ID de Prueba:	1.3.6.1.4.1.25623.1.0.805650
Categoría:	Web application abuses
Título:	PHP < 5.4.39, 5.5.x < 5.5.23, 5.6.x < 5.6.7 Multiple Vulnerabilities - Windows
Resumen:	PHP is prone to multiple vulnerabilities.
Descripción:	Summary: PHP is prone to multiple vulnerabilities. Vulnerability Insight: The following flaws exist: - 'do_soap_call' function in ext/soap/soap.c script in PHP does not verify that the uri property is a string. - 'SoapClient::__call' method in ext/soap/soap.c script in PHP does not verify that __default_headers is an array. - use-after-free error related to the 'unserialize' function when using DateInterval input. - a flaw in the 'move_uploaded_file' function that is triggered when handling NULL bytes. - an integer overflow condition in the '_zip_cdir_new' function in 'zip_dirent.c' script. Vulnerability Impact: Successfully exploiting these issues allow remote attackers to obtain sensitive information by providing crafted serialized data with an int data type and to execute arbitrary code by providing crafted serialized data with an unexpected data type. Affected Software/OS: PHP prior to version 5.4.39, 5.5.x prior to 5.5.23 and 5.6.x prior to 5.6.7. Solution: Update to version 5.4.39, 5.5.23, 5.6.7 or later. CVSS Score: 7.5 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Referencia Cruzada:	Common Vulnerability Exposure (CVE) ID: CVE-2015-2331 http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html Debian Security Information: DSA-3198 (Google Search) http://www.debian.org/security/2015/dsa-3198 http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154666.html http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155299.html http://lists.fedoraproject.org/pipermail/package-announce/2015-March/153983.html http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154266.html http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154276.html http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155622.html HPdes Security Advisory: HPSBMU03380 http://marc.info/?l=bugtraq&m=143748090628601&w=2 HPdes Security Advisory: HPSBMU03409 http://marc.info/?l=bugtraq&m=144050155601375&w=2 HPdes Security Advisory: HPSBUX03337 http://marc.info/?l=bugtraq&m=143403519711434&w=2 HPdes Security Advisory: SSRT102066 http://www.mandriva.com/security/advisories?name=MDVSA-2015:079 http://www.securitytracker.com/id/1031985 SuSE Security Announcement: openSUSE-SU-2015:0615 (Google Search) http://lists.opensuse.org/opensuse-updates/2015-03/msg00083.html SuSE Security Announcement: openSUSE-SU-2015:0644 (Google Search) http://lists.opensuse.org/opensuse-updates/2015-04/msg00002.html Common Vulnerability Exposure (CVE) ID: CVE-2015-2348 BugTraq ID: 73434 http://www.securityfocus.com/bid/73434 https://security.gentoo.org/glsa/201606-10 RedHat Security Advisories: RHSA-2015:1053 http://rhn.redhat.com/errata/RHSA-2015-1053.html RedHat Security Advisories: RHSA-2015:1066 http://rhn.redhat.com/errata/RHSA-2015-1066.html RedHat Security Advisories: RHSA-2015:1135 http://rhn.redhat.com/errata/RHSA-2015-1135.html http://www.securitytracker.com/id/1032484 SuSE Security Announcement: SUSE-SU-2015:0868 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00005.html SuSE Security Announcement: openSUSE-SU-2015:0684 (Google Search) http://lists.opensuse.org/opensuse-updates/2015-04/msg00015.html http://www.ubuntu.com/usn/USN-2572-1 Common Vulnerability Exposure (CVE) ID: CVE-2015-2787 http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html BugTraq ID: 73431 http://www.securityfocus.com/bid/73431 RedHat Security Advisories: RHSA-2015:1218 http://rhn.redhat.com/errata/RHSA-2015-1218.html http://www.securitytracker.com/id/1032485 Common Vulnerability Exposure (CVE) ID: CVE-2015-4147 BugTraq ID: 73357 http://www.securityfocus.com/bid/73357 http://openwall.com/lists/oss-security/2015/06/01/4 http://www.securitytracker.com/id/1032459 Common Vulnerability Exposure (CVE) ID: CVE-2015-4148 BugTraq ID: 75103 http://www.securityfocus.com/bid/75103 SuSE Security Announcement: openSUSE-SU-2015:1057 (Google Search) http://lists.opensuse.org/opensuse-updates/2015-06/msg00028.html
Copyright	Copyright (C) 2015 Greenbone AG

Esta es sólo una de 146377 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.