Test ID:	1.3.6.1.4.1.25623.1.0.805651
Category:	Web application abuses
Title:	PHP Multiple Vulnerabilities - 01 (Jun 2015) - Linux
Summary:	PHP is prone to multiple vulnerabilities.
Description:	Summary: PHP is prone to multiple vulnerabilities. Vulnerability Insight: Multiple flaws are due to: - 'do_soap_call' function in ext/soap/soap.c script in PHP does not verify that the uri property is a string. - 'SoapClient::__call' method in ext/soap/soap.c script in PHP does not verify that __default_headers is an array. - use-after-free error related to the 'unserialize' function when using DateInterval input. - a flaw in the 'move_uploaded_file' function that is triggered when handling NULL bytes. - an integer overflow condition in the '_zip_cdir_new' function in 'zip_dirent.c' script. Vulnerability Impact: Successfully exploiting this issue allow remote attackers to obtain sensitive information by providing crafted serialized data with an int data type and to execute arbitrary code by providing crafted serialized data with an unexpected data type. Affected Software/OS: PHP versions before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 Solution: Update to PHP 5.4.39 or 5.5.23 or 5.6.7 or later. CVSS Score: 7.5 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2015-4148 http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html BugTraq ID: 75103 http://www.securityfocus.com/bid/75103 https://security.gentoo.org/glsa/201606-10 http://openwall.com/lists/oss-security/2015/06/01/4 RedHat Security Advisories: RHSA-2015:1053 http://rhn.redhat.com/errata/RHSA-2015-1053.html RedHat Security Advisories: RHSA-2015:1066 http://rhn.redhat.com/errata/RHSA-2015-1066.html RedHat Security Advisories: RHSA-2015:1135 http://rhn.redhat.com/errata/RHSA-2015-1135.html RedHat Security Advisories: RHSA-2015:1218 http://rhn.redhat.com/errata/RHSA-2015-1218.html http://www.securitytracker.com/id/1032459 SuSE Security Announcement: openSUSE-SU-2015:1057 (Google Search) http://lists.opensuse.org/opensuse-updates/2015-06/msg00028.html Common Vulnerability Exposure (CVE) ID: CVE-2015-4147 BugTraq ID: 73357 http://www.securityfocus.com/bid/73357 SuSE Security Announcement: SUSE-SU-2015:0868 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00005.html Common Vulnerability Exposure (CVE) ID: CVE-2015-2787 http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html BugTraq ID: 73431 http://www.securityfocus.com/bid/73431 HPdes Security Advisory: HPSBMU03380 http://marc.info/?l=bugtraq&m=143748090628601&w=2 HPdes Security Advisory: HPSBMU03409 http://marc.info/?l=bugtraq&m=144050155601375&w=2 http://www.securitytracker.com/id/1032485 SuSE Security Announcement: openSUSE-SU-2015:0684 (Google Search) http://lists.opensuse.org/opensuse-updates/2015-04/msg00015.html http://www.ubuntu.com/usn/USN-2572-1 Common Vulnerability Exposure (CVE) ID: CVE-2015-2348 BugTraq ID: 73434 http://www.securityfocus.com/bid/73434 http://www.securitytracker.com/id/1032484 Common Vulnerability Exposure (CVE) ID: CVE-2015-2331 Debian Security Information: DSA-3198 (Google Search) http://www.debian.org/security/2015/dsa-3198 http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154666.html http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155299.html http://lists.fedoraproject.org/pipermail/package-announce/2015-March/153983.html http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154266.html http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154276.html http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155622.html HPdes Security Advisory: HPSBUX03337 http://marc.info/?l=bugtraq&m=143403519711434&w=2 HPdes Security Advisory: SSRT102066 http://www.mandriva.com/security/advisories?name=MDVSA-2015:079 http://www.securitytracker.com/id/1031985 SuSE Security Announcement: openSUSE-SU-2015:0615 (Google Search) http://lists.opensuse.org/opensuse-updates/2015-03/msg00083.html SuSE Security Announcement: openSUSE-SU-2015:0644 (Google Search) http://lists.opensuse.org/opensuse-updates/2015-04/msg00002.html
Copyright	Copyright (C) 2015 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.