Multiple vulnerabilities in PHP

1) Improper restriction of XML external entity reference (XXE)

EUVDB-ID: #VU9867

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2015-8866

CWE-ID: CWE-611 - Improper Restriction of XML External Entity Reference ('XXE')

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform XXE. attcks.

The vulnerability exists in ext/libxml/libxml.c when using PHP-FPM due to improper isolation of each threat from libxml_disable_entity_loader changes in other threads. A remote attacker can perform XML External Entity (XXE) and XML Entity Expansion (XEE) attacks via a crafted XML document.

Note: this vulnerability is known at least since 2013 and it was patched several times.

Mitigation

Update to version 7.0.27.

Vulnerable software versions

PHP: 5.4.15 - 7.2.0

CPE2.3

• cpe:2.3:a:php_group:php:7.2.0:*:*:*:*:*:*:*

External links

http://www.openwall.com/lists/oss-security/2016/04/24/1
http://git.php.net/?p=php-src.git;a=commit;h=de31324c221c1791b26350ba106cc26bad23ace9
http://www.php.net/ChangeLog-5.php
http://bugs.php.net/bug.php?id=64938

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

2) Denial of service

EUVDB-ID: #VU9868

Risk: Low

CVSSv3.1:

CVE-ID: N/A

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service attack.

The vulnerability exists due to an error in gdImageCreateFromGifCtx() function when processing images with GD library. A remote attacker can create a specially crafted image, pass it to vulnerable application and perform a denial of service (DoS) attack via infinite loop.

Mitigation

Update to version 7.0.27,7.1.13 or 7.2.1.

Vulnerable software versions

PHP: 7.0.0 - 7.2.0

CPE2.3

• cpe:2.3:a:php_group:php:7.2.0:*:*:*:*:*:*:*

External links

http://bugs.php.net/bug.php?id=75571

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

3) Corss-site scrpting

EUVDB-ID: #VU9869

Risk: Low

CVSSv3.1:

CVE-ID: N/A

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform XSS attacks.

The vulnerability exists due to improper input validation in .phar when processing 404 response. A remote attacker can create a specially crafted link, rick tyhe victim into opening it and execute arbitrary HTML and script code in victim's browser in context of vulnerable website.

Mitigation

Update to version 7.0.27,7.1.13 or 7.2.1.

Vulnerable software versions

PHP: 7.0.0 - 7.2.0

CPE2.3

• cpe:2.3:a:php_group:php:7.2.0:*:*:*:*:*:*:*

External links

http://bugs.php.net/bug.php?id=74782

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?