English | Deutsch | Español | Português
 UserID:
 Passwd:
new user
 About:   Dedicated  | Advanced  | Standard  | Recurring  | No Risk  | Desktop  | Basic  | Single  | Security Seal  | FAQ
  Price/Feature Summary  | Order  | New Vulnerabilities  | Confidentiality  | Vulnerability Search
 Vulnerability   
Search   
    Search 75803 CVE descriptions
and 40037 test descriptions,
access 10,000+ cross references.
Tests   CVE   All  

Test ID:1.3.6.1.4.1.25623.1.0.70257
Category:FreeBSD Local Security Checks
Title:FreeBSD Ports: php5, php5-sockets
Summary:FreeBSD Ports: php5, php5-sockets
Description:The remote host is missing an update to the system
as announced in the referenced advisory.

The following packages are affected:
php5
php5-sockets

CVE-2011-2483
crypt_blowfish before 1.1, as used in PHP before 5.3.7 on certain
platforms, does not properly handle 8-bit characters, which makes it
easier for context-dependent attackers to determine a cleartext
password by leveraging knowledge of a password hash.

CVE-2011-2202
The rfc1867_post_handler function in main/rfc1867.c in PHP before
5.3.7 does not properly restrict filenames in multipart/form-data POST
requests, which allows remote attackers to conduct absolute path
traversal attacks, and possibly create or overwrite arbitrary files,
via a crafted upload request, related to a 'file path injection
vulnerability.'

CVE-2011-1938
Stack-based buffer overflow in the socket_connect function in
ext/sockets/sockets.c in PHP 5.3.3 through 5.3.6 might allow
context-dependent attackers to execute arbitrary code via a long
pathname for a UNIX socket.

CVE-2011-1148
Use-after-free vulnerability in the substr_replace function in PHP
5.3.6 and earlier allows context-dependent attackers to cause a denial
of service (memory corruption) or possibly have unspecified other
impact by using the same variable for multiple arguments.

Solution:
Update your system with the appropriate patches or
software upgrades.
Cross-Ref: BugTraq ID: 49241
Common Vulnerability Exposure (CVE) ID: CVE-2011-2483
http://freshmeat.net/projects/crypt_blowfish
http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html
Debian Security Information: DSA-2340 (Google Search)
http://www.debian.org/security/2011/dsa-2340
Debian Security Information: DSA-2399 (Google Search)
http://www.debian.org/security/2012/dsa-2399
http://www.mandriva.com/security/advisories?name=MDVSA-2011:180
http://www.mandriva.com/security/advisories?name=MDVSA-2011:165
http://www.mandriva.com/security/advisories?name=MDVSA-2011:178
http://www.mandriva.com/security/advisories?name=MDVSA-2011:179
http://www.redhat.com/support/errata/RHSA-2011-1377.html
http://www.redhat.com/support/errata/RHSA-2011-1378.html
http://www.redhat.com/support/errata/RHSA-2011-1423.html
SuSE Security Announcement: SUSE-SA:2011:035 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2011-08/msg00015.html
http://www.ubuntu.com/usn/USN-1229-1
http://www.securityfocus.com/bid/49241
XForce ISS Database: php-cryptblowfish-info-disclosure(69319)
http://xforce.iss.net/xforce/xfdb/69319
Common Vulnerability Exposure (CVE) ID: CVE-2011-2202
http://openwall.com/lists/oss-security/2011/06/12/5
http://openwall.com/lists/oss-security/2011/06/13/15
http://pastebin.com/1edSuSVN
Debian Security Information: DSA-2266 (Google Search)
http://www.debian.org/security/2011/dsa-2266
RedHat Security Advisories: RHSA-2012:0071
http://rhn.redhat.com/errata/RHSA-2012-0071.html
BugTraq ID: 48259
http://www.securityfocus.com/bid/48259
http://securitytracker.com/id?1025659
http://secunia.com/advisories/44874
XForce ISS Database: php-sapiposthandlerfunc-sec-bypass(67999)
http://xforce.iss.net/xforce/xfdb/67999
Common Vulnerability Exposure (CVE) ID: CVE-2011-1938
http://www.exploit-db.com/exploits/17318/
http://openwall.com/lists/oss-security/2011/05/24/1
http://openwall.com/lists/oss-security/2011/05/24/9
http://osvdb.org/72644
http://securityreason.com/securityalert/8262
http://securityreason.com/securityalert/8294
XForce ISS Database: php-socketconnect-bo(67606)
http://xforce.iss.net/xforce/xfdb/67606
Common Vulnerability Exposure (CVE) ID: CVE-2011-1148
http://openwall.com/lists/oss-security/2011/03/13/2
http://openwall.com/lists/oss-security/2011/03/13/3
http://openwall.com/lists/oss-security/2011/03/13/9
BugTraq ID: 46843
http://www.securityfocus.com/bid/46843
XForce ISS Database: php-substrreplace-code-exec(66080)
http://xforce.iss.net/xforce/xfdb/66080
CopyrightCopyright (c) 2011 E-Soft Inc. http://www.securityspace.com

This is only one of 40037 vulnerability tests in our test suite. Find out more about running a complete security audit.

To run a free test of this vulnerability against your system, register below.

New User Registration
Email:
UserID:
Passwd:
Please email me your monthly newsletters, informing the latest services, improvements & surveys.
Please email me a vulnerability test announcement whenever a new test is added.
   Privacy
Registered User Login
 
UserID:   
Passwd:  

 Forgot userid or passwd?
Email/Userid:




Home | About Us | Contact Us | Partner Programs | Developer APIs | Privacy | Mailing Lists | Abuse
Security Audits | Managed DNS | Network Monitoring | Site Analyzer | Internet Research Reports
Web Probe | Whois

© 1998-2014 E-Soft Inc. All rights reserved.