Test ID:	1.3.6.1.4.1.25623.1.0.842904
Category:	Ubuntu Local Security Checks
Title:	Ubuntu: Security Advisory (USN-3095-1)
Summary:	The remote host is missing an update for the 'php5, php7.0' package(s) announced via the USN-3095-1 advisory.
Description:	Summary: The remote host is missing an update for the 'php5, php7.0' package(s) announced via the USN-3095-1 advisory. Vulnerability Insight: Taoguang Chen discovered that PHP incorrectly handled certain invalid objects when unserializing data. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2016-7124) Taoguang Chen discovered that PHP incorrectly handled invalid session names. A remote attacker could use this issue to inject arbitrary session data. (CVE-2016-7125) It was discovered that PHP incorrectly handled certain gamma values in the imagegammacorrect function. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2016-7127) It was discovered that PHP incorrectly handled certain crafted TIFF image thumbnails. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly expose sensitive information. (CVE-2016-7128) It was discovered that PHP incorrectly handled unserializing certain wddxPacket XML documents. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2016-7129, CVE-2016-7130, CVE-2016-7131, CVE-2016-7132, CVE-2016-7413) It was discovered that PHP incorrectly handled certain memory operations. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 16.04 LTS. (CVE-2016-7133) It was discovered that PHP incorrectly handled long strings in curl_escape calls. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 16.04 LTS. (CVE-2016-7134) Taoguang Chen discovered that PHP incorrectly handled certain failures when unserializing data. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2016-7411) It was discovered that PHP incorrectly handled certain flags in the MySQL driver. Malicious remote MySQL servers could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2016-7412) It was discovered that PHP incorrectly handled ZIP file signature verification when processing a PHAR archive. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2016-7414) It was discovered that PHP incorrectly handled certain locale operations. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2016-7416) It was discovered that PHP incorrectly handled SplArray unserializing. A remote attacker could use this issue to cause PHP to ... [Please see the references for more information on the vulnerabilities] Affected Software/OS: 'php5, php7.0' package(s) on Ubuntu 12.04, Ubuntu 14.04, Ubuntu 16.04. Solution: Please install the updated package(s). CVSS Score: 7.5 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2016-7124 BugTraq ID: 92756 http://www.securityfocus.com/bid/92756 https://security.gentoo.org/glsa/201611-22 http://openwall.com/lists/oss-security/2016/09/02/9 RedHat Security Advisories: RHSA-2016:2750 http://rhn.redhat.com/errata/RHSA-2016-2750.html http://www.securitytracker.com/id/1036680 Common Vulnerability Exposure (CVE) ID: CVE-2016-7125 BugTraq ID: 92552 http://www.securityfocus.com/bid/92552 Common Vulnerability Exposure (CVE) ID: CVE-2016-7127 BugTraq ID: 92757 http://www.securityfocus.com/bid/92757 Common Vulnerability Exposure (CVE) ID: CVE-2016-7128 BugTraq ID: 92564 http://www.securityfocus.com/bid/92564 Common Vulnerability Exposure (CVE) ID: CVE-2016-7129 BugTraq ID: 92758 http://www.securityfocus.com/bid/92758 Common Vulnerability Exposure (CVE) ID: CVE-2016-7130 BugTraq ID: 92764 http://www.securityfocus.com/bid/92764 Common Vulnerability Exposure (CVE) ID: CVE-2016-7131 BugTraq ID: 92768 http://www.securityfocus.com/bid/92768 Common Vulnerability Exposure (CVE) ID: CVE-2016-7132 BugTraq ID: 92767 http://www.securityfocus.com/bid/92767 Common Vulnerability Exposure (CVE) ID: CVE-2016-7133 BugTraq ID: 92765 http://www.securityfocus.com/bid/92765 Common Vulnerability Exposure (CVE) ID: CVE-2016-7134 BugTraq ID: 92766 http://www.securityfocus.com/bid/92766 Common Vulnerability Exposure (CVE) ID: CVE-2016-7411 BugTraq ID: 93009 http://www.securityfocus.com/bid/93009 http://www.openwall.com/lists/oss-security/2016/09/15/10 http://www.securitytracker.com/id/1036836 Common Vulnerability Exposure (CVE) ID: CVE-2016-7412 BugTraq ID: 93005 http://www.securityfocus.com/bid/93005 RedHat Security Advisories: RHSA-2018:1296 https://access.redhat.com/errata/RHSA-2018:1296 Common Vulnerability Exposure (CVE) ID: CVE-2016-7413 BugTraq ID: 93006 http://www.securityfocus.com/bid/93006 Common Vulnerability Exposure (CVE) ID: CVE-2016-7414 BugTraq ID: 93004 http://www.securityfocus.com/bid/93004 Common Vulnerability Exposure (CVE) ID: CVE-2016-7416 BugTraq ID: 93008 http://www.securityfocus.com/bid/93008 Common Vulnerability Exposure (CVE) ID: CVE-2016-7417 BugTraq ID: 93007 http://www.securityfocus.com/bid/93007 Common Vulnerability Exposure (CVE) ID: CVE-2016-7418 BugTraq ID: 93011 http://www.securityfocus.com/bid/93011
Copyright	Copyright (C) 2016 Greenbone AG

This is only one of 146377 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.