Vulnerability   
Search   
    Search 219043 CVE descriptions
and 99761 test descriptions,
access 10,000+ cross references.
Tests   CVE   All  

Test ID:1.3.6.1.4.1.25623.1.0.58201
Category:Red Hat Local Security Checks
Title:RedHat Security Advisory RHSA-2007:0154
Summary:NOSUMMARY
Description:Description:

The remote host is missing updates announced in
advisory RHSA-2007:0154.

PHP is an HTML-embedded scripting language commonly used with the Apache
HTTP Web server.

A denial of service flaw was found in the way PHP processed a deeply nested
array. A remote attacker could cause the PHP interpreter to crash by
submitting an input variable with a deeply nested array. (CVE-2007-1285)

A flaw was found in the way PHP's unserialize() function processes data. If
a remote attacker is able to pass arbitrary data to PHP's unserialize()
function, it may be possible for them to execute arbitrary code as the
apache user. (CVE-2007-1286)

A double free flaw was found in PHP's session_decode() function. If a
remote attacker is able to pass arbitrary data to PHP's session_decode()
function, it may be possible for them to execute arbitrary code as the
apache user. (CVE-2007-1711)

Users of PHP should upgrade to these updated packages which contain
backported patches to correct these issues.

Solution:
Please note that this update is available via
Red Hat Network. To use Red Hat Network, launch the Red
Hat Update Agent with the following command: up2date

http://rhn.redhat.com/errata/RHSA-2007-0154.html
http://www.redhat.com/security/updates/classification/#important

Risk factor : High

CVSS Score:
6.8

Cross-Ref: Common Vulnerability Exposure (CVE) ID: CVE-2007-1285
BugTraq ID: 22764
http://www.securityfocus.com/bid/22764
Bugtraq: 20070418 rPSA-2007-0073-1 php php-mysql php-pgsql (Google Search)
http://www.securityfocus.com/archive/1/466166/100/0/threaded
http://security.gentoo.org/glsa/glsa-200705-19.xml
http://www.mandriva.com/security/advisories?name=MDKSA-2007:087
http://www.mandriva.com/security/advisories?name=MDKSA-2007:088
http://www.mandriva.com/security/advisories?name=MDKSA-2007:089
http://www.mandriva.com/security/advisories?name=MDKSA-2007:090
http://www.php-security.org/MOPB/MOPB-03-2007.html
http://www.osvdb.org/32769
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11017
http://www.redhat.com/support/errata/RHSA-2007-0082.html
RedHat Security Advisories: RHSA-2007:0154
http://rhn.redhat.com/errata/RHSA-2007-0154.html
RedHat Security Advisories: RHSA-2007:0155
http://rhn.redhat.com/errata/RHSA-2007-0155.html
http://www.redhat.com/support/errata/RHSA-2007-0162.html
RedHat Security Advisories: RHSA-2007:0163
http://rhn.redhat.com/errata/RHSA-2007-0163.html
http://www.securitytracker.com/id?1017771
http://secunia.com/advisories/24909
http://secunia.com/advisories/24910
http://secunia.com/advisories/24924
http://secunia.com/advisories/24941
http://secunia.com/advisories/24945
http://secunia.com/advisories/25445
http://secunia.com/advisories/26048
http://secunia.com/advisories/26642
http://secunia.com/advisories/27864
http://secunia.com/advisories/28936
http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.335136
SuSE Security Announcement: SUSE-SA:2007:044 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2007-07/msg00006.html
https://usn.ubuntu.com/549-1/
http://www.ubuntu.com/usn/usn-549-2
Common Vulnerability Exposure (CVE) ID: CVE-2007-1286
BugTraq ID: 22765
http://www.securityfocus.com/bid/22765
Debian Security Information: DSA-1282 (Google Search)
http://www.debian.org/security/2007/dsa-1282
Debian Security Information: DSA-1283 (Google Search)
http://www.debian.org/security/2007/dsa-1283
http://security.gentoo.org/glsa/glsa-200703-21.xml
HPdes Security Advisory: HPSBMA02215
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01056506
HPdes Security Advisory: HPSBTU02232
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01086137
HPdes Security Advisory: SSRT071423
HPdes Security Advisory: SSRT071429
http://www.php-security.org/MOPB/MOPB-04-2007.html
http://www.osvdb.org/32771
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11575
http://secunia.com/advisories/24419
http://secunia.com/advisories/24606
http://secunia.com/advisories/25025
http://secunia.com/advisories/25062
http://secunia.com/advisories/25423
http://secunia.com/advisories/25850
http://www.trustix.org/errata/2007/0009/
http://www.vupen.com/english/advisories/2007/1991
http://www.vupen.com/english/advisories/2007/2374
XForce ISS Database: php-zval-code-execution(32796)
https://exchange.xforce.ibmcloud.com/vulnerabilities/32796
Common Vulnerability Exposure (CVE) ID: CVE-2007-1711
http://lists.apple.com/archives/security-announce//2007/Jul/msg00004.html
BugTraq ID: 23121
http://www.securityfocus.com/bid/23121
BugTraq ID: 25159
http://www.securityfocus.com/bid/25159
http://www.php-security.org/MOPB/MOPB-32-2007.html
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10406
http://secunia.com/advisories/26235
http://www.vupen.com/english/advisories/2007/2732
XForce ISS Database: php-deserializer-code-execution(33575)
https://exchange.xforce.ibmcloud.com/vulnerabilities/33575
CopyrightCopyright (c) 2007 E-Soft Inc. http://www.securityspace.com

This is only one of 99761 vulnerability tests in our test suite. Find out more about running a complete security audit.

To run a free test of this vulnerability against your system, register below.




© 1998-2021 E-Soft Inc. All rights reserved.