Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
nessusUbuntu Security Notice (C) 2017-2023 Canonical, Inc. / NASL script (C) 2017-2023 and is owned by Tenable, Inc. or an Affiliate thereof.UBUNTU_USN-3382-1.NASL
HistoryAug 11, 2017 - 12:00 a.m.

Ubuntu 14.04 LTS / 16.04 LTS : PHP vulnerabilities (USN-3382-1)

2017-08-1100:00:00
Ubuntu Security Notice (C) 2017-2023 Canonical, Inc. / NASL script (C) 2017-2023 and is owned by Tenable, Inc. or an Affiliate thereof.
www.tenable.com
53
JSON

It was discovered that the PHP opcache created keys for files it cached based on their filepath. A local attacker could possibly use this issue in a shared hosting environment to obtain sensitive information. This issue only affected Ubuntu 14.04 LTS.
(CVE-2015-8994)

It was discovered that the PHP URL parser incorrectly handled certain URI components. A remote attacker could possibly use this issue to bypass hostname-specific URL checks. This issue only affected Ubuntu 14.04 LTS. (CVE-2016-10397)

It was discovered that PHP incorrectly handled certain boolean parameters when unserializing data. A remote attacker could possibly use this issue to cause PHP to crash, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS. (CVE-2017-11143)

Sebastian Li, Wei Lei, Xie Xiaofei, and Liu Yang discovered that PHP incorrectly handled the OpenSSL sealing function. A remote attacker could possibly use this issue to cause PHP to crash, resulting in a denial of service. (CVE-2017-11144)

Wei Lei and Liu Yang discovered that the PHP date extension incorrectly handled memory. A remote attacker could possibly use this issue to disclose sensitive information from the server.
(CVE-2017-11145)

It was discovered that PHP incorrectly handled certain PHAR archives.
A remote attacker could use this issue to cause PHP to crash or disclose sensitive information. This issue only affected Ubuntu 14.04 LTS. (CVE-2017-11147)

It was discovered that PHP incorrectly handled locale length. A remote attacker could possibly use this issue to cause PHP to crash, resulting in a denial of service. (CVE-2017-11362)

Wei Lei and Liu Yang discovered that PHP incorrectly handled parsing ini files. An attacker could possibly use this issue to cause PHP to crash, resulting in a denial of service. (CVE-2017-11628)

It was discovered that PHP mbstring incorrectly handled certain regular expressions. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2017-9224, CVE-2017-9226, CVE-2017-9227, CVE-2017-9228, CVE-2017-9229).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Ubuntu Security Notice USN-3382-1. The text 
# itself is copyright (C) Canonical, Inc. See 
# <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered 
# trademark of Canonical, Inc.
#

include('compat.inc');

if (description)
{
  script_id(102416);
  script_version("3.9");
  script_set_attribute(attribute:"plugin_modification_date", value:"2023/10/20");

  script_cve_id(
    "CVE-2015-8994",
    "CVE-2016-10397",
    "CVE-2017-11143",
    "CVE-2017-11144",
    "CVE-2017-11145",
    "CVE-2017-11147",
    "CVE-2017-11362",
    "CVE-2017-11628",
    "CVE-2017-9224",
    "CVE-2017-9226",
    "CVE-2017-9227",
    "CVE-2017-9228",
    "CVE-2017-9229"
  );
  script_xref(name:"USN", value:"3382-1");

  script_name(english:"Ubuntu 14.04 LTS / 16.04 LTS : PHP vulnerabilities (USN-3382-1)");

  script_set_attribute(attribute:"synopsis", value:
"The remote Ubuntu host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"It was discovered that the PHP opcache created keys for files it
cached based on their filepath. A local attacker could possibly use
this issue in a shared hosting environment to obtain sensitive
information. This issue only affected Ubuntu 14.04 LTS.
(CVE-2015-8994)

It was discovered that the PHP URL parser incorrectly handled certain
URI components. A remote attacker could possibly use this issue to
bypass hostname-specific URL checks. This issue only affected Ubuntu
14.04 LTS. (CVE-2016-10397)

It was discovered that PHP incorrectly handled certain boolean
parameters when unserializing data. A remote attacker could possibly
use this issue to cause PHP to crash, resulting in a denial of
service. This issue only affected Ubuntu 14.04 LTS. (CVE-2017-11143)

Sebastian Li, Wei Lei, Xie Xiaofei, and Liu Yang discovered that PHP
incorrectly handled the OpenSSL sealing function. A remote attacker
could possibly use this issue to cause PHP to crash, resulting in a
denial of service. (CVE-2017-11144)

Wei Lei and Liu Yang discovered that the PHP date extension
incorrectly handled memory. A remote attacker could possibly use this
issue to disclose sensitive information from the server.
(CVE-2017-11145)

It was discovered that PHP incorrectly handled certain PHAR archives.
A remote attacker could use this issue to cause PHP to crash or
disclose sensitive information. This issue only affected Ubuntu 14.04
LTS. (CVE-2017-11147)

It was discovered that PHP incorrectly handled locale length. A remote
attacker could possibly use this issue to cause PHP to crash,
resulting in a denial of service. (CVE-2017-11362)

Wei Lei and Liu Yang discovered that PHP incorrectly handled parsing
ini files. An attacker could possibly use this issue to cause PHP to
crash, resulting in a denial of service. (CVE-2017-11628)

It was discovered that PHP mbstring incorrectly handled certain
regular expressions. A remote attacker could use this issue to cause
PHP to crash, resulting in a denial of service, or possibly execute
arbitrary code. (CVE-2017-9224, CVE-2017-9226, CVE-2017-9227,
CVE-2017-9228, CVE-2017-9229).

Note that Tenable Network Security has extracted the preceding
description block directly from the Ubuntu security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues.");
  script_set_attribute(attribute:"see_also", value:"https://ubuntu.com/security/notices/USN-3382-1");
  script_set_attribute(attribute:"solution", value:
"Update the affected packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2017-9228");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2017/03/02");
  script_set_attribute(attribute:"patch_publication_date", value:"2017/08/10");
  script_set_attribute(attribute:"plugin_publication_date", value:"2017/08/11");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:libapache2-mod-php5");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:libapache2-mod-php5filter");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:libapache2-mod-php7.0");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:libphp5-embed");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:libphp7.0-embed");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:php-pear");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:php5");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:php5-cgi");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:php5-cli");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:php5-common");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:php5-curl");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:php5-dev");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:php5-enchant");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:php5-fpm");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:php5-gd");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:php5-gmp");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:php5-intl");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:php5-ldap");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:php5-mysql");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:php5-mysqlnd");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:php5-odbc");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:php5-pgsql");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:php5-pspell");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:php5-readline");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:php5-recode");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:php5-snmp");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:php5-sqlite");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:php5-sybase");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:php5-tidy");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:php5-xmlrpc");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:php5-xsl");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:php7.0");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:php7.0-bcmath");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:php7.0-bz2");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:php7.0-cgi");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:php7.0-cli");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:php7.0-common");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:php7.0-curl");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:php7.0-dba");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:php7.0-dev");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:php7.0-enchant");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:php7.0-fpm");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:php7.0-gd");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:php7.0-gmp");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:php7.0-imap");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:php7.0-interbase");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:php7.0-intl");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:php7.0-json");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:php7.0-ldap");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:php7.0-mbstring");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:php7.0-mcrypt");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:php7.0-mysql");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:php7.0-odbc");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:php7.0-opcache");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:php7.0-pgsql");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:php7.0-phpdbg");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:php7.0-pspell");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:php7.0-readline");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:php7.0-recode");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:php7.0-snmp");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:php7.0-soap");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:php7.0-sqlite3");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:php7.0-sybase");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:php7.0-tidy");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:php7.0-xml");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:php7.0-xmlrpc");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:php7.0-xsl");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:php7.0-zip");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:14.04:-:lts");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:16.04:-:lts");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Ubuntu Local Security Checks");

  script_copyright(english:"Ubuntu Security Notice (C) 2017-2023 Canonical, Inc. / NASL script (C) 2017-2023 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/cpu", "Host/Ubuntu", "Host/Ubuntu/release", "Host/Debian/dpkg-l");

  exit(0);
}

include('debian_package.inc');

if ( ! get_kb_item('Host/local_checks_enabled') ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_release = get_kb_item('Host/Ubuntu/release');
if ( isnull(os_release) ) audit(AUDIT_OS_NOT, 'Ubuntu');
os_release = chomp(os_release);
if (! ('14.04' >< os_release || '16.04' >< os_release)) audit(AUDIT_OS_NOT, 'Ubuntu 14.04 / 16.04', 'Ubuntu ' + os_release);
if ( ! get_kb_item('Host/Debian/dpkg-l') ) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Ubuntu', cpu);

var pkgs = [
    {'osver': '14.04', 'pkgname': 'libapache2-mod-php5', 'pkgver': '5.5.9+dfsg-1ubuntu4.22'},
    {'osver': '14.04', 'pkgname': 'libapache2-mod-php5filter', 'pkgver': '5.5.9+dfsg-1ubuntu4.22'},
    {'osver': '14.04', 'pkgname': 'libphp5-embed', 'pkgver': '5.5.9+dfsg-1ubuntu4.22'},
    {'osver': '14.04', 'pkgname': 'php-pear', 'pkgver': '5.5.9+dfsg-1ubuntu4.22'},
    {'osver': '14.04', 'pkgname': 'php5', 'pkgver': '5.5.9+dfsg-1ubuntu4.22'},
    {'osver': '14.04', 'pkgname': 'php5-cgi', 'pkgver': '5.5.9+dfsg-1ubuntu4.22'},
    {'osver': '14.04', 'pkgname': 'php5-cli', 'pkgver': '5.5.9+dfsg-1ubuntu4.22'},
    {'osver': '14.04', 'pkgname': 'php5-common', 'pkgver': '5.5.9+dfsg-1ubuntu4.22'},
    {'osver': '14.04', 'pkgname': 'php5-curl', 'pkgver': '5.5.9+dfsg-1ubuntu4.22'},
    {'osver': '14.04', 'pkgname': 'php5-dev', 'pkgver': '5.5.9+dfsg-1ubuntu4.22'},
    {'osver': '14.04', 'pkgname': 'php5-enchant', 'pkgver': '5.5.9+dfsg-1ubuntu4.22'},
    {'osver': '14.04', 'pkgname': 'php5-fpm', 'pkgver': '5.5.9+dfsg-1ubuntu4.22'},
    {'osver': '14.04', 'pkgname': 'php5-gd', 'pkgver': '5.5.9+dfsg-1ubuntu4.22'},
    {'osver': '14.04', 'pkgname': 'php5-gmp', 'pkgver': '5.5.9+dfsg-1ubuntu4.22'},
    {'osver': '14.04', 'pkgname': 'php5-intl', 'pkgver': '5.5.9+dfsg-1ubuntu4.22'},
    {'osver': '14.04', 'pkgname': 'php5-ldap', 'pkgver': '5.5.9+dfsg-1ubuntu4.22'},
    {'osver': '14.04', 'pkgname': 'php5-mysql', 'pkgver': '5.5.9+dfsg-1ubuntu4.22'},
    {'osver': '14.04', 'pkgname': 'php5-mysqlnd', 'pkgver': '5.5.9+dfsg-1ubuntu4.22'},
    {'osver': '14.04', 'pkgname': 'php5-odbc', 'pkgver': '5.5.9+dfsg-1ubuntu4.22'},
    {'osver': '14.04', 'pkgname': 'php5-pgsql', 'pkgver': '5.5.9+dfsg-1ubuntu4.22'},
    {'osver': '14.04', 'pkgname': 'php5-pspell', 'pkgver': '5.5.9+dfsg-1ubuntu4.22'},
    {'osver': '14.04', 'pkgname': 'php5-readline', 'pkgver': '5.5.9+dfsg-1ubuntu4.22'},
    {'osver': '14.04', 'pkgname': 'php5-recode', 'pkgver': '5.5.9+dfsg-1ubuntu4.22'},
    {'osver': '14.04', 'pkgname': 'php5-snmp', 'pkgver': '5.5.9+dfsg-1ubuntu4.22'},
    {'osver': '14.04', 'pkgname': 'php5-sqlite', 'pkgver': '5.5.9+dfsg-1ubuntu4.22'},
    {'osver': '14.04', 'pkgname': 'php5-sybase', 'pkgver': '5.5.9+dfsg-1ubuntu4.22'},
    {'osver': '14.04', 'pkgname': 'php5-tidy', 'pkgver': '5.5.9+dfsg-1ubuntu4.22'},
    {'osver': '14.04', 'pkgname': 'php5-xmlrpc', 'pkgver': '5.5.9+dfsg-1ubuntu4.22'},
    {'osver': '14.04', 'pkgname': 'php5-xsl', 'pkgver': '5.5.9+dfsg-1ubuntu4.22'},
    {'osver': '16.04', 'pkgname': 'libapache2-mod-php7.0', 'pkgver': '7.0.22-0ubuntu0.16.04.1'},
    {'osver': '16.04', 'pkgname': 'libphp7.0-embed', 'pkgver': '7.0.22-0ubuntu0.16.04.1'},
    {'osver': '16.04', 'pkgname': 'php7.0', 'pkgver': '7.0.22-0ubuntu0.16.04.1'},
    {'osver': '16.04', 'pkgname': 'php7.0-bcmath', 'pkgver': '7.0.22-0ubuntu0.16.04.1'},
    {'osver': '16.04', 'pkgname': 'php7.0-bz2', 'pkgver': '7.0.22-0ubuntu0.16.04.1'},
    {'osver': '16.04', 'pkgname': 'php7.0-cgi', 'pkgver': '7.0.22-0ubuntu0.16.04.1'},
    {'osver': '16.04', 'pkgname': 'php7.0-cli', 'pkgver': '7.0.22-0ubuntu0.16.04.1'},
    {'osver': '16.04', 'pkgname': 'php7.0-common', 'pkgver': '7.0.22-0ubuntu0.16.04.1'},
    {'osver': '16.04', 'pkgname': 'php7.0-curl', 'pkgver': '7.0.22-0ubuntu0.16.04.1'},
    {'osver': '16.04', 'pkgname': 'php7.0-dba', 'pkgver': '7.0.22-0ubuntu0.16.04.1'},
    {'osver': '16.04', 'pkgname': 'php7.0-dev', 'pkgver': '7.0.22-0ubuntu0.16.04.1'},
    {'osver': '16.04', 'pkgname': 'php7.0-enchant', 'pkgver': '7.0.22-0ubuntu0.16.04.1'},
    {'osver': '16.04', 'pkgname': 'php7.0-fpm', 'pkgver': '7.0.22-0ubuntu0.16.04.1'},
    {'osver': '16.04', 'pkgname': 'php7.0-gd', 'pkgver': '7.0.22-0ubuntu0.16.04.1'},
    {'osver': '16.04', 'pkgname': 'php7.0-gmp', 'pkgver': '7.0.22-0ubuntu0.16.04.1'},
    {'osver': '16.04', 'pkgname': 'php7.0-imap', 'pkgver': '7.0.22-0ubuntu0.16.04.1'},
    {'osver': '16.04', 'pkgname': 'php7.0-interbase', 'pkgver': '7.0.22-0ubuntu0.16.04.1'},
    {'osver': '16.04', 'pkgname': 'php7.0-intl', 'pkgver': '7.0.22-0ubuntu0.16.04.1'},
    {'osver': '16.04', 'pkgname': 'php7.0-json', 'pkgver': '7.0.22-0ubuntu0.16.04.1'},
    {'osver': '16.04', 'pkgname': 'php7.0-ldap', 'pkgver': '7.0.22-0ubuntu0.16.04.1'},
    {'osver': '16.04', 'pkgname': 'php7.0-mbstring', 'pkgver': '7.0.22-0ubuntu0.16.04.1'},
    {'osver': '16.04', 'pkgname': 'php7.0-mcrypt', 'pkgver': '7.0.22-0ubuntu0.16.04.1'},
    {'osver': '16.04', 'pkgname': 'php7.0-mysql', 'pkgver': '7.0.22-0ubuntu0.16.04.1'},
    {'osver': '16.04', 'pkgname': 'php7.0-odbc', 'pkgver': '7.0.22-0ubuntu0.16.04.1'},
    {'osver': '16.04', 'pkgname': 'php7.0-opcache', 'pkgver': '7.0.22-0ubuntu0.16.04.1'},
    {'osver': '16.04', 'pkgname': 'php7.0-pgsql', 'pkgver': '7.0.22-0ubuntu0.16.04.1'},
    {'osver': '16.04', 'pkgname': 'php7.0-phpdbg', 'pkgver': '7.0.22-0ubuntu0.16.04.1'},
    {'osver': '16.04', 'pkgname': 'php7.0-pspell', 'pkgver': '7.0.22-0ubuntu0.16.04.1'},
    {'osver': '16.04', 'pkgname': 'php7.0-readline', 'pkgver': '7.0.22-0ubuntu0.16.04.1'},
    {'osver': '16.04', 'pkgname': 'php7.0-recode', 'pkgver': '7.0.22-0ubuntu0.16.04.1'},
    {'osver': '16.04', 'pkgname': 'php7.0-snmp', 'pkgver': '7.0.22-0ubuntu0.16.04.1'},
    {'osver': '16.04', 'pkgname': 'php7.0-soap', 'pkgver': '7.0.22-0ubuntu0.16.04.1'},
    {'osver': '16.04', 'pkgname': 'php7.0-sqlite3', 'pkgver': '7.0.22-0ubuntu0.16.04.1'},
    {'osver': '16.04', 'pkgname': 'php7.0-sybase', 'pkgver': '7.0.22-0ubuntu0.16.04.1'},
    {'osver': '16.04', 'pkgname': 'php7.0-tidy', 'pkgver': '7.0.22-0ubuntu0.16.04.1'},
    {'osver': '16.04', 'pkgname': 'php7.0-xml', 'pkgver': '7.0.22-0ubuntu0.16.04.1'},
    {'osver': '16.04', 'pkgname': 'php7.0-xmlrpc', 'pkgver': '7.0.22-0ubuntu0.16.04.1'},
    {'osver': '16.04', 'pkgname': 'php7.0-xsl', 'pkgver': '7.0.22-0ubuntu0.16.04.1'},
    {'osver': '16.04', 'pkgname': 'php7.0-zip', 'pkgver': '7.0.22-0ubuntu0.16.04.1'}
];

var flag = 0;
foreach package_array ( pkgs ) {
  var osver = NULL;
  var pkgname = NULL;
  var pkgver = NULL;
  if (!empty_or_null(package_array['osver'])) osver = package_array['osver'];
  if (!empty_or_null(package_array['pkgname'])) pkgname = package_array['pkgname'];
  if (!empty_or_null(package_array['pkgver'])) pkgver = package_array['pkgver'];
  if (osver && pkgname && pkgver) {
    if (ubuntu_check(osver:osver, pkgname:pkgname, pkgver:pkgver)) flag++;
  }
}

if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_HOLE,
    extra      : ubuntu_report_get()
  );
  exit(0);
}
else
{
  var tested = ubuntu_pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'libapache2-mod-php5 / libapache2-mod-php5filter / etc');
}
VendorProductVersionCPE
canonicalubuntu_linuxlibapache2-mod-php5p-cpe:/a:canonical:ubuntu_linux:libapache2-mod-php5
canonicalubuntu_linuxlibapache2-mod-php5filterp-cpe:/a:canonical:ubuntu_linux:libapache2-mod-php5filter
canonicalubuntu_linuxlibapache2-mod-php7.0p-cpe:/a:canonical:ubuntu_linux:libapache2-mod-php7.0
canonicalubuntu_linuxlibphp5-embedp-cpe:/a:canonical:ubuntu_linux:libphp5-embed
canonicalubuntu_linuxlibphp7.0-embedp-cpe:/a:canonical:ubuntu_linux:libphp7.0-embed
canonicalubuntu_linuxphp-pearp-cpe:/a:canonical:ubuntu_linux:php-pear
canonicalubuntu_linuxphp5p-cpe:/a:canonical:ubuntu_linux:php5
canonicalubuntu_linuxphp5-cgip-cpe:/a:canonical:ubuntu_linux:php5-cgi
canonicalubuntu_linuxphp5-clip-cpe:/a:canonical:ubuntu_linux:php5-cli
canonicalubuntu_linuxphp5-commonp-cpe:/a:canonical:ubuntu_linux:php5-common
Rows per page:
1-10 of 701

Related

ubuntu 2
openvas 35
debian 5
osv 13
nessus 52
slackware 1
fedora 7
hackerone 4
amazon 5
f5 3
mageia 1
freebsd 1
altlinux 1
ibm 6
suse 2
gentoo 1
veracode 9
redhat 1
debiancve 9
redhatcve 8
ubuntucve 9
prion 12
cve 8
alpinelinux 3
checkpoint_advisories 1
ubuntu
ubuntu
PHP vulnerabilities
2017-08-10 00:00:00
PHP vulnerabilities
2017-12-18 00:00:00
openvas
openvas
Ubuntu: Security Advisory (USN-3382-1)
2017-08-11 00:00:00
Ubuntu: Security Advisory (USN-3382-2)
2022-08-26 00:00:00
Debian: Security Advisory (DLA-1034-1)
2018-02-07 00:00:00
debian
debian
[SECURITY] [DLA 1034-1] php5 security update
2017-07-21 11:45:57
[SECURITY] [DLA 958-1] libonig security update
2017-05-28 13:46:37
[SECURITY] [DSA 4081-1] php5 security update
2018-01-08 22:33:54
osv
osv
php5 - security update
2017-07-21 00:00:00
libonig - security update
2017-05-28 00:00:00
php5 - security update
2018-01-08 00:00:00
nessus
nessus
Debian DLA-1034-1 : php5 security update
2017-07-24 00:00:00
Amazon Linux AMI : php56 (ALAS-2017-871)
2017-08-18 00:00:00
Fedora 26 : php (2017-b8bb4b86e2)
2017-07-19 00:00:00
slackware
slackware
[slackware-security] php
2017-07-08 00:39:45
fedora
fedora
[SECURITY] Fedora 24 Update: php-5.6.31-1.fc24
2017-07-19 01:49:32
[SECURITY] Fedora 25 Update: php-7.0.21-1.fc25
2017-07-13 19:20:35
[SECURITY] Fedora 26 Update: php-7.1.7-1.fc26
2017-07-18 22:25:50
hackerone
hackerone
Internet Bug Bounty: PHP mbstring / Oniguruma multiple remote heap/stack corruptions
2017-06-08 06:55:30
Internet Bug Bounty: PHP WDDX Deserialization Heap OOB Read in timelib_meridian()
2017-07-12 10:27:57
Internet Bug Bounty: PHP INI Parsing Stack Buffer Overflow Vulnerability
2017-07-12 09:21:09
amazon
amazon
Medium: php56
2017-08-17 18:16:00
Important: oniguruma
2023-10-12 15:09:00
Medium: php70
2017-08-03 20:38:00
f5
f5
K20289222 : Multiple PHP vulnerabilities
2017-08-08 00:00:00
K75543432 : PHP vulnerability CVE-2017-11628
2017-11-06 00:00:00
K06844177 : PHP vulnerability CVE-2017-9229
2017-07-21 00:00:00
mageia
mageia
Updated php and libgd packages fix security vulnerabilities
2017-08-08 01:16:24
freebsd
freebsd
oniguruma -- multiple vulnerabilities
2017-07-06 00:00:00
altlinux
altlinux
Security fix for the ALT Linux 8 package oniguruma version 6.4.0-alt1
2017-07-12 00:00:00
ibm
ibm
Security Bulletin: Multiple vulnerabilities in php5 affect IBM Flex System Manager (FSM) (CVE-2017-9227, CVE-2017-9226 CVE-2017-9224)
2018-06-18 01:38:12
Security Bulletin: Vulnerabilities in php53 affect IBM BladeCenter Advanced Management Module (AMM) (CVE-2017-9227, CVE-2017-9226, CVE-2017-9224)
2023-04-14 14:32:25
Security Bulletin: Vulnerabilities in PHP affect IBM Chassis Management Module (CVE-2017-9227, CVE-2017-9226, CVE-2017-9224)
2019-01-31 02:25:02
suse
suse
Security update for php7 (important)
2017-09-04 12:07:53
Security update for php7 (important)
2017-08-30 19:30:52
gentoo
gentoo
PHP: Multiple vulnerabilities
2017-09-24 00:00:00
veracode
veracode
Use After Free
2019-05-16 02:59:58
Denial Of Service (DoS)
2019-05-16 02:59:59
Information Disclosure
2019-05-16 02:59:59
redhat
redhat
(RHSA-2018:1296) Moderate: rh-php70-php security, bug fix, and enhancement update
2018-05-03 03:21:11
debiancve
debiancve
CVE-2015-8994
2017-03-02 06:59:00
CVE-2016-10397
2017-07-10 14:29:00
CVE-2017-11147
2017-07-10 14:29:00
redhatcve
redhatcve
CVE-2016-10397
2017-07-17 13:48:32
CVE-2017-11144
2017-07-17 14:20:20
CVE-2017-11628
2019-11-02 22:24:08
ubuntucve
ubuntucve
CVE-2016-10397
2017-07-10 00:00:00
CVE-2015-8994
2017-03-02 00:00:00
CVE-2017-11144
2017-07-10 00:00:00
prion
prion
Design/Logic Flaw
2017-03-02 06:59:00
Code injection
2017-07-10 14:29:00
Stack overflow
2017-07-25 23:29:00
cve
cve
CVE-2015-8994
2017-03-02 06:59:00
CVE-2016-10397
2017-07-10 14:29:00
CVE-2017-11628
2017-07-25 23:29:00
alpinelinux
alpinelinux
CVE-2017-9229
2017-05-24 15:29:00
CVE-2017-9224
2017-05-24 15:29:00
CVE-2017-9228
2017-05-24 15:29:00
checkpoint_advisories
checkpoint_advisories
Oniguruma Project Memory Corruption (CVE-2017-9226)
2020-09-24 00:00:00
JSON
Related for UBUNTU_USN-3382-1.NASL
ubuntu2openvas35debian5osv13nessus52slackware1fedora7hackerone4amazon5f53mageia1freebsd1altlinux1ibm6suse2gentoo1veracode9redhat1debiancve9redhatcve8ubuntucve9prion12cve8alpinelinux3checkpoint_advisories1