Multiple vulnerabilities in PHP

1) Integer overflow

EUVDB-ID: #VU40095

Risk: High

CVSSv3.1: 7.1 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2016-7133

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

Zend/zend_alloc.c in PHP 7.x before 7.0.10, when open_basedir is enabled, mishandles huge realloc operations, which allows remote attackers to cause a denial of service (integer overflow) or possibly have unspecified other impact via a long pathname.

Mitigation

Install update from vendor's website.

Vulnerable software versions

PHP: 7.0.0 - 7.0.9

External links

http://openwall.com/lists/oss-security/2016/09/02/9
http://www.php.net/ChangeLog-7.php
http://www.securityfocus.com/bid/92765
http://bugs.php.net/bug.php?id=72742
http://github.com/php/php-src/commit/c2a13ced4272f2e65d2773e2ea6ca11c1ce4a911?w=1
http://security.gentoo.org/glsa/201611-22

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) NULL pointer dereference

EUVDB-ID: #VU40096

Risk: Medium

CVSSv3.1: 6.9 [AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:U/RC:C]

CVE-ID: CVE-2016-7132

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error. A remote attacker can trigger denial of service conditions via an invalid wddxPacket XML document that is mishandled in a wddx_deserialize call, as demonstrated by a stray element inside a boolean element, leading to incorrect pop processing.

Mitigation

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

Vulnerable software versions

PHP: 7.0.0 - 7.0.9

External links

http://openwall.com/lists/oss-security/2016/09/02/9
http://rhn.redhat.com/errata/RHSA-2016-2750.html
http://www.php.net/ChangeLog-5.php
http://www.php.net/ChangeLog-7.php
http://www.securityfocus.com/bid/92767
http://www.securitytracker.com/id/1036680
http://bugs.php.net/bug.php?id=72799
http://github.com/php/php-src/commit/a14fdb9746262549bbbb96abb87338bacd147e1b?w=1
http://security.gentoo.org/glsa/201611-22
http://www.tenable.com/security/tns-2016-19

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) NULL pointer dereference

EUVDB-ID: #VU40097

Risk: Medium

CVSSv3.1: 6.9 [AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:U/RC:C]

CVE-ID: CVE-2016-7131

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error. A remote attacker can trigger denial of service conditions via a malformed wddxPacket XML document that is mishandled in a wddx_deserialize call, as demonstrated by a tag that lacks a < (less than) character.

Mitigation

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

Vulnerable software versions

PHP: 7.0.0 - 7.0.9

External links

http://openwall.com/lists/oss-security/2016/09/02/9
http://rhn.redhat.com/errata/RHSA-2016-2750.html
http://www.php.net/ChangeLog-5.php
http://www.php.net/ChangeLog-7.php
http://www.securityfocus.com/bid/92768
http://www.securitytracker.com/id/1036680
http://bugs.php.net/bug.php?id=72790
http://github.com/php/php-src/commit/a14fdb9746262549bbbb96abb87338bacd147e1b?w=1
http://security.gentoo.org/glsa/201611-22
http://www.tenable.com/security/tns-2016-19

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) NULL pointer dereference

EUVDB-ID: #VU40098

Risk: Medium

CVSSv3.1: 6.9 [AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:U/RC:C]

CVE-ID: CVE-2016-7130

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error. A remote attacker can trigger denial of service conditions via an invalid base64 binary value, as demonstrated by a wddx_deserialize call that mishandles a binary element in a wddxPacket XML document.

Mitigation

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

Vulnerable software versions

PHP: 7.0.0 - 7.0.9

External links

http://openwall.com/lists/oss-security/2016/09/02/9
http://rhn.redhat.com/errata/RHSA-2016-2750.html
http://www.php.net/ChangeLog-5.php
http://www.php.net/ChangeLog-7.php
http://www.securityfocus.com/bid/92764
http://www.securitytracker.com/id/1036680
http://bugs.php.net/bug.php?id=72750
http://github.com/php/php-src/commit/698a691724c0a949295991e5df091ce16f899e02?w=1
http://security.gentoo.org/glsa/201611-22
http://www.tenable.com/security/tns-2016-19

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Input validation error

EUVDB-ID: #VU40099

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2016-7129

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The php_wddx_process_data function in ext/wddx/wddx.c in PHP before 5.6.25 and 7.x before 7.0.10 allows remote attackers to cause a denial of service (segmentation fault) or possibly have unspecified other impact via an invalid ISO 8601 time value, as demonstrated by a wddx_deserialize call that mishandles a dateTime element in a wddxPacket XML document.

Mitigation

Install update from vendor's website.

Vulnerable software versions

PHP: 7.0.0 - 7.0.9

External links

http://openwall.com/lists/oss-security/2016/09/02/9
http://rhn.redhat.com/errata/RHSA-2016-2750.html
http://www.php.net/ChangeLog-5.php
http://www.php.net/ChangeLog-7.php
http://www.securityfocus.com/bid/92758
http://www.securitytracker.com/id/1036680
http://bugs.php.net/bug.php?id=72749
http://github.com/php/php-src/commit/426aeb2808955ee3d3f52e0cfb102834cdb836a5?w=1
http://security.gentoo.org/glsa/201611-22
http://www.tenable.com/security/tns-2016-19

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Information disclosure

EUVDB-ID: #VU40100

Risk: Medium

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2016-7128

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The exif_process_IFD_in_TIFF function in ext/exif/exif.c in PHP before 5.6.25 and 7.x before 7.0.10 mishandles the case of a thumbnail offset that exceeds the file size, which allows remote attackers to obtain sensitive information from process memory via a crafted TIFF image.

Mitigation

Install update from vendor's website.

Vulnerable software versions

PHP: 7.0.0 - 7.0.9

External links

http://openwall.com/lists/oss-security/2016/09/02/9
http://rhn.redhat.com/errata/RHSA-2016-2750.html
http://www.php.net/ChangeLog-5.php
http://www.php.net/ChangeLog-7.php
http://www.securityfocus.com/bid/92564
http://www.securitytracker.com/id/1036680
http://bugs.php.net/bug.php?id=72627
http://github.com/php/php-src/commit/6dbb1ee46b5f4725cc6519abf91e512a2a10dfed?w=1
http://security.gentoo.org/glsa/201611-22
http://www.tenable.com/security/tns-2016-19

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Out-of-bounds write

EUVDB-ID: #VU40101

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2016-7127

CWE-ID: CWE-787 - Out-of-bounds write

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The imagegammacorrect function in ext/gd/gd.c in PHP before 5.6.25 and 7.x before 7.0.10 does not properly validate gamma values, which allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact by providing different signs for the second and third arguments.

Mitigation

Install update from vendor's website.

Vulnerable software versions

PHP: 7.0.0 - 7.0.9

External links

http://openwall.com/lists/oss-security/2016/09/02/9
http://rhn.redhat.com/errata/RHSA-2016-2750.html
http://www.php.net/ChangeLog-5.php
http://www.php.net/ChangeLog-7.php
http://www.securityfocus.com/bid/92757
http://www.securitytracker.com/id/1036680
http://bugs.php.net/bug.php?id=72730
http://github.com/php/php-src/commit/1bd103df00f49cf4d4ade2cfe3f456ac058a4eae?w=1
http://security.gentoo.org/glsa/201611-22
http://www.tenable.com/security/tns-2016-19

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Out-of-bounds write

EUVDB-ID: #VU40102

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2016-7126

CWE-ID: CWE-787 - Out-of-bounds write

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The imagetruecolortopalette function in ext/gd/gd.c in PHP before 5.6.25 and 7.x before 7.0.10 does not properly validate the number of colors, which allows remote attackers to cause a denial of service (select_colors allocation error and out-of-bounds write) or possibly have unspecified other impact via a large value in the third argument.

Mitigation

Install update from vendor's website.

Vulnerable software versions

PHP: 7.0.0 - 7.0.9

External links

http://openwall.com/lists/oss-security/2016/09/02/9
http://rhn.redhat.com/errata/RHSA-2016-2750.html
http://www.php.net/ChangeLog-5.php
http://www.php.net/ChangeLog-7.php
http://www.securityfocus.com/bid/92755
http://www.securitytracker.com/id/1036680
http://bugs.php.net/bug.php?id=72697
http://github.com/php/php-src/commit/b6f13a5ef9d6280cf984826a5de012a32c396cd4?w=1
http://security.gentoo.org/glsa/201611-22
http://www.tenable.com/security/tns-2016-19

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Improper Neutralization of Special Elements in Output Used by a Downstream Component

EUVDB-ID: #VU40103

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2016-7125

CWE-ID: CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to manipulate data.

ext/session/session.c in PHP before 5.6.25 and 7.x before 7.0.10 skips invalid session names in a way that triggers incorrect parsing, which allows remote attackers to inject arbitrary-type session data by leveraging control of a session name, as demonstrated by object injection.

Mitigation

Install update from vendor's website.

Vulnerable software versions

PHP: 7.0.0 - 7.0.9

External links

http://openwall.com/lists/oss-security/2016/09/02/9
http://rhn.redhat.com/errata/RHSA-2016-2750.html
http://www.php.net/ChangeLog-5.php
http://www.php.net/ChangeLog-7.php
http://www.securityfocus.com/bid/92552
http://www.securitytracker.com/id/1036680
http://bugs.php.net/bug.php?id=72681
http://github.com/php/php-src/commit/8763c6090d627d8bb0ee1d030c30e58f406be9ce?w=1
http://security.gentoo.org/glsa/201611-22
http://www.tenable.com/security/tns-2016-19

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

Risk	High
Patch available	NO
Number of vulnerabilities	9
CVE-ID	CVE-2016-7133 CVE-2016-7132 CVE-2016-7131 CVE-2016-7130 CVE-2016-7129 CVE-2016-7128 CVE-2016-7127 CVE-2016-7126 CVE-2016-7125
CWE-ID	CWE-190 CWE-476 CWE-20 CWE-200 CWE-787 CWE-74
Exploitation vector	Network
Public exploit	N/A
Vulnerable software Subscribe	PHP Universal components / Libraries / Scripting languages
Vendor	PHP Group