-140627.NASL
    description php53 was updated to fix the following security vulnerabilities : - Heap-based buffer overflow in DNS TXT record parsing. (CVE-2014-4049) - Denial of service in Fileinfo component. (CVE-2014-0238) - Performance degradation by too many file_printf calls. (CVE-2014-0237) - NULL pointer dereference in GD XPM decoder. (CVE-2014-2497)
    last seen 2018-09-01
    modified 2014-08-31
    plugin id 76367
    published 2014-07-04
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=76367
    title SuSE 11.3 Security Update : php53 (SAT Patch Number 9450)
  • NASL family CGI abuses
    NASL id PHP_5_3_29.NASL
    description According to its banner, the version of PHP installed on the remote host is 5.3.x prior to 5.3.29. It is, therefore, affected by the following vulnerabilities : - A heap-based buffer overflow error exists in the file 'ext/date/lib/parse_iso_intervals.c' related to handling DateInterval objects that allows denial of service attacks. (CVE-2013-6712) - A boundary checking error exists related to the Fileinfo extension, Composite Document Format (CDF) handling, and the function 'cdf_read_short_sector'. (CVE-2014-0207) - A flaw exists with the 'cdf_unpack_summary_info()' function within 'src/cdf.c' where multiple file_printf calls occur when handling specially crafted CDF files. This could allow a context dependent attacker to crash the web application using PHP. (CVE-2014-0237) - A flaw exists with the 'cdf_read_property_info()' function within 'src/cdf.c' where an infinite loop occurs when handling specially crafted CDF files. This could allow a context dependent attacker to crash the web application using PHP. (CVE-2014-0238) - A type-confusion error exists related to the Standard PHP Library (SPL) extension and the function 'unserialize'. (CVE-2014-3515) - An error exists related to configuration scripts and temporary file handling that could allow insecure file usage. (CVE-2014-3981) - A heap-based buffer overflow error exists related to the function 'dns_get_record' that could allow execution of arbitrary code. (CVE-2014-4049) - An out-of-bounds read exists in printf. (Bug #67249) Note that Nessus has not attempted to exploit these issues, but has instead relied only on the application's self-reported version number. Additionally, note that version 5.3.29 marks the end of support for the PHP 5.3.x branch.
    last seen 2019-02-21
    modified 2018-07-24
    plugin id 77285
    published 2014-08-20
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=77285
    title PHP 5.3.x < 5.3.29 Multiple Vulnerabilities
  • NASL family Fedora Local Security Checks
    NASL id FEDORA_2014-6904.NASL
    description 29 May 2014, PHP 5.5.13 CLI server : - Fixed bug #67079 (Missing MIME types for XML/XSL files). (Anatol) COM : - Fixed bug #66431 (Special Character via COM Interface (CP_UTF8)). (Anatol) Core : - Fixed bug #65701 (copy() doesn't work when destination filename is created by tempnam()). (Boro Sitnikovski) - Fixed bug #67072 (Echoing unserialized 'SplFileObject' crash). (Anatol) - Fixed bug #67245 (usage of memcpy() with overlapping src and dst in zend_exceptions.c). (Bob) - Fixed bug #67247 (spl_fixedarray_resize integer overflow). (Stas) - Fixed bug #67249 (printf out-of-bounds read). (Stas) - Fixed bug #67250 (iptcparse out-of-bounds read). (Stas) - Fixed bug #67252 (convert_uudecode out-of-bounds read). (Stas) Curl : - Fixed bug #64247 (CURLOPT_INFILE doesn't allow reset). (Mike) Date : - Fixed bug #67118 (DateTime constructor crash with invalid data). (Anatol) - Fixed bug #67251 (date_parse_from_format out-of-bounds read). (Stas) - Fixed bug #67253 (timelib_meridian_with_check out-of-bounds read). (Stas) DOM : - Fixed bug #67081 (DOMDocumentType->internalSubset returns entire DOCTYPE tag, not only the subset). (Anatol) Fileinfo : - Fixed bug #66307 (Fileinfo crashes with powerpoint files). (Anatol) - Fixed bug #67327 (fileinfo: CDF infinite loop in nelements DoS) (CVE-2014-0238). - Fixed bug #67328 (fileinfo: fileinfo: numerous file_printf calls resulting in performance degradation) (CVE-2014-0237). FPM : - Fixed bug #66908 (php-fpm reload leaks epoll_create() file descriptor). (Julio Pintos) GD : - Fixed bug #67248 (imageaffinematrixget missing check of parameters). (Stas) PCRE : - Fixed bug #67238 (Ungreedy and min/max quantifier bug, applied patch from the upstream). (Anatol) Phar : - Fix bug #64498 ($phar->buildFromDirectory can't compress file with an accent in its name). (PR #588) Backported from 5.5.14 : - Fileinfo: Fixed bug #67326 (fileinfo: cdf_read_short_sector insufficient boundary check). - Core: workaround regression introduce in fix for #67072 - Date: Fixed regression in fix for bug #67118 (constructor can't be called twice). Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2015-10-19
    plugin id 76094
    published 2014-06-18
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=76094
    title Fedora 19 : php-phpunit-PHPUnit-MockObject-1.2.3-4.fc19 / php-5.5.13-3.fc19 / etc (2014-6904)
  • NASL family Debian Local Security Checks
    NASL id DEBIAN_DLA-27.NASL
    description Fix various denial of service attacks : CVE-2014-3487 The cdf_read_property_info function does not properly validate a stream offset, which allows remote attackers to cause a denial of service (application crash) via a crafted CDF file. CVE-2014-3480 The cdf_count_chain function in cdf.c in does not properly validate sector-count data, which allows remote attackers to cause a denial of service (application crash) via a crafted CDF file. CVE-2014-3479 The cdf_check_stream_offset function in cdf.c relies on incorrect sector-size data, which allows remote attackers to cause a denial of service (application crash) via a crafted stream offset in a CDF file. CVE-2014-3478 Buffer overflow in the mconvert function in softmagic.c allows remote attackers to cause a denial of service (application crash) via a crafted Pascal string in a FILE_PSTRING conversion. CVE-2014-0238 The cdf_read_property_info function in cdf.c allows remote attackers to cause a denial of service (infinite loop or out-of-bounds memory access) via a vector that (1) has zero length or (2) is too long. CVE-2014-0237 The cdf_unpack_summary_info function in cdf.c allows remote attackers to cause a denial of service (performance degradation) by triggering many file_printf calls. CVE-2014-0207 The cdf_read_short_sector function in cdf.c allows remote attackers to cause a denial of service (assertion failure and application exit) via a crafted CDF file. NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-07-06
    plugin id 82175
    published 2015-03-26
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=82175
    title Debian DLA-27-1 : file security update
  • NASL family Amazon Linux Local Security Checks
    NASL id ALA_ALAS-2014-361.NASL
    description The cdf_unpack_summary_info function in cdf.c in the Fileinfo component in PHP before 5.4.29 and 5.5.x before 5.5.13 allows remote attackers to cause a denial of service (performance degradation) by triggering many file_printf calls. The cdf_read_property_info function in cdf.c in the Fileinfo component in PHP before 5.4.29 and 5.5.x before 5.5.13 allows remote attackers to cause a denial of service (infinite loop or out-of-bounds memory access) via a vector that (1) has zero length or (2) is too long.
    last seen 2019-02-21
    modified 2018-04-18
    plugin id 78304
    published 2014-10-12
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=78304
    title Amazon Linux AMI : php54 (ALAS-2014-361)
  • NASL family Mandriva Local Security Checks
    NASL id MANDRIVA_MDVSA-2014-115.NASL
    description Updated php packages fix security vulnerabilities : A flaw was found in the way file's Composite Document Files (CDF) format parser handle CDF files with many summary info entries. The cdf_unpack_summary_info() function unnecessarily repeatedly read the info from the same offset. This led to many file_printf() calls in cdf_file_property_info(), which caused file to use an excessive amount of CPU time when parsing a specially crafted CDF file (CVE-2014-0237). A flaw was found in the way file parsed property information from Composite Document Files (CDF) files. A property entry with 0 elements triggers an infinite loop (CVE-2014-0238). PHP contains a bundled copy of the file utility's libmagic library, so it was vulnerable to this issue. It has been updated to the 5.5.13 version, which fixes this issue and several other bugs. Additionally, php-apc has been rebuilt against the updated php packages.
    last seen 2019-02-21
    modified 2018-07-19
    plugin id 74448
    published 2014-06-11
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=74448
    title Mandriva Linux Security Advisory : php (MDVSA-2014:115)
  • NASL family Debian Local Security Checks
    NASL id DEBIAN_DLA-145.NASL
    description Brief introduction CVE-2014-0237 The cdf_unpack_summary_info function in cdf.c in the Fileinfo component in PHP before 5.4.29 and 5.5.x before 5.5.13 allows remote attackers to cause a denial of service (performance degradation) by triggering many file_printf calls. CVE-2014-0238 The cdf_read_property_info function in cdf.c in the Fileinfo component in PHP before 5.4.29 and 5.5.x before 5.5.13 allows remote attackers to cause a denial of service (infinite loop or out-of-bounds memory access) via a vector that (1) has zero length or (2) is too long. CVE-2014-2270 softmagic.c in file before 5.17 and libmagic allows context dependent attackers to cause a denial of service (out-of-bounds memory access and crash) via crafted offsets in the softmagic of a PE executable. CVE-2014-8117 - Stop reporting bad capabilities after the first few. - limit the number of program and section header number of sections - limit recursion level CVE-2015-TEMP (no official CVE number available yet) - NULL pointer deference (PHP bugs: 68739 68740) - out-of-bounds memory access (file bug: 398) additional patches from CVE-2014-3478 added NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-07-06
    plugin id 82128
    published 2015-03-26
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=82128
    title Debian DLA-145-1 : php5 security update
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2015-2155.NASL
    description Updated file packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. The file command is used to identify a particular file according to the type of data the file contains. It can identify many different file types, including Executable and Linkable Format (ELF) binary files, system libraries, RPM packages, and different graphics formats. Multiple denial of service flaws were found in the way file parsed certain Composite Document Format (CDF) files. A remote attacker could use either of these flaws to crash file, or an application using file, via a specially crafted CDF file. (CVE-2014-0207, CVE-2014-0237, CVE-2014-0238, CVE-2014-3479, CVE-2014-3480, CVE-2014-3487, CVE-2014-3587) Two flaws were found in the way file processed certain Pascal strings. A remote attacker could cause file to crash if it was used to identify the type of the attacker-supplied file. (CVE-2014-3478, CVE-2014-9652) Multiple flaws were found in the file regular expression rules for detecting various files. A remote attacker could use these flaws to cause file to consume an excessive amount of CPU. (CVE-2014-3538) Multiple flaws were found in the way file parsed Executable and Linkable Format (ELF) files. A remote attacker could use these flaws to cause file to crash, disclose portions of its memory, or consume an excessive amount of system resources. (CVE-2014-3710, CVE-2014-8116, CVE-2014-8117, CVE-2014-9653) Red Hat would like to thank Thomas Jarosch of Intra2net AG for reporting the CVE-2014-8116 and CVE-2014-8117 issues. The CVE-2014-0207, CVE-2014-0237, CVE-2014-0238, CVE-2014-3478, CVE-2014-3479, CVE-2014-3480, CVE-2014-3487, CVE-2014-3710 issues were discovered by Francisco Alonso of Red Hat Product Security; the CVE-2014-3538 issue was discovered by Jan Kaluza of the Red Hat Web Stack Team The file packages have been updated to ensure correct operation on Power little endian and ARM 64-bit hardware architectures. (BZ#1224667, BZ#1224668, BZ#1157850, BZ#1067688). All file users are advised to upgrade to these updated packages, which contain backported patches to correct these issues.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 86973
    published 2015-11-20
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=86973
    title RHEL 7 : file (RHSA-2015:2155)
  • NASL family Scientific Linux Local Security Checks
    NASL id SL_20141014_FILE_ON_SL6_X.NASL
    description Multiple denial of service flaws were found in the way file parsed certain Composite Document Format (CDF) files. A remote attacker could use either of these flaws to crash file, or an application using file, via a specially crafted CDF file. (CVE-2014-0237, CVE-2014-0238, CVE-2014-3479, CVE-2014-3480, CVE-2012-1571) Two denial of service flaws were found in the way file handled indirect and search rules. A remote attacker could use either of these flaws to cause file, or an application using file, to crash or consume an excessive amount of CPU. (CVE-2014-1943, CVE-2014-2270) This update also fixes the following bugs : - Previously, the output of the 'file' command contained redundant white spaces. With this update, the new STRING_TRIM flag has been introduced to remove the unnecessary white spaces. - Due to a bug, the 'file' command could incorrectly identify an XML document as a LaTex document. The underlying source code has been modified to fix this bug and the command now works as expected. - Previously, the 'file' command could not recognize .JPG files and incorrectly labeled them as 'Minix filesystem'. This bug has been fixed and the command now properly detects .JPG files. - Under certain circumstances, the 'file' command incorrectly detected NETpbm files as 'x86 boot sector'. This update applies a patch to fix this bug and the command now detects NETpbm files as expected. - Previously, the 'file' command incorrectly identified ASCII text files as a .PIC image file. With this update, a patch has been provided to address this bug and the command now correctly recognizes ASCII text files. - On 32-bit PowerPC systems, the 'from' field was missing from the output of the 'file' command. The underlying source code has been modified to fix this bug and 'file' output now contains the 'from' field as expected. - The 'file' command incorrectly detected text files as 'RRDTool DB version ool - Round Robin Database Tool'. This update applies a patch to fix this bug and the command now correctly detects text files. - Previously, the 'file' command supported only version 1 and 2 of the QCOW format. As a consequence, file was unable to detect a 'qcow2 compat=1.1' file created on Scientific Linux 7. With this update, support for QCOW version 3 has been added so that the command now detects such files as expected.
    last seen 2019-02-21
    modified 2018-12-28
    plugin id 78843
    published 2014-11-04
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=78843
    title Scientific Linux Security Update : file on SL6.x i386/x86_64
  • NASL family Amazon Linux Local Security Checks
    NASL id ALA_ALAS-2014-382.NASL
    description A denial of service flaw was found in the way the File Information (fileinfo) extension parsed certain Composite Document Format (CDF) files. A remote attacker could use this flaw to crash a PHP application using fileinfo via a specially crafted CDF file. Buffer overflow in the mconvert function in softmagic.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, allows remote attackers to cause a denial of service (application crash) via a crafted Pascal string in a FILE_PSTRING conversion. file before 5.19 does not properly restrict the amount of data read during a regex search, which allows remote attackers to cause a denial of service (CPU consumption) via a crafted file that triggers backtracking during processing of an awk rule. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7345 .
    last seen 2019-02-21
    modified 2018-04-18
    plugin id 78325
    published 2014-10-12
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=78325
    title Amazon Linux AMI : file (ALAS-2014-382)
  • NASL family Scientific Linux Local Security Checks
    NASL id SL_20140806_PHP53_AND_PHP_ON_SL5_X.NASL
    description Multiple denial of service flaws were found in the way the File Information (fileinfo) extension parsed certain Composite Document Format (CDF) files. A remote attacker could use either of these flaws to crash a PHP application using fileinfo via a specially crafted CDF file. (CVE-2014-0237, CVE-2014-0238, CVE-2014-3479, CVE-2014-3480, CVE-2012-1571) Two denial of service flaws were found in the way the File Information (fileinfo) extension handled indirect and search rules. A remote attacker could use either of these flaws to cause a PHP application using fileinfo to crash or consume an excessive amount of CPU. (CVE-2014-1943, CVE-2014-2270) A heap-based buffer overflow flaw was found in the way PHP parsed DNS TXT records. A malicious DNS server or a man-in-the-middle attacker could possibly use this flaw to execute arbitrary code as the PHP interpreter if a PHP application used the dns_get_record() function to perform a DNS query. (CVE-2014-4049) A type confusion issue was found in PHP's phpinfo() function. A malicious script author could possibly use this flaw to disclose certain portions of server memory. (CVE-2014-4721) A buffer over-read flaw was found in the way the DateInterval class parsed interval specifications. An attacker able to make a PHP application parse a specially crafted specification using DateInterval could possibly cause the PHP interpreter to crash. (CVE-2013-6712) A type confusion issue was found in the SPL ArrayObject and SPLObjectStorage classes' unserialize() method. A remote attacker able to submit specially crafted input to a PHP application, which would then unserialize this input using one of the aforementioned methods, could use this flaw to execute arbitrary code with the privileges of the user running that PHP application. (CVE-2014-3515)
    last seen 2019-02-21
    modified 2018-12-28
    plugin id 77047
    published 2014-08-07
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=77047
    title Scientific Linux Security Update : php53 and php on SL5.x, SL6.x i386/x86_64
  • NASL family Oracle Linux Local Security Checks
    NASL id ORACLELINUX_ELSA-2014-1013.NASL
    description From Red Hat Security Advisory 2014:1013 : Updated php packages that fix multiple security issues are now available for Red Hat Enterprise Linux 7. The Red Hat Security Response Team has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. PHP's fileinfo module provides functions used to identify a particular file according to the type of data contained by the file. A denial of service flaw was found in the File Information (fileinfo) extension rules for detecting AWK files. A remote attacker could use this flaw to cause a PHP application using fileinfo to consume an excessive amount of CPU. (CVE-2013-7345) Multiple denial of service flaws were found in the way the File Information (fileinfo) extension parsed certain Composite Document Format (CDF) files. A remote attacker could use either of these flaws to crash a PHP application using fileinfo via a specially crafted CDF file. (CVE-2014-0207, CVE-2014-0237, CVE-2014-0238, CVE-2014-3479, CVE-2014-3480, CVE-2014-3487) A heap-based buffer overflow flaw was found in the way PHP parsed DNS TXT records. A malicious DNS server or a man-in-the-middle attacker could possibly use this flaw to execute arbitrary code as the PHP interpreter if a PHP application used the dns_get_record() function to perform a DNS query. (CVE-2014-4049) A type confusion issue was found in PHP's phpinfo() function. A malicious script author could possibly use this flaw to disclose certain portions of server memory. (CVE-2014-4721) A type confusion issue was found in the SPL ArrayObject and SPLObjectStorage classes' unserialize() method. A remote attacker able to submit specially crafted input to a PHP application, which would then unserialize this input using one of the aforementioned methods, could use this flaw to execute arbitrary code with the privileges of the user running that PHP application. (CVE-2014-3515) The CVE-2014-0207, CVE-2014-0237, CVE-2014-0238, CVE-2014-3479, CVE-2014-3480, and CVE-2014-3487 issues were discovered by Francisco Alonso of Red Hat Product Security. All php users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. After installing the updated packages, the httpd daemon must be restarted for the update to take effect.
    last seen 2019-02-21
    modified 2015-12-01
    plugin id 77044
    published 2014-08-07
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=77044
    title Oracle Linux 7 : php (ELSA-2014-1013)
redhat via4
advisories
  • rhsa
    id RHSA-2014:1765
  • rhsa
    id RHSA-2014:1766
rpms
  • php53-0:5.3.3-23.el5_10
  • php53-bcmath-0:5.3.3-23.el5_10
  • php53-cli-0:5.3.3-23.el5_10
  • php53-common-0:5.3.3-23.el5_10
  • php53-dba-0:5.3.3-23.el5_10
  • php53-devel-0:5.3.3-23.el5_10
  • php53-gd-0:5.3.3-23.el5_10
  • php53-imap-0:5.3.3-23.el5_10
  • php53-intl-0:5.3.3-23.el5_10
  • php53-ldap-0:5.3.3-23.el5_10
  • php53-mbstring-0:5.3.3-23.el5_10
  • php53-mysql-0:5.3.3-23.el5_10
  • php53-odbc-0:5.3.3-23.el5_10
  • php53-pdo-0:5.3.3-23.el5_10
  • php53-pgsql-0:5.3.3-23.el5_10
  • php53-process-0:5.3.3-23.el5_10
  • php53-pspell-0:5.3.3-23.el5_10
  • php53-snmp-0:5.3.3-23.el5_10
  • php53-soap-0:5.3.3-23.el5_10
  • php53-xml-0:5.3.3-23.el5_10
  • php53-xmlrpc-0:5.3.3-23.el5_10
  • php-0:5.3.3-27.el6_5.1
  • php-bcmath-0:5.3.3-27.el6_5.1
  • php-cli-0:5.3.3-27.el6_5.1
  • php-common-0:5.3.3-27.el6_5.1
  • php-dba-0:5.3.3-27.el6_5.1
  • php-devel-0:5.3.3-27.el6_5.1
  • php-embedded-0:5.3.3-27.el6_5.1
  • php-enchant-0:5.3.3-27.el6_5.1
  • php-fpm-0:5.3.3-27.el6_5.1
  • php-gd-0:5.3.3-27.el6_5.1
  • php-imap-0:5.3.3-27.el6_5.1
  • php-intl-0:5.3.3-27.el6_5.1
  • php-ldap-0:5.3.3-27.el6_5.1
  • php-mbstring-0:5.3.3-27.el6_5.1
  • php-mysql-0:5.3.3-27.el6_5.1
  • php-odbc-0:5.3.3-27.el6_5.1
  • php-pdo-0:5.3.3-27.el6_5.1
  • php-pgsql-0:5.3.3-27.el6_5.1
  • php-process-0:5.3.3-27.el6_5.1
  • php-pspell-0:5.3.3-27.el6_5.1
  • php-recode-0:5.3.3-27.el6_5.1
  • php-snmp-0:5.3.3-27.el6_5.1
  • php-soap-0:5.3.3-27.el6_5.1
  • php-tidy-0:5.3.3-27.el6_5.1
  • php-xml-0:5.3.3-27.el6_5.1
  • php-xmlrpc-0:5.3.3-27.el6_5.1
  • php-zts-0:5.3.3-27.el6_5.1
  • php-0:5.4.16-23.el7_0
  • php-bcmath-0:5.4.16-23.el7_0
  • php-cli-0:5.4.16-23.el7_0
  • php-common-0:5.4.16-23.el7_0
  • php-dba-0:5.4.16-23.el7_0
  • php-devel-0:5.4.16-23.el7_0
  • php-embedded-0:5.4.16-23.el7_0
  • php-enchant-0:5.4.16-23.el7_0
  • php-fpm-0:5.4.16-23.el7_0
  • php-gd-0:5.4.16-23.el7_0
  • php-intl-0:5.4.16-23.el7_0
  • php-ldap-0:5.4.16-23.el7_0
  • php-mbstring-0:5.4.16-23.el7_0
  • php-mysql-0:5.4.16-23.el7_0
  • php-mysqlnd-0:5.4.16-23.el7_0
  • php-odbc-0:5.4.16-23.el7_0
  • php-pdo-0:5.4.16-23.el7_0
  • php-pgsql-0:5.4.16-23.el7_0
  • php-process-0:5.4.16-23.el7_0
  • php-pspell-0:5.4.16-23.el7_0
  • php-recode-0:5.4.16-23.el7_0
  • php-snmp-0:5.4.16-23.el7_0
  • php-soap-0:5.4.16-23.el7_0
  • php-xml-0:5.4.16-23.el7_0
  • php-xmlrpc-0:5.4.16-23.el7_0
  • file-0:5.04-21.el6
  • file-devel-0:5.04-21.el6
  • file-libs-0:5.04-21.el6
  • file-static-0:5.04-21.el6
  • python-magic-0:5.04-21.el6
  • file-0:5.11-31.el7
  • file-devel-0:5.11-31.el7
  • file-libs-0:5.11-31.el7
  • file-static-0:5.11-31.el7
  • python-magic-0:5.11-31.el7
refmap via4
apple APPLE-SA-2015-04-08-2
bid 67765
confirm
debian DSA-3021
secunia
  • 59061
  • 59329
  • 59418
  • 60998
suse SUSE-SU-2014:0869
Last major update 06-01-2017 - 21:59
Published 01-06-2014 - 00:29
Back to Top