VAR-201605-0133

Vulnerability from variot - Updated: 2026-03-09 20:47

The file_check_mem function in funcs.c in file before 5.23, as used in the Fileinfo component in PHP before 5.5.34, 5.6.x before 5.6.20, and 7.x before 7.0.5, mishandles continuation-level jumps, which allows context-dependent attackers to cause a denial of service (buffer overflow and application crash) or possibly execute arbitrary code via a crafted magic file. PHP is prone to a denial-of-service vulnerability. Successful exploits may allow the attacker to crash the affected application resulting in denial-of-service condition. PHP (PHP: Hypertext Preprocessor, PHP: Hypertext Preprocessor) is an open source general-purpose computer scripting language jointly maintained by the PHP Group and the open source community; Fileinfo is one of them used to display file attributes and support batch modification of its Components of properties. The vulnerability stems from the fact that the program does not correctly handle continuation-level jumps. The following versions are affected: PHP prior to 5.5.34, 5.6.x prior to 5.6.20, 7.x prior to 7.0.5, and prior to file 5.23. This update provides the corresponding update for Ubuntu 12.04 ESM. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1

===================================================================== Red Hat Security Advisory

Synopsis: Moderate: rh-php56 security, bug fix, and enhancement update Advisory ID: RHSA-2016:2750-01 Product: Red Hat Software Collections Advisory URL: https://rhn.redhat.com/errata/RHSA-2016-2750.html Issue date: 2016-11-15 CVE Names: CVE-2013-7456 CVE-2014-9767 CVE-2015-2325 CVE-2015-2326 CVE-2015-2327 CVE-2015-2328 CVE-2015-3210 CVE-2015-3217 CVE-2015-5073 CVE-2015-8381 CVE-2015-8383 CVE-2015-8384 CVE-2015-8385 CVE-2015-8386 CVE-2015-8388 CVE-2015-8391 CVE-2015-8392 CVE-2015-8395 CVE-2015-8835 CVE-2015-8865 CVE-2015-8866 CVE-2015-8867 CVE-2015-8873 CVE-2015-8874 CVE-2015-8876 CVE-2015-8877 CVE-2015-8879 CVE-2016-1903 CVE-2016-2554 CVE-2016-3074 CVE-2016-3141 CVE-2016-3142 CVE-2016-4070 CVE-2016-4071 CVE-2016-4072 CVE-2016-4073 CVE-2016-4342 CVE-2016-4343 CVE-2016-4473 CVE-2016-4537 CVE-2016-4538 CVE-2016-4539 CVE-2016-4540 CVE-2016-4541 CVE-2016-4542 CVE-2016-4543 CVE-2016-4544 CVE-2016-5093 CVE-2016-5094 CVE-2016-5096 CVE-2016-5114 CVE-2016-5399 CVE-2016-5766 CVE-2016-5767 CVE-2016-5768 CVE-2016-5770 CVE-2016-5771 CVE-2016-5772 CVE-2016-5773 CVE-2016-6128 CVE-2016-6207 CVE-2016-6288 CVE-2016-6289 CVE-2016-6290 CVE-2016-6291 CVE-2016-6292 CVE-2016-6294 CVE-2016-6295 CVE-2016-6296 CVE-2016-6297 CVE-2016-7124 CVE-2016-7125 CVE-2016-7126 CVE-2016-7127 CVE-2016-7128 CVE-2016-7129 CVE-2016-7130 CVE-2016-7131 CVE-2016-7132 =====================================================================

Summary:

An update for rh-php56, rh-php56-php, and rh-php56-php-pear is now available for Red Hat Software Collections.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Relevant releases/architectures:

Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) - noarch, x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) - noarch, x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7) - noarch, x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2) - noarch, x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3) - noarch, x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) - noarch, x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) - noarch, x86_64

Description:

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. The rh-php56 packages provide a recent stable release of PHP with PEAR 1.9.5 and enhanced language features including constant expressions, variadic functions, arguments unpacking, and the interactive debuger. The memcache, mongo, and XDebug extensions are also included.

The rh-php56 Software Collection has been upgraded to version 5.6.25, which provides a number of bug fixes and enhancements over the previous version. (BZ#1356157, BZ#1365401)

Security Fixes in the rh-php56-php component:

Several Moderate and Low impact security issues were found in PHP. Space precludes documenting each of these issues in this advisory. Refer to the CVE links in the References section for a description of each of these vulnerabilities. (CVE-2013-7456, CVE-2014-9767, CVE-2015-8835, CVE-2015-8865, CVE-2015-8866, CVE-2015-8867, CVE-2015-8873, CVE-2015-8874, CVE-2015-8876, CVE-2015-8877, CVE-2015-8879, CVE-2016-1903, CVE-2016-2554, CVE-2016-3074, CVE-2016-3141, CVE-2016-3142, CVE-2016-4070, CVE-2016-4071, CVE-2016-4072, CVE-2016-4073, CVE-2016-4342, CVE-2016-4343, CVE-2016-4473, CVE-2016-4537, CVE-2016-4538, CVE-2016-4539, CVE-2016-4540, CVE-2016-4541, CVE-2016-4542, CVE-2016-4543, CVE-2016-4544, CVE-2016-5093, CVE-2016-5094, CVE-2016-5096, CVE-2016-5114, CVE-2016-5399, CVE-2016-5766, CVE-2016-5767, CVE-2016-5768, CVE-2016-5770, CVE-2016-5771, CVE-2016-5772, CVE-2016-5773, CVE-2016-6128, CVE-2016-6207, CVE-2016-6288, CVE-2016-6289, CVE-2016-6290, CVE-2016-6291, CVE-2016-6292, CVE-2016-6294, CVE-2016-6295, CVE-2016-6296, CVE-2016-6297, CVE-2016-7124, CVE-2016-7125, CVE-2016-7126, CVE-2016-7127, CVE-2016-7128, CVE-2016-7129, CVE-2016-7130, CVE-2016-7131, CVE-2016-7132)
Multiple flaws were found in the PCRE library included with the rh-php56-php packages for Red Hat Enterprise Linux 6. (CVE-2015-2325, CVE-2015-2326, CVE-2015-2327, CVE-2015-2328, CVE-2015-3210, CVE-2015-3217, CVE-2015-5073, CVE-2015-8381, CVE-2015-8383, CVE-2015-8384, CVE-2015-8385, CVE-2015-8386, CVE-2015-8388, CVE-2015-8391, CVE-2015-8392, CVE-2015-8395)

Red Hat would like to thank Hans Jerry Illikainen for reporting CVE-2016-3074, CVE-2016-4473, and CVE-2016-5399.

Solution:

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the updated packages, the httpd daemon must be restarted for the update to take effect.

Bugs fixed (https://bugzilla.redhat.com/):

1207198 - CVE-2015-2325 pcre: heap buffer overflow in compile_branch() 1207202 - CVE-2015-2326 pcre: heap buffer over-read in pcre_compile2() (8.37/23) 1228283 - CVE-2015-3217 pcre: stack overflow caused by mishandled group empty match (8.38/11) 1237223 - CVE-2015-5073 CVE-2015-8388 pcre: buffer overflow for forward reference within backward assertion with excess closing parenthesis (8.38/18) 1260716 - CVE-2014-9767 php: ZipArchive::extractTo allows for directory traversal when creating directories 1285399 - CVE-2015-2328 pcre: infinite recursion compiling pattern with recursive reference in a group with indefinite repeat (8.36/20) 1285408 - CVE-2015-2327 pcre: infinite recursion compiling pattern with zero-repeated groups that include recursive back reference (8.36/19) 1287614 - CVE-2015-8383 pcre: Buffer overflow caused by repeated conditional group (8.38/3) 1287623 - CVE-2015-3210 CVE-2015-8384 pcre: buffer overflow caused by recursive back reference by name within certain group (8.38/4) 1287629 - CVE-2015-8385 pcre: buffer overflow caused by named forward reference to duplicate group number (8.38/30) 1287636 - CVE-2015-8386 pcre: Buffer overflow caused by lookbehind assertion (8.38/6) 1287671 - CVE-2015-8391 pcre: inefficient posix character class syntax check (8.38/16) 1287690 - CVE-2015-8392 pcre: buffer overflow caused by patterns with duplicated named groups with (?| (8.38/27) 1287711 - CVE-2015-8381 CVE-2015-8395 pcre: Buffer overflow caused by duplicate named references (8.38/36) 1297710 - CVE-2016-5114 php: out-of-bounds write in fpm_log.c 1297717 - CVE-2016-1903 php: Out-of-bounds memory read via gdImageRotateInterpolated 1305536 - CVE-2016-4342 php: use of uninitialized pointer in PharFileInfo::getContent 1305543 - CVE-2016-2554 php: buffer overflow in handling of long link names in tar phar archives 1315312 - CVE-2016-3142 php: Out-of-bounds read in phar_parse_zipfile() 1315328 - CVE-2016-3141 php: Use after free in WDDX Deserialize when processing XML data 1321893 - CVE-2016-3074 php: Signedness vulnerability causing heap overflow in libgd 1323074 - CVE-2015-8835 php: type confusion issue in Soap Client call() method 1323103 - CVE-2016-4073 php: Negative size parameter in memcpy 1323106 - CVE-2016-4072 php: Invalid memory write in phar on filename containing \0 inside name 1323108 - CVE-2016-4071 php: Format string vulnerability in php_snmp_error() 1323114 - CVE-2016-4070 php: Integer overflow in php_raw_url_encode 1323118 - CVE-2015-8865 file: Buffer over-write in finfo_open with malformed magic file 1330418 - CVE-2015-8866 php: libxml_disable_entity_loader setting is shared between threads 1330420 - CVE-2015-8867 php: openssl_random_pseudo_bytes() is not cryptographically secure 1332454 - CVE-2016-4343 php: Uninitialized pointer in phar_make_dirstream() 1332860 - CVE-2016-4537 CVE-2016-4538 php: bcpowmod accepts negative scale causing heap buffer overflow corrupting one definition 1332865 - CVE-2016-4542 CVE-2016-4543 CVE-2016-4544 php: Out-of-bounds heap memory read in exif_read_data() caused by malformed input 1332872 - CVE-2016-4540 CVE-2016-4541 php: OOB read in grapheme_stripos and grapheme_strpos when negative offset is used 1332877 - CVE-2016-4539 php: xml_parse_into_struct() can crash when XML parser is re-used 1336772 - CVE-2015-8874 gd: gdImageFillToBorder deep recursion leading to stack overflow 1336775 - CVE-2015-8873 php: Stack consumption vulnerability in Zend/zend_exceptions.c 1338896 - CVE-2015-8876 php: Zend/zend_exceptions.c does not validate certain Exception objects 1338907 - CVE-2015-8877 gd: gdImageScaleTwoPass function in gd_interpolation.c uses inconsistent allocate and free approaches 1338912 - CVE-2015-8879 php: odbc_bindcols function mishandles driver behavior for SQL_WVARCHAR columns 1339590 - CVE-2016-5093 php: improper nul termination leading to out-of-bounds read in get_icu_value_internal 1339949 - CVE-2016-5096 php: Integer underflow causing arbitrary null write in fread/gzread 1340433 - CVE-2013-7456 gd: incorrect boundary adjustment in _gdContributionsCalc 1340738 - CVE-2016-5094 php: Integer overflow in php_html_entities() 1347772 - CVE-2016-4473 php: Invalid free() instead of efree() in phar_extract_file() 1351068 - CVE-2016-5766 gd: Integer Overflow in _gd2GetHeader() resulting in heap overflow 1351069 - CVE-2016-5767 gd: Integer Overflow in gdImagePaletteToTrueColor() resulting in heap overflow 1351168 - CVE-2016-5768 php: Double free in _php_mb_regex_ereg_replace_exec 1351171 - CVE-2016-5770 php: Int/size_t confusion in SplFileObject::fread 1351173 - CVE-2016-5771 php: Use After Free Vulnerability in PHP's GC algorithm and unserialize 1351175 - CVE-2016-5772 php: Double Free Corruption in wddx_deserialize 1351179 - CVE-2016-5773 php: ZipArchive class Use After Free Vulnerability in PHP's GC algorithm and unserialize 1351603 - CVE-2016-6128 gd: Invalid color index not properly handled 1358395 - CVE-2016-5399 php: Improper error handling in bzread() 1359698 - CVE-2016-6289 php: Integer overflow leads to buffer overflow in virtual_file_ex 1359710 - CVE-2016-6290 php: Use after free in unserialize() with Unexpected Session Deserialization 1359718 - CVE-2016-6291 php: Out-of-bounds access in exif_process_IFD_in_MAKERNOTE 1359756 - CVE-2016-6292 php: Null pointer dereference in exif_process_user_comment 1359800 - CVE-2016-6207 php,gd: Integer overflow error within _gdContributionsAlloc() 1359811 - CVE-2016-6294 php: Out-of-bounds access in locale_accept_from_http 1359815 - CVE-2016-6295 php: Use after free in SNMP with GC and unserialize() 1359822 - CVE-2016-6296 php: Heap buffer overflow vulnerability in simplestring_addn in simplestring.c 1359828 - CVE-2016-6297 php: Stack-based buffer overflow vulnerability in php_stream_zip_opener 1360322 - CVE-2016-6288 php: Buffer over-read in php_url_parse_ex 1374697 - CVE-2016-7124 php: bypass __wakeup() in deserialization of an unexpected object 1374698 - CVE-2016-7125 php: Session Data Injection Vulnerability 1374699 - CVE-2016-7126 php: select_colors write out-of-bounds 1374701 - CVE-2016-7127 php: imagegammacorrect allows arbitrary write access 1374704 - CVE-2016-7128 php: Memory Leakage In exif_process_IFD_in_TIFF 1374705 - CVE-2016-7129 php: wddx_deserialize allows illegal memory access 1374707 - CVE-2016-7130 php: wddx_deserialize null dereference 1374708 - CVE-2016-7131 php: wddx_deserialize null dereference with invalid xml 1374711 - CVE-2016-7132 php: wddx_deserialize null dereference in php_wddx_pop_element

Package List:

Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6):

Source: rh-php56-2.3-1.el6.src.rpm rh-php56-php-5.6.25-1.el6.src.rpm rh-php56-php-pear-1.9.5-4.el6.src.rpm

noarch: rh-php56-php-pear-1.9.5-4.el6.noarch.rpm

x86_64: rh-php56-2.3-1.el6.x86_64.rpm rh-php56-php-5.6.25-1.el6.x86_64.rpm rh-php56-php-bcmath-5.6.25-1.el6.x86_64.rpm rh-php56-php-cli-5.6.25-1.el6.x86_64.rpm rh-php56-php-common-5.6.25-1.el6.x86_64.rpm rh-php56-php-dba-5.6.25-1.el6.x86_64.rpm rh-php56-php-dbg-5.6.25-1.el6.x86_64.rpm rh-php56-php-debuginfo-5.6.25-1.el6.x86_64.rpm rh-php56-php-devel-5.6.25-1.el6.x86_64.rpm rh-php56-php-embedded-5.6.25-1.el6.x86_64.rpm rh-php56-php-enchant-5.6.25-1.el6.x86_64.rpm rh-php56-php-fpm-5.6.25-1.el6.x86_64.rpm rh-php56-php-gd-5.6.25-1.el6.x86_64.rpm rh-php56-php-gmp-5.6.25-1.el6.x86_64.rpm rh-php56-php-imap-5.6.25-1.el6.x86_64.rpm rh-php56-php-intl-5.6.25-1.el6.x86_64.rpm rh-php56-php-ldap-5.6.25-1.el6.x86_64.rpm rh-php56-php-mbstring-5.6.25-1.el6.x86_64.rpm rh-php56-php-mysqlnd-5.6.25-1.el6.x86_64.rpm rh-php56-php-odbc-5.6.25-1.el6.x86_64.rpm rh-php56-php-opcache-5.6.25-1.el6.x86_64.rpm rh-php56-php-pdo-5.6.25-1.el6.x86_64.rpm rh-php56-php-pgsql-5.6.25-1.el6.x86_64.rpm rh-php56-php-process-5.6.25-1.el6.x86_64.rpm rh-php56-php-pspell-5.6.25-1.el6.x86_64.rpm rh-php56-php-recode-5.6.25-1.el6.x86_64.rpm rh-php56-php-snmp-5.6.25-1.el6.x86_64.rpm rh-php56-php-soap-5.6.25-1.el6.x86_64.rpm rh-php56-php-tidy-5.6.25-1.el6.x86_64.rpm rh-php56-php-xml-5.6.25-1.el6.x86_64.rpm rh-php56-php-xmlrpc-5.6.25-1.el6.x86_64.rpm rh-php56-runtime-2.3-1.el6.x86_64.rpm rh-php56-scldevel-2.3-1.el6.x86_64.rpm

Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7):

Source: rh-php56-2.3-1.el6.src.rpm rh-php56-php-5.6.25-1.el6.src.rpm rh-php56-php-pear-1.9.5-4.el6.src.rpm

noarch: rh-php56-php-pear-1.9.5-4.el6.noarch.rpm

Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6):

Source: rh-php56-2.3-1.el6.src.rpm rh-php56-php-5.6.25-1.el6.src.rpm rh-php56-php-pear-1.9.5-4.el6.src.rpm

noarch: rh-php56-php-pear-1.9.5-4.el6.noarch.rpm

Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7):

Source: rh-php56-2.3-1.el7.src.rpm rh-php56-php-5.6.25-1.el7.src.rpm rh-php56-php-pear-1.9.5-4.el7.src.rpm

noarch: rh-php56-php-pear-1.9.5-4.el7.noarch.rpm

x86_64: rh-php56-2.3-1.el7.x86_64.rpm rh-php56-php-5.6.25-1.el7.x86_64.rpm rh-php56-php-bcmath-5.6.25-1.el7.x86_64.rpm rh-php56-php-cli-5.6.25-1.el7.x86_64.rpm rh-php56-php-common-5.6.25-1.el7.x86_64.rpm rh-php56-php-dba-5.6.25-1.el7.x86_64.rpm rh-php56-php-dbg-5.6.25-1.el7.x86_64.rpm rh-php56-php-debuginfo-5.6.25-1.el7.x86_64.rpm rh-php56-php-devel-5.6.25-1.el7.x86_64.rpm rh-php56-php-embedded-5.6.25-1.el7.x86_64.rpm rh-php56-php-enchant-5.6.25-1.el7.x86_64.rpm rh-php56-php-fpm-5.6.25-1.el7.x86_64.rpm rh-php56-php-gd-5.6.25-1.el7.x86_64.rpm rh-php56-php-gmp-5.6.25-1.el7.x86_64.rpm rh-php56-php-intl-5.6.25-1.el7.x86_64.rpm rh-php56-php-ldap-5.6.25-1.el7.x86_64.rpm rh-php56-php-mbstring-5.6.25-1.el7.x86_64.rpm rh-php56-php-mysqlnd-5.6.25-1.el7.x86_64.rpm rh-php56-php-odbc-5.6.25-1.el7.x86_64.rpm rh-php56-php-opcache-5.6.25-1.el7.x86_64.rpm rh-php56-php-pdo-5.6.25-1.el7.x86_64.rpm rh-php56-php-pgsql-5.6.25-1.el7.x86_64.rpm rh-php56-php-process-5.6.25-1.el7.x86_64.rpm rh-php56-php-pspell-5.6.25-1.el7.x86_64.rpm rh-php56-php-recode-5.6.25-1.el7.x86_64.rpm rh-php56-php-snmp-5.6.25-1.el7.x86_64.rpm rh-php56-php-soap-5.6.25-1.el7.x86_64.rpm rh-php56-php-xml-5.6.25-1.el7.x86_64.rpm rh-php56-php-xmlrpc-5.6.25-1.el7.x86_64.rpm rh-php56-runtime-2.3-1.el7.x86_64.rpm rh-php56-scldevel-2.3-1.el7.x86_64.rpm

Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2):

Source: rh-php56-2.3-1.el7.src.rpm rh-php56-php-5.6.25-1.el7.src.rpm rh-php56-php-pear-1.9.5-4.el7.src.rpm

noarch: rh-php56-php-pear-1.9.5-4.el7.noarch.rpm

Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3):

Source: rh-php56-2.3-1.el7.src.rpm rh-php56-php-5.6.25-1.el7.src.rpm rh-php56-php-pear-1.9.5-4.el7.src.rpm

noarch: rh-php56-php-pear-1.9.5-4.el7.noarch.rpm

Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7):

Source: rh-php56-2.3-1.el7.src.rpm rh-php56-php-5.6.25-1.el7.src.rpm rh-php56-php-pear-1.9.5-4.el7.src.rpm

noarch: rh-php56-php-pear-1.9.5-4.el7.noarch.rpm

These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/

References:

https://access.redhat.com/security/cve/CVE-2013-7456 https://access.redhat.com/security/cve/CVE-2014-9767 https://access.redhat.com/security/cve/CVE-2015-2325 https://access.redhat.com/security/cve/CVE-2015-2326 https://access.redhat.com/security/cve/CVE-2015-2327 https://access.redhat.com/security/cve/CVE-2015-2328 https://access.redhat.com/security/cve/CVE-2015-3210 https://access.redhat.com/security/cve/CVE-2015-3217 https://access.redhat.com/security/cve/CVE-2015-5073 https://access.redhat.com/security/cve/CVE-2015-8381 https://access.redhat.com/security/cve/CVE-2015-8383 https://access.redhat.com/security/cve/CVE-2015-8384 https://access.redhat.com/security/cve/CVE-2015-8385 https://access.redhat.com/security/cve/CVE-2015-8386 https://access.redhat.com/security/cve/CVE-2015-8388 https://access.redhat.com/security/cve/CVE-2015-8391 https://access.redhat.com/security/cve/CVE-2015-8392 https://access.redhat.com/security/cve/CVE-2015-8395 https://access.redhat.com/security/cve/CVE-2015-8835 https://access.redhat.com/security/cve/CVE-2015-8865 https://access.redhat.com/security/cve/CVE-2015-8866 https://access.redhat.com/security/cve/CVE-2015-8867 https://access.redhat.com/security/cve/CVE-2015-8873 https://access.redhat.com/security/cve/CVE-2015-8874 https://access.redhat.com/security/cve/CVE-2015-8876 https://access.redhat.com/security/cve/CVE-2015-8877 https://access.redhat.com/security/cve/CVE-2015-8879 https://access.redhat.com/security/cve/CVE-2016-1903 https://access.redhat.com/security/cve/CVE-2016-2554 https://access.redhat.com/security/cve/CVE-2016-3074 https://access.redhat.com/security/cve/CVE-2016-3141 https://access.redhat.com/security/cve/CVE-2016-3142 https://access.redhat.com/security/cve/CVE-2016-4070 https://access.redhat.com/security/cve/CVE-2016-4071 https://access.redhat.com/security/cve/CVE-2016-4072 https://access.redhat.com/security/cve/CVE-2016-4073 https://access.redhat.com/security/cve/CVE-2016-4342 https://access.redhat.com/security/cve/CVE-2016-4343 https://access.redhat.com/security/cve/CVE-2016-4473 https://access.redhat.com/security/cve/CVE-2016-4537 https://access.redhat.com/security/cve/CVE-2016-4538 https://access.redhat.com/security/cve/CVE-2016-4539 https://access.redhat.com/security/cve/CVE-2016-4540 https://access.redhat.com/security/cve/CVE-2016-4541 https://access.redhat.com/security/cve/CVE-2016-4542 https://access.redhat.com/security/cve/CVE-2016-4543 https://access.redhat.com/security/cve/CVE-2016-4544 https://access.redhat.com/security/cve/CVE-2016-5093 https://access.redhat.com/security/cve/CVE-2016-5094 https://access.redhat.com/security/cve/CVE-2016-5096 https://access.redhat.com/security/cve/CVE-2016-5114 https://access.redhat.com/security/cve/CVE-2016-5399 https://access.redhat.com/security/cve/CVE-2016-5766 https://access.redhat.com/security/cve/CVE-2016-5767 https://access.redhat.com/security/cve/CVE-2016-5768 https://access.redhat.com/security/cve/CVE-2016-5770 https://access.redhat.com/security/cve/CVE-2016-5771 https://access.redhat.com/security/cve/CVE-2016-5772 https://access.redhat.com/security/cve/CVE-2016-5773 https://access.redhat.com/security/cve/CVE-2016-6128 https://access.redhat.com/security/cve/CVE-2016-6207 https://access.redhat.com/security/cve/CVE-2016-6288 https://access.redhat.com/security/cve/CVE-2016-6289 https://access.redhat.com/security/cve/CVE-2016-6290 https://access.redhat.com/security/cve/CVE-2016-6291 https://access.redhat.com/security/cve/CVE-2016-6292 https://access.redhat.com/security/cve/CVE-2016-6294 https://access.redhat.com/security/cve/CVE-2016-6295 https://access.redhat.com/security/cve/CVE-2016-6296 https://access.redhat.com/security/cve/CVE-2016-6297 https://access.redhat.com/security/cve/CVE-2016-7124 https://access.redhat.com/security/cve/CVE-2016-7125 https://access.redhat.com/security/cve/CVE-2016-7126 https://access.redhat.com/security/cve/CVE-2016-7127 https://access.redhat.com/security/cve/CVE-2016-7128 https://access.redhat.com/security/cve/CVE-2016-7129 https://access.redhat.com/security/cve/CVE-2016-7130 https://access.redhat.com/security/cve/CVE-2016-7131 https://access.redhat.com/security/cve/CVE-2016-7132 https://access.redhat.com/security/updates/classification/#moderate

Contact:

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/

iD8DBQFYKvj4XlSAg2UNWIIRAqg2AKCB6Jcysv4gkiktKAJA3gy+RKlAqwCeJpjs UCuj+0gWfBsWXOgFhgH0uL8= =FcPG -----END PGP SIGNATURE-----

-- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1

Note: the current version of the following document is available here: https://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c05240731

SUPPORT COMMUNICATION - SECURITY BULLETIN

Document ID: c05240731 Version: 1

HPSBNS03635 rev.1 - HPE NonStop Servers OSS Script Languages running Perl and PHP, Multiple Local and Remote Vulnerabilities

NOTICE: The information in this Security Bulletin should be acted upon as soon as possible.

Release Date: 2016-08-19 Last Updated: 2016-08-19

Potential Security Impact: Local Denial of Service (DoS), Elevation of Privilege, Remote Denial of Service (DoS), Execution of Arbitrary Code, Unauthorized Disclosure of Information, Unauthorized Modification

Source: Hewlett Packard Enterprise, Product Security Response Team

VULNERABILITY SUMMARY Multiple potential remote and local vulnerabilities impacting Perl and PHP have been addressed by HPE NonStop Servers OSS Script Languages. The vulnerabilities include Perl's opportunistic loading of optional modules which might allow local users to gain elevation of privilege via a Trojan horse library under the current working directory.

References:

- CVE-2016-1238 - Perl Local Elevation of Privilege
- CVE-2016-2381 - Perl Remote Unauthorized Modification
- CVE-2014-4330 - Perl Local Denial of Service (DoS)

    **Note:** applies only for the H/J-series SPR. Fix was already

provided in a previous L-series SPR.

- CVE-2015-8383 - Perl Remote Denial of Service (DoS)
- CVE-2015-8386 - Perl Remote Denial of Service (DoS)
- CVE-2015-8387 - Perl Remote Denial of Service (DoS)
- CVE-2015-8389 - Perl Remote Denial of Service (DoS)
- CVE-2015-8390 - Perl Remote Denial of Service (DoS)
- CVE-2015-8391 - Perl Remote Denial of Service (DoS)
- CVE-2015-8393 - Perl Remote Unauthorized Disclosure of Information
- CVE-2015-8394 - Perl Remote Denial of Service (DoS)
- CVE-2015-8607 - Perl Remote Unauthorized Disclosure of Information,

Unauthorized Modification, Denial of Service (DoS) - CVE-2015-8853 - Perl Remote Denial of Service (DoS) - CVE-2015-8865 - Perl Remote Denial of Service (Dos), Execute Arbitrary Code - CVE-2013-7456 - PHP Remote Denial of Service (DoS) - CVE-2015-8874 - PHP Remote Denial of Service (DoS) - CVE-2016-1903 - PHP Remote Unauthorized Disclosure of Information, Denial of Service (DoS) - CVE-2016-2554 - PHP Remote Denial of Service (DoS) - CVE-2016-3074 - PHP using GD Graphics Library 2.1.1 (aka libgd or libgd2) Remote Denial of Service (Dos), Execute Arbitrary Code - CVE-2016-4070 - PHP Remote Denial of Service (DoS) - CVE-2016-4071 - PHP Remote Execute Arbitrary Code - CVE-2016-4072 - PHP Remote Execute Arbitrary Code - CVE-2016-4073 - PHP Remote Denial of Service (Dos), Execute Arbitrary Code - CVE-2016-4342 - PHP Remote Denial of Service (DoS) - CVE-2016-4343 - PHP Remote Denial of Service (DoS) - CVE-2016-4537 - PHP Remote Denial of Service (DoS) - CVE-2016-4538 - PHP Remote Denial of Service (DoS) - CVE-2016-4539 - PHP Remote Denial of Service (DoS) - CVE-2016-4540 - PHP Remote Denial of Service (DoS) - CVE-2016-4541 - PHP Remote Denial of Service (DoS) - CVE-2016-4542 - PHP Remote Denial of Service (DoS) - CVE-2016-4543 - PHP Remote Denial of Service (DoS) - CVE-2016-4544 - PHP Remote Denial of Service (DoS) - CVE-2016-5093 - PHP Remote Denial of Service (DoS) - CVE-2016-5094 - PHP Remote Denial of Service (DoS) - CVE-2016-5096 - PHP Remote Denial of Service (DoS) - CVE-2016-5114 - PHP Remote Unauthorized Disclosure of Information, Denial of Service (DoS) - CVE-2016-5766 - PHP Remote Denial of Service (DoS) - CVE-2016-5767 - PHP Remote Denial of Service (DoS) - CVE-2016-5768 - PHP Remote Denial of Service (Dos), Execute Arbitrary Code - CVE-2016-5769 - PHP Remote Denial of Service (DoS) - CVE-2016-5770 - PHP Remote Denial of Service (DoS) - CVE-2016-5771 - PHP Remote Denial of Service (Dos), Execute Arbitrary Code - CVE-2016-5772 - PHP Remote Denial of Service (Dos), Execute Arbitrary Code - CVE-2016-5773 - PHP Remote Denial of Service (Dos), Execute Arbitrary Code - NonStop Hotstuff HS03333 - PSRT110206

SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed. OSS Script Languages (T1203) T1203H01 through T1203H01^AAD, T1203L01 and T1203L01^AAC

*Impacted releases:*

- L15.02
- L15.08.00, L15.08.01
- L16.05.00

- J06.14 through J06.16.02
- J06.17.00, J06.17.01
- J06.18.00, J06.18.01
- J06.19.00, J06.19.01, J06.19.02
- J06.20.00

- H06.25 through H06.26.01
- H06.27.00, H06.27.01
- H06.28.00, H06.28.01
- H06.29.00, H06.29.01

BACKGROUND

CVSS Base Metrics ================= Reference, CVSS V3 Score/Vector, CVSS V2 Score/Vector

CVE-2013-7456
  7.6 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H
  6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)

CVE-2014-4330
  4.0 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
  2.1 (AV:L/AC:L/Au:N/C:N/I:N/A:P)

CVE-2015-8383
  7.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
  7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)

CVE-2015-8386
  7.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
  7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)

CVE-2015-8387
  7.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
  7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)

CVE-2015-8389
  7.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
  7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)

CVE-2015-8390
  7.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
  7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)

CVE-2015-8391
  8.6 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
  9.0 (AV:N/AC:L/Au:N/C:P/I:P/A:C)

CVE-2015-8393
  5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
  5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N)

CVE-2015-8394
  7.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
  7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)

CVE-2015-8607
  7.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
  7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)

CVE-2015-8853
  7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)

CVE-2015-8865
  7.3 CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
  7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)

CVE-2015-8874
  7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)

CVE-2016-1238
  6.7 CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
  6.2 (AV:L/AC:H/Au:N/C:C/I:C/A:C)

CVE-2016-1903
  9.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
  6.4 (AV:N/AC:L/Au:N/C:P/I:N/A:P)

CVE-2016-2381
  6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
  5.0 (AV:N/AC:L/Au:N/C:N/I:P/A:N)

CVE-2016-2554
  9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)

CVE-2016-3074
  9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)

CVE-2016-4070
  7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)

CVE-2016-4071
  9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)

CVE-2016-4072
  9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)

CVE-2016-4073
  9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)

CVE-2016-4342
  8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
  8.3 (AV:N/AC:M/Au:N/C:P/I:P/A:C)

CVE-2016-4343
  8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
  6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)

CVE-2016-4537
  9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)

CVE-2016-4538
  9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)

CVE-2016-4539
  9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)

CVE-2016-4540
  9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)

CVE-2016-4541
  9.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
  7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)

CVE-2016-4542
  9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)

CVE-2016-4543
  9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)

CVE-2016-4544
  9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)

CVE-2016-5093
  8.6 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
  7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)

CVE-2016-5094
  8.6 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
  7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)

CVE-2016-5096
  8.6 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
  7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)

CVE-2016-5114
  9.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
  6.4 (AV:N/AC:L/Au:N/C:P/I:N/A:P)

CVE-2016-5766
  8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
  6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)

CVE-2016-5767
  8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
  6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)

CVE-2016-5768
  9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)

CVE-2016-5769
  9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)

CVE-2016-5770
  9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)

CVE-2016-5771
  9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)

CVE-2016-5772
  9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)

CVE-2016-5773
  9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)

Information on CVSS is documented in
HPE Customer Notice HPSN-2008-002 here:

https://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c01345499

RESOLUTION

HPE has released the following software updates to resolve the vulnerabilities in NonStop Servers OSS Script Languages running Perl and PHP.

Install one of the SPRs below as appropriate for the system's release version:

L-Series:
- T1203L01^AAE (OSS Scripting Languages) - already available
  
  This SPR already is present in these RVUs: None
  
  This SPR is usable with the following RVUs:
  - L15.02 through L16.05.00
H and J-Series:
- T1203H01^AAF (OSS Scripting Languages) - already available
  
  This SPR already is present in these RVUs: None
  
  This SPR is usable with the following RVUs:
  - J06.14 through J06.20.00
  - H06.25 through H06.29.01

Note: Please refer to NonStop Hotstuff HS03333 for more information.

HISTORY Version:1 (rev.1) - 19 August 2016 Initial release

Third Party Security Patches: Third party security patches that are to be installed on systems running Hewlett Packard Enterprise (HPE) software products should be applied in accordance with the customer's patch management policy.

Support: For issues about implementing the recommendations of this Security Bulletin, contact normal HPE Services support channel. For other issues about the content of this Security Bulletin, send e-mail to security-alert@hpe.com.

Report: To report a potential security vulnerability for any HPE supported product: Web form: https://www.hpe.com/info/report-security-vulnerability Email: security-alert@hpe.com

Subscribe: To initiate a subscription to receive future HPE Security Bulletin alerts via Email: http://www.hpe.com/support/Subscriber_Choice

Security Bulletin Archive: A list of recently released Security Bulletins is available here: http://www.hpe.com/support/Security_Bulletin_Archive

Software Product Category: The Software Product Category is represented in the title by the two characters following HPSB.

3C = 3COM 3P = 3rd Party Software GN = HPE General Software HF = HPE Hardware and Firmware MU = Multi-Platform Software NS = NonStop Servers OV = OpenVMS PV = ProCurve ST = Storage Software UX = HP-UX

Hewlett Packard Enterprise shall not be liable for technical or editorial errors or omissions contained herein. The information provided is provided "as is" without warranty of any kind. To the extent permitted by law, neither HP or its affiliates, subcontractors or suppliers will be liable for incidental,special or consequential damages including downtime cost; lost profits; damages relating to the procurement of substitute products or services; or damages for loss of data, or software restoration. The information in this document is subject to change without notice. Hewlett Packard Enterprise and the names of Hewlett Packard Enterprise products referenced herein are trademarks of Hewlett Packard Enterprise in the United States and other countries. Other product and company names mentioned herein may be trademarks of their respective owners. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512

APPLE-SA-2016-05-16-4 OS X El Capitan 10.11.5 and Security Update 2016-003

OS X El Capitan 10.11.5 and Security Update 2016-003 is now available and addresses the following:

AMD Available for: OS X El Capitan v10.11 and later Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed through improved memory handling. CVE-ID CVE-2016-1792 : beist and ABH of BoB

AMD Available for: OS X Mavericks v10.9.5, OS X Yosemite v10.10.5, and OS X El Capitan v10.11 and later Impact: An application may be able to determine kernel memory layout Description: An issue existed that led to the disclosure of kernel memory content. This issue was addressed through improved bounds checking. CVE-ID CVE-2016-1791 : daybreaker of Minionz

apache_mod_php Available for: OS X El Capitan v10.11 and later Impact: Multiple vulnerabilities in PHP Description: Multiple vulnerabilities existed in PHP versions prior to 5.5.34. These were addressed by updating PHP to version 5.5.34. CVE-ID CVE-2015-8865 CVE-2016-3141 CVE-2016-3142 CVE-2016-4070 CVE-2016-4071 CVE-2016-4072 CVE-2016-4073

AppleGraphicsControl Available for: OS X El Capitan v10.11 and later Impact: An application may be able to execute arbitrary code with kernel privileges Description: A null pointer dereference was addressed through improved validation. CVE-ID CVE-2016-1793 : Ian Beer of Google Project Zero CVE-2016-1794 : Ian Beer of Google Project Zero

AppleGraphicsPowerManagement Available for: OS X El Capitan v10.11 and later Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed through improved memory handling. CVE-ID CVE-2016-1795 : Moony Li (@Flyic) and Jack Tang (@jacktang310) of Trend Micro

ATS Available for: OS X El Capitan v10.11 and later Impact: An application may be able to determine kernel memory layout Description: An out of bounds memory access issue was addressed through improved memory handling. CVE-ID CVE-2016-1796 : lokihardt working with Trend Micro's Zero Day Initiative

ATS Available for: OS X El Capitan v10.11 and later Impact: An application may be able to execute arbitrary code with system privileges Description: An issue existed in the sandbox policy. This was addressed by sandboxing FontValidator. CVE-ID CVE-2016-1797 : lokihardt working with Trend Micro's Zero Day Initiative

Audio Available for:
OS X Yosemite v10.10.5 and OS X El Capitan v10.11 and later Impact: An application may be able to cause a denial of service Description: A null pointer dereference was addressed through improved validation. CVE-ID CVE-2016-1798 : Juwei Lin of TrendMicro

Audio Available for: OS X El Capitan v10.11 and later Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed through improved input validation. CVE-ID CVE-2016-1799 : Juwei Lin of TrendMicro

Captive Network Assistant Available for: OS X Mavericks v10.9.5, OS X Yosemite v10.10.5, and OS X El Capitan v10.11 and later Impact: An attacker in a privileged network position may be able to execute arbitrary code with user assistance Description: A custom URL scheme handling issue was addressed through improved input validation. CVE-ID CVE-2016-1800 : Apple

CFNetwork Proxies Available for: OS X El Capitan v10.11 and later Impact: An attacker in a privileged network position may be able to leak sensitive user information Description: An information leak existed in the handling of HTTP and HTTPS requests. This issue was addressed through improved URL handling. CVE-ID CVE-2016-1801 : Alex Chapman and Paul Stone of Context Information Security

CommonCrypto Available for: OS X El Capitan v10.11 and later Impact: A malicious application may be able to leak sensitive user information Description: An issue existed in the handling of return values in CCCrypt. This issue was addressed through improved key length management. CVE-ID CVE-2016-1802 : Klaus Rodewig

CoreCapture Available for: OS X El Capitan v10.11 and later Impact: An application may be able to execute arbitrary code with kernel privileges Description: A null pointer dereference was addressed through improved validation. CVE-ID CVE-2016-1803 : Ian Beer of Google Project Zero, daybreaker working with Trend Micro’s Zero Day Initiative

CoreStorage Available for: OS X El Capitan v10.11 and later Impact: An application may be able to execute arbitrary code with kernel privileges Description: A configuration issue was addressed through additional restrictions. CVE-ID CVE-2016-1805 : Stefan Esser

Crash Reporter Available for: OS X El Capitan v10.11 and later Impact: An application may be able to execute arbitrary code with root privileges Description: A configuration issue was addressed through additional restrictions. CVE-ID CVE-2016-1806 : lokihardt working with Trend Micro's Zero Day Initiative

Disk Images Available for: OS X El Capitan v10.11 and later Impact: A local attacker may be able to read kernel memory Description: A race condition was addressed through improved locking. CVE-ID CVE-2016-1807 : Ian Beer of Google Project Zero

Disk Images Available for: OS X El Capitan v10.11 and later Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue existed in the parsing of disk images. This issue was addressed through improved memory handling. CVE-ID CVE-2016-1808 : Moony Li (@Flyic) and Jack Tang (@jacktang310) of Trend Micro

Disk Utility Available for: OS X El Capitan v10.11 and later Impact: Disk Utility failed to compress and encrypt disk images Description: Incorrect keys were being used to encrypt disk images. This issue was addressed by updating the encryption keys. CVE-ID CVE-2016-1809 : Ast A. Moore (@astamoore) and David Foster of TechSmartKids

Graphics Drivers Available for: OS X El Capitan v10.11 and later Impact: An application may be able to execute arbitrary code with kernel privileges Description: Multiple memory corruption issues were addressed through improved memory handling. CVE-ID CVE-2016-1810 : Moony Li (@Flyic) and Jack Tang (@jacktang310) of Trend Micro

ImageIO Available for: OS X El Capitan v10.11 and later Impact: Processing a maliciously crafted image may lead to a denial of service Description: A null pointer dereference was addressed through improved validation. CVE-ID CVE-2016-1811 : Lander Brandt (@landaire)

Intel Graphics Driver Available for: OS X El Capitan v10.11 and later Impact: An application may be able to execute arbitrary code with kernel privileges Description: A buffer overflow was addressed through improved bounds checking. CVE-ID CVE-2016-1812 : Juwei Lin of TrendMicro

IOAcceleratorFamily Available for: OS X El Capitan v10.11 and later Impact: An application may be able to cause a denial of service Description: A null pointer dereference was addressed through improved locking. CVE-ID CVE-2016-1814 : Juwei Lin of TrendMicro

IOAcceleratorFamily Available for: OS X El Capitan v10.11 and later Impact: An application may be able to execute arbitrary code with kernel privileges Description: Multiple memory corruption issues were addressed through improved memory handling. CVE-ID CVE-2016-1815 : Liang Chen, Qidan He of KeenLab, Tencent working with Trend Micro's Zero Day Initiative CVE-2016-1817 : Moony Li (@Flyic) and Jack Tang (@jacktang310) of Trend Micro working with Trend Micro's Zero Day Initiative CVE-2016-1818 : Juwei Lin of TrendMicro CVE-2016-1819 : Ian Beer of Google Project Zero

IOAcceleratorFamily Available for: OS X El Capitan v10.11 and later Impact: An application may be able to execute arbitrary code with kernel privileges Description: A null pointer dereference was addressed through improved validation. CVE-ID CVE-2016-1813 : Ian Beer of Google Project Zero CVE-2016-1816 : Peter Pi (@heisecode) of Trend Micro and Juwei Lin of Trend Micro

IOAudioFamily Available for: OS X El Capitan v10.11 and later Impact: An application may be able to execute arbitrary code with kernel privileges Description: A buffer overflow was addressed with improved bounds checking. CVE-ID CVE-2016-1820 : Moony Li (@Flyic) and Jack Tang (@jacktang310) of Trend Micro working with Trend Micro’s Zero Day Initiative

IOAudioFamily Available for: OS X El Capitan v10.11 and later Impact: An application may be able to execute arbitrary code with kernel privileges Description: A null pointer dereference was addressed through improved validation. CVE-ID CVE-2016-1821 : Ian Beer of Google Project Zero

IOFireWireFamily Available for: OS X El Capitan v10.11 and later Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed through improved memory handling. CVE-ID CVE-2016-1822 : CESG

IOHIDFamily Available for: OS X El Capitan v10.11 and later Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed through improved memory handling. CVE-ID CVE-2016-1823 : Ian Beer of Google Project Zero CVE-2016-1824 : Marco Grassi (@marcograss) of KeenLab (@keen_lab), Tencent

IOHIDFamily Available for: OS X El Capitan v10.11 and later Impact: An application may be able to execute arbitrary code with kernel privileges Description: Multiple memory corruption issues were addressed through improved memory handling. CVE-ID CVE-2016-1825 : Brandon Azad

Kernel Available for: OS X El Capitan v10.11 and later Impact: An application may be able to execute arbitrary code with kernel privileges Description: Multiple memory corruption issues were addressed through improved memory handling. CVE-ID CVE-2016-1827 : Brandon Azad CVE-2016-1828 : Brandon Azad CVE-2016-1829 : CESG CVE-2016-1830 : Brandon Azad CVE-2016-1831 : Brandon Azad

Kernel Available for: OS X El Capitan v10.11 and later Impact: An application may be able to execute arbitrary code with kernel privileges Description: An integer overflow existed in dtrace. This issue was addressed through improved bounds checking. CVE-ID CVE-2016-1826 : Ben Murphy working with Trend Micro’s Zero Day Initiative

libc Available for: OS X El Capitan v10.11 and later Impact: A local attacker may be able to cause unexpected application termination or arbitrary code execution Description: A memory corruption issue was addressed through improved input validation. CVE-ID CVE-2016-1832 : Karl Williamson

libxml2 Available for: OS X Mavericks v10.9.5, OS X Yosemite v10.10.5, and OS X El Capitan v10.11 and later Impact: Processing maliciously crafted XML may lead to an unexpected application termination or arbitrary code execution Description: Multiple memory corruption issues were addressed through improved memory handling. CVE-ID CVE-2016-1833 : Mateusz Jurczyk CVE-2016-1834 : Apple CVE-2016-1835 : Wei Lei and Liu Yang of Nanyang Technological University CVE-2016-1836 : Wei Lei and Liu Yang of Nanyang Technological University CVE-2016-1837 : Wei Lei and Liu Yang of Nanyang Technological University CVE-2016-1838 : Mateusz Jurczyk CVE-2016-1839 : Mateusz Jurczyk CVE-2016-1840 : Kostya Serebryany

libxslt Available for: OS X Mavericks v10.9.5, OS X Yosemite v10.10.5, and OS X El Capitan v10.11 and later Impact: Visiting a maliciously crafted website may lead to arbitrary code execution Description: A memory corruption issue was addressed through improved memory handling. CVE-ID CVE-2016-1841 : Sebastian Apelt

MapKit Available for: OS X El Capitan v10.11 and later Impact: An attacker in a privileged network position may be able to leak sensitive user information Description: Shared links were sent with HTTP rather than HTTPS. This was addressed by enabling HTTPS for shared links. CVE-ID CVE-2016-1842 : Richard Shupak (https://www.linkedin.com/in/rshupak)

Messages Available for: OS X El Capitan v10.11 and later Impact: A malicious server or user may be able to modify another user's contact list Description: A validation issue existed in roster changes. This issue was addressed through improved validation of roster sets. CVE-ID CVE-2016-1844 : Thijs Alkemade of Computest

Messages Available for: OS X El Capitan v10.11 and later Impact: A remote attacker may be able to leak sensitive user information Description: An encoding issue existed in filename parsing. This issue was addressed through improved filename encoding. CVE-ID CVE-2016-1843 : Heige (a.k.a. SuperHei) of Knownsec 404 Security Team [http://www.knownsec.com]

Multi-Touch Available for: OS X El Capitan v10.11 and later Impact: An application may be able to execute arbitrary code with system privileges Description: A memory corruption issue was addressed through improved memory handling. CVE-ID CVE-2016-1804 : Liang Chen, Yubin Fu, Marco Grassi of KeenLab, Tencent of Trend Micro's Zero Day Initiative

NVIDIA Graphics Drivers Available for:
OS X Yosemite v10.10.5 and OS X El Capitan v10.11 and later Impact: An application may be able to execute arbitrary code with kernel privileges Description: Multiple memory corruption issues were addressed through improved memory handling. CVE-ID CVE-2016-1846 : Ian Beer of Google Project Zero

OpenGL Available for: OS X Mavericks v10.9.5, OS X Yosemite v10.10.5, and OS X El Capitan v10.11 and later Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: Multiple memory corruption issues were addressed through improved memory handling. CVE-ID CVE-2016-1847 : Tongbo Luo and Bo Qu of Palo Alto Networks

QuickTime Available for: OS X El Capitan v10.11 and later Impact: Opening a maliciously crafted file may lead to unexpected application termination or arbitrary code execution Description: A memory corruption issue was addressed through improved memory handling. CVE-ID CVE-2016-1848 : Francis Provencher from COSIG

SceneKit Available for: OS X El Capitan v10.11 and later Impact: Opening a maliciously crafted file may lead to unexpected application termination or arbitrary code execution Description: A memory corruption issue was addressed through improved memory handling. CVE-ID CVE-2016-1850 : Tyler Bohan of Cisco Talos

Screen Lock Available for: OS X El Capitan v10.11 and later Impact: A person with physical access to a computer may be able to reset an expired password from the lock screen Description: An issue existed in the management of password profiles. This issue was addressed through improved password reset handling. CVE-ID CVE-2016-1851 : an anonymous researcher

Tcl Available for: OS X El Capitan v10.11 and later Impact: An attacker in a privileged network position may be able to leak sensitive user information Description: A protocol security issue was addressed by disabling SSLv2. CVE-ID CVE-2016-1853 : researchers at Tel Aviv University, Münster University of Applied Sciences, Ruhr University Bochum, the University of Pennsylvania, the Hashcat project, the University of Michigan, Two Sigma, Google, and the OpenSSL project: Nimrod Aviram, Sebastian Schinzel, Juraj Somorovsky, Nadia Heninger, Maik Dankel, Jens Steube, Luke Valenta, David Adrian, J. Alex Halderman, Viktor Dukhovni, Emilia Käsper, Shaanan Cohney, Susanne Engels, Christof Paar, and Yuval Shavitt

Note: OS X El Capitan 10.11.5 includes the security content of Safari 9.1.1. For further details see https://support.apple.com/en-us/HT206565

OS X El Capitan 10.11.5 and Security Update 2016-003 may be obtained from the Mac App Store or Apple's Software Downloads web site: http://www.apple.com/support/downloads/

Information will also be posted to the Apple Security Updates web site: http://support.apple.com/kb/HT201222

This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Comment: GPGTools - https://gpgtools.org

iQIcBAEBCgAGBQJXOj0GAAoJEIOj74w0bLRGFp0QANQktsdXgOptLJWGqWXaDKmW HaY0fNyuXNLzGNH2GKQ1yXi2KjMqGnCuAwaS3Ku/4qx2Imq3X+BLLYrSOwttbAvQ yGdWaFo1ExK/WT4CI02QM7LDOZNXOyZq/ofQ4jXi/wDpuXXNV+I+RsMMUJL4Uon9 2fngj7FHXk4fvCYs9lahjv+wDGkpIcVDTU6Liqxmje2KQzShYJ8tYwwacsOSQKxk bmsUiA9q9zkGbbo7mo5WikQUO1XWaBLQiBejzJMyNEFGECtOc9B4+irTJgERTSHb igd2875EmH/sNI6WkEQNZwpMfdKBhNI/W9e/DhZVSwAydK6xt8yr0vd5ZF/M8jCU CWGzoOQI1snlr862Ccx7H+db8umu1UmDMUjz1To+hqCEhnvMW2/oRvrKtk2Q65Pu STqixhDl0HEamvX/72r7LNsZHjzmoGoKjpwjnGf0phZgSBP1bWKmhp9748Rcb12a LzwRy7KJ20W8XGGiMeqKoe4bFaBK6iBJok4+ZpROadGrxtjVumtqbZ5CrY1Hp8/F I4VMuReDqG39G4yyDeAEr9JWRdmV285Z1zaxOgd2CsPblDfEWp9HiBpC8Agd1p9x Mf/EDssinL1K7dQQPIXgGUE5S6Z2DzGEeKvHzm8kLxl0OfwntATY/mf7TM0nj4JY YyNMZcKPuYVmF3b2PAfb =P+17 -----END PGP SIGNATURE----- .

Background

file is a utility that guesses a file format by scanning binary data for patterns.

Gentoo Linux Security Advisory GLSA 201611-22

                                       https://security.gentoo.org/

Severity: Normal Title: PHP: Multiple vulnerabilities Date: November 30, 2016 Bugs: #578734, #581834, #584204, #587246, #591710, #594498, #597586, #599326 ID: 201611-22

Synopsis

Multiple vulnerabilities have been found in PHP, the worst of which could lead to arbitrary code execution or cause a Denial of Service condition.

Background

PHP is a widely-used general-purpose scripting language that is especially suited for Web development and can be embedded into HTML. Please review the CVE identifiers referenced below for details.

Workaround

There is no known workaround at this time.

Resolution

All PHP users should upgrade to the latest version:

# emerge --sync # emerge --ask --oneshot --verbose ">=dev=lang/php-5.6.28"

References

[ 1 ] CVE-2015-8865 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-8865 [ 2 ] CVE-2016-3074 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-3074 [ 3 ] CVE-2016-4071 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4071 [ 4 ] CVE-2016-4072 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4072 [ 5 ] CVE-2016-4073 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4073 [ 6 ] CVE-2016-4537 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4537 [ 7 ] CVE-2016-4538 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4538 [ 8 ] CVE-2016-4539 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4539 [ 9 ] CVE-2016-4540 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4540 [ 10 ] CVE-2016-4541 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4541 [ 11 ] CVE-2016-4542 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4542 [ 12 ] CVE-2016-4543 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4543 [ 13 ] CVE-2016-4544 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4544 [ 14 ] CVE-2016-5385 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-5385 [ 15 ] CVE-2016-6289 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6289 [ 16 ] CVE-2016-6290 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6290 [ 17 ] CVE-2016-6291 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6291 [ 18 ] CVE-2016-6292 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6292 [ 19 ] CVE-2016-6294 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6294 [ 20 ] CVE-2016-6295 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6295 [ 21 ] CVE-2016-6296 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6296 [ 22 ] CVE-2016-6297 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6297 [ 23 ] CVE-2016-7124 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-7124 [ 24 ] CVE-2016-7125 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-7125 [ 25 ] CVE-2016-7126 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-7126 [ 26 ] CVE-2016-7127 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-7127 [ 27 ] CVE-2016-7128 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-7128 [ 28 ] CVE-2016-7129 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-7129 [ 29 ] CVE-2016-7130 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-7130 [ 30 ] CVE-2016-7131 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-7131 [ 31 ] CVE-2016-7132 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-7132 [ 32 ] CVE-2016-7133 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-7133 [ 33 ] CVE-2016-7134 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-7134 [ 34 ] CVE-2016-7411 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-7411 [ 35 ] CVE-2016-7412 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-7412 [ 36 ] CVE-2016-7413 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-7413 [ 37 ] CVE-2016-7414 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-7414 [ 38 ] CVE-2016-7416 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-7416 [ 39 ] CVE-2016-7417 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-7417 [ 40 ] CVE-2016-7418 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-7418

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website:

https://security.gentoo.org/glsa/201611-22

Concerns?

Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.

License

The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license.

http://creativecommons.org/licenses/by-sa/2.5

. ========================================================================== Ubuntu Security Notice USN-3686-1 June 14, 2018

file vulnerabilities

A security issue affects these releases of Ubuntu and its derivatives:

Ubuntu 18.04 LTS
Ubuntu 17.10
Ubuntu 16.04 LTS
Ubuntu 14.04 LTS

Summary:

Several security issues were fixed in file.

Software Description: - file: Tool to determine file types

Details:

Alexander Cherepanov discovered that file incorrectly handled a large number of notes. An attacker could use this issue to cause a denial of service. This issue only affected Ubuntu 14.04 LTS. (CVE-2014-9620)

Alexander Cherepanov discovered that file incorrectly handled certain long strings. An attacker could use this issue to cause a denial of service. This issue only affected Ubuntu 14.04 LTS. (CVE-2014-9620)

Alexander Cherepanov discovered that file incorrectly handled certain malformed ELF files. This issue only affected Ubuntu 14.04 LTS. (CVE-2014-9653)

It was discovered that file incorrectly handled certain magic files. This issue only affected Ubuntu 14.04 LTS. (CVE-2015-8865)

It was discovered that file incorrectly handled certain malformed ELF files. An attacker could use this issue to cause a denial of service. (CVE-2018-10360)

Update instructions:

The problem can be corrected by updating your system to the following package versions:

Ubuntu 18.04 LTS: file 1:5.32-2ubuntu0.1 libmagic1 1:5.32-2ubuntu0.1

Ubuntu 17.10: file 1:5.32-1ubuntu0.1 libmagic1 1:5.32-1ubuntu0.1

Ubuntu 16.04 LTS: file 1:5.25-2ubuntu1.1 libmagic1 1:5.25-2ubuntu1.1

Ubuntu 14.04 LTS: file 1:5.14-2ubuntu3.4 libmagic1 1:5.14-2ubuntu3.4

In general, a standard system update will make all the necessary changes

Show details on source website

JSON

To clipboard

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201605-0133",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "php",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "php",
        "version": "7.0.3"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "php",
        "version": "5.6.19"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "php",
        "version": "5.6.18"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "php",
        "version": "5.6.17"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "php",
        "version": "5.6.13"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "php",
        "version": "5.6.12"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "php",
        "version": "5.6.11"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "php",
        "version": "5.6.5"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "php",
        "version": "5.6.4"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "php",
        "version": "5.6.1"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "php",
        "version": "7.0.4"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "php",
        "version": "7.0.2"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "php",
        "version": "7.0.1"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "php",
        "version": "5.6.9"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "php",
        "version": "5.6.8"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "php",
        "version": "5.6.7"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "php",
        "version": "5.6.6"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "php",
        "version": "5.6.3"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "php",
        "version": "5.6.2"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "php",
        "version": "5.6.14"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "php",
        "version": "5.6.10"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "php",
        "version": "5.6.16"
      },
      {
        "model": "mac os x",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "apple",
        "version": "10.11.4"
      },
      {
        "model": "php",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "php",
        "version": "5.5.33"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "php",
        "version": "5.6.15"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "php",
        "version": "5.6.0"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "php",
        "version": "7.0.0"
      },
      {
        "model": "mac os x",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "apple",
        "version": "10.11.4"
      },
      {
        "model": "linux lts",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ubuntu",
        "version": "16.04"
      },
      {
        "model": "linux",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ubuntu",
        "version": "15.10"
      },
      {
        "model": "linux lts",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ubuntu",
        "version": "14.04"
      },
      {
        "model": "linux lts",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ubuntu",
        "version": "12.04"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "7.0"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.5.33"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.5.32"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.5.29"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.5.28"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.5.27"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.5.26"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.5.21"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.5.14"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.5.13"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.5.12"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.5.11"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.5.10"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.5.6"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.5.5"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.5.4"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.5.3"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.5.1"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.5"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.4.45"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.4.44"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.4.43"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.4.37"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.4.30"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.4.29"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.4.26"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.4.25"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.4.17"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.4.14"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.4.8"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.4.7"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.4.6"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.4.4"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.4.3"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.4.2"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.4.1"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.3.29"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.3.28"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.3.24"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.3.23"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.3.22"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.3.21"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.3.20"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.3.17"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.3.16"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.3.14"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.3.13"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.3.12"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.3.9"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.3.8"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.3.7"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.3.6"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.3.5"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.3.2"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.3.1"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.3"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.2.17"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.2.16"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.2.15"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.2.13"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.2.12"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.2.11"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.2.10"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.2.9"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.2.8"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.2.7"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.2.6"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.2.5"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.2.4"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.2.3"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.2.2"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.2.1"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.1.6"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.1.5"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.1.4"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.1.3"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.1.2"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.1.1"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.1"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.0.5"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.0.4"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.0.3"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.0.2"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.0.1"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.6"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.5.9"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.5.8"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.5.7"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.5.31"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.5.30"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.5.25"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.5.24"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.5.23"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.5.22"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.5.2"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.5.19"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.5.18"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.5.17"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.5.16"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.5.15"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.4.9"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.4.5"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.4.42"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.4.41"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.4.39"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.4.38"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.4.36"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.4.35"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.4.34"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.4.33"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.4.32"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.4.31"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.4.28"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.4.27"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.4.24"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.4.23"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.4.22"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.4.21"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.4.20"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.4.19"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.4.18"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.4.16"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.4.15"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.4.13"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.4.12"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.4.11"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.4.10"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.3.4"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.3.3"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.3.27"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.3.26"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.3.25"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.3.19"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.3.18"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.3.15"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.3.11"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.3.10"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.2.17.03"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.2.14"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.2"
      },
      {
        "model": "php",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.1.43"
      },
      {
        "model": "linux",
        "scope": null,
        "trust": 0.3,
        "vendor": "gentoo",
        "version": null
      },
      {
        "model": "linux sparc",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "debian",
        "version": "6.0"
      },
      {
        "model": "linux s/390",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "debian",
        "version": "6.0"
      },
      {
        "model": "linux powerpc",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "debian",
        "version": "6.0"
      },
      {
        "model": "linux mips",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "debian",
        "version": "6.0"
      },
      {
        "model": "linux ia-64",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "debian",
        "version": "6.0"
      },
      {
        "model": "linux ia-32",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "debian",
        "version": "6.0"
      },
      {
        "model": "linux arm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "debian",
        "version": "6.0"
      },
      {
        "model": "linux amd64",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "debian",
        "version": "6.0"
      },
      {
        "model": "mac os security update",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "x2016-0020"
      },
      {
        "model": "mac os",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "x10.11.3"
      },
      {
        "model": "mac os",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "x10.11.2"
      },
      {
        "model": "mac os",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "x10.11.1"
      },
      {
        "model": "mac os",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "x10.11.4"
      },
      {
        "model": "mac os",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "x10.11"
      },
      {
        "model": "php",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "php",
        "version": "7.0.5"
      },
      {
        "model": "php",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.6.20"
      },
      {
        "model": "php",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "php",
        "version": "5.5.34"
      },
      {
        "model": "mac os security update",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "apple",
        "version": "x2016-0030"
      },
      {
        "model": "mac os",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "apple",
        "version": "x10.11.5"
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "85802"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201604-556"
      },
      {
        "db": "NVD",
        "id": "CVE-2015-8865"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Hugh Davenport",
    "sources": [
      {
        "db": "BID",
        "id": "85802"
      }
    ],
    "trust": 0.3
  },
  "cve": "CVE-2015-8865",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "nvd@nist.gov",
            "availabilityImpact": "PARTIAL",
            "baseScore": 7.5,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 10.0,
            "id": "CVE-2015-8865",
            "impactScore": 6.4,
            "integrityImpact": "PARTIAL",
            "severity": "HIGH",
            "trust": 1.1,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "VULHUB",
            "availabilityImpact": "PARTIAL",
            "baseScore": 7.5,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 10.0,
            "id": "VHN-86826",
            "impactScore": 6.4,
            "integrityImpact": "PARTIAL",
            "severity": "HIGH",
            "trust": 0.1,
            "vectorString": "AV:N/AC:L/AU:N/C:P/I:P/A:P",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "author": "nvd@nist.gov",
            "availabilityImpact": "HIGH",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "exploitabilityScore": 1.3,
            "id": "CVE-2015-8865",
            "impactScore": 5.9,
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "trust": 1.0,
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2015-8865",
            "trust": 1.0,
            "value": "HIGH"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201604-556",
            "trust": 0.6,
            "value": "HIGH"
          },
          {
            "author": "VULHUB",
            "id": "VHN-86826",
            "trust": 0.1,
            "value": "HIGH"
          },
          {
            "author": "VULMON",
            "id": "CVE-2015-8865",
            "trust": 0.1,
            "value": "HIGH"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-86826"
      },
      {
        "db": "VULMON",
        "id": "CVE-2015-8865"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201604-556"
      },
      {
        "db": "NVD",
        "id": "CVE-2015-8865"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "The file_check_mem function in funcs.c in file before 5.23, as used in the Fileinfo component in PHP before 5.5.34, 5.6.x before 5.6.20, and 7.x before 7.0.5, mishandles continuation-level jumps, which allows context-dependent attackers to cause a denial of service (buffer overflow and application crash) or possibly execute arbitrary code via a crafted magic file. PHP is prone to a denial-of-service vulnerability. \nSuccessful exploits may allow the attacker to crash the affected application resulting in denial-of-service condition. PHP (PHP: Hypertext Preprocessor, PHP: Hypertext Preprocessor) is an open source general-purpose computer scripting language jointly maintained by the PHP Group and the open source community; Fileinfo is one of them used to display file attributes and support batch modification of its Components of properties. The vulnerability stems from the fact that the program does not correctly handle continuation-level jumps. The following versions are affected: PHP prior to 5.5.34, 5.6.x prior to 5.6.20, 7.x prior to 7.0.5, and prior to file 5.23. This update provides\nthe corresponding update for Ubuntu 12.04 ESM. \n-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA1\n\n=====================================================================\n                   Red Hat Security Advisory\n\nSynopsis:          Moderate: rh-php56 security, bug fix, and enhancement update\nAdvisory ID:       RHSA-2016:2750-01\nProduct:           Red Hat Software Collections\nAdvisory URL:      https://rhn.redhat.com/errata/RHSA-2016-2750.html\nIssue date:        2016-11-15\nCVE Names:         CVE-2013-7456 CVE-2014-9767 CVE-2015-2325 \n                   CVE-2015-2326 CVE-2015-2327 CVE-2015-2328 \n                   CVE-2015-3210 CVE-2015-3217 CVE-2015-5073 \n                   CVE-2015-8381 CVE-2015-8383 CVE-2015-8384 \n                   CVE-2015-8385 CVE-2015-8386 CVE-2015-8388 \n                   CVE-2015-8391 CVE-2015-8392 CVE-2015-8395 \n                   CVE-2015-8835 CVE-2015-8865 CVE-2015-8866 \n                   CVE-2015-8867 CVE-2015-8873 CVE-2015-8874 \n                   CVE-2015-8876 CVE-2015-8877 CVE-2015-8879 \n                   CVE-2016-1903 CVE-2016-2554 CVE-2016-3074 \n                   CVE-2016-3141 CVE-2016-3142 CVE-2016-4070 \n                   CVE-2016-4071 CVE-2016-4072 CVE-2016-4073 \n                   CVE-2016-4342 CVE-2016-4343 CVE-2016-4473 \n                   CVE-2016-4537 CVE-2016-4538 CVE-2016-4539 \n                   CVE-2016-4540 CVE-2016-4541 CVE-2016-4542 \n                   CVE-2016-4543 CVE-2016-4544 CVE-2016-5093 \n                   CVE-2016-5094 CVE-2016-5096 CVE-2016-5114 \n                   CVE-2016-5399 CVE-2016-5766 CVE-2016-5767 \n                   CVE-2016-5768 CVE-2016-5770 CVE-2016-5771 \n                   CVE-2016-5772 CVE-2016-5773 CVE-2016-6128 \n                   CVE-2016-6207 CVE-2016-6288 CVE-2016-6289 \n                   CVE-2016-6290 CVE-2016-6291 CVE-2016-6292 \n                   CVE-2016-6294 CVE-2016-6295 CVE-2016-6296 \n                   CVE-2016-6297 CVE-2016-7124 CVE-2016-7125 \n                   CVE-2016-7126 CVE-2016-7127 CVE-2016-7128 \n                   CVE-2016-7129 CVE-2016-7130 CVE-2016-7131 \n                   CVE-2016-7132 \n=====================================================================\n\n1. Summary:\n\nAn update for rh-php56, rh-php56-php, and rh-php56-php-pear is now\navailable for Red Hat Software Collections. \n\nRed Hat Product Security has rated this update as having a security impact\nof Moderate. A Common Vulnerability Scoring System (CVSS) base score, which\ngives a detailed severity rating, is available for each vulnerability from\nthe CVE link(s) in the References section. \n\n2. Relevant releases/architectures:\n\nRed Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) - noarch, x86_64\nRed Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) - noarch, x86_64\nRed Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7) - noarch, x86_64\nRed Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2) - noarch, x86_64\nRed Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3) - noarch, x86_64\nRed Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) - noarch, x86_64\nRed Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) - noarch, x86_64\n\n3. Description:\n\nPHP is an HTML-embedded scripting language commonly used with the Apache\nHTTP Server. The rh-php56 packages provide a recent stable release of PHP\nwith PEAR 1.9.5 and enhanced language features including constant\nexpressions, variadic functions, arguments unpacking, and the interactive\ndebuger. The memcache, mongo, and XDebug extensions are also included. \n\nThe rh-php56 Software Collection has been upgraded to version 5.6.25, which\nprovides a number of bug fixes and enhancements over the previous version. \n(BZ#1356157, BZ#1365401)\n\nSecurity Fixes in the rh-php56-php component:\n\n* Several Moderate and Low impact security issues were found in PHP. Space precludes documenting each of these issues in this\nadvisory. Refer to the CVE links in the References section for a\ndescription of each of these vulnerabilities. (CVE-2013-7456,\nCVE-2014-9767, CVE-2015-8835, CVE-2015-8865, CVE-2015-8866, CVE-2015-8867,\nCVE-2015-8873, CVE-2015-8874, CVE-2015-8876, CVE-2015-8877, CVE-2015-8879,\nCVE-2016-1903, CVE-2016-2554, CVE-2016-3074, CVE-2016-3141, CVE-2016-3142,\nCVE-2016-4070, CVE-2016-4071, CVE-2016-4072, CVE-2016-4073, CVE-2016-4342,\nCVE-2016-4343, CVE-2016-4473, CVE-2016-4537, CVE-2016-4538, CVE-2016-4539,\nCVE-2016-4540, CVE-2016-4541, CVE-2016-4542, CVE-2016-4543, CVE-2016-4544,\nCVE-2016-5093, CVE-2016-5094, CVE-2016-5096, CVE-2016-5114, CVE-2016-5399,\nCVE-2016-5766, CVE-2016-5767, CVE-2016-5768, CVE-2016-5770, CVE-2016-5771,\nCVE-2016-5772, CVE-2016-5773, CVE-2016-6128, CVE-2016-6207, CVE-2016-6288,\nCVE-2016-6289, CVE-2016-6290, CVE-2016-6291, CVE-2016-6292, CVE-2016-6294,\nCVE-2016-6295, CVE-2016-6296, CVE-2016-6297, CVE-2016-7124, CVE-2016-7125,\nCVE-2016-7126, CVE-2016-7127, CVE-2016-7128, CVE-2016-7129, CVE-2016-7130,\nCVE-2016-7131, CVE-2016-7132)\n\n* Multiple flaws were found in the PCRE library included with the\nrh-php56-php packages for Red Hat Enterprise Linux 6. (CVE-2015-2325, CVE-2015-2326, CVE-2015-2327, CVE-2015-2328,\nCVE-2015-3210, CVE-2015-3217, CVE-2015-5073, CVE-2015-8381, CVE-2015-8383,\nCVE-2015-8384, CVE-2015-8385, CVE-2015-8386, CVE-2015-8388, CVE-2015-8391,\nCVE-2015-8392, CVE-2015-8395)\n\nRed Hat would like to thank Hans Jerry Illikainen for reporting\nCVE-2016-3074, CVE-2016-4473, and CVE-2016-5399. \n\n4. Solution:\n\nFor details on how to apply this update, which includes the changes\ndescribed in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the updated packages, the httpd daemon must be restarted\nfor the update to take effect. \n\n5. Bugs fixed (https://bugzilla.redhat.com/):\n\n1207198 - CVE-2015-2325 pcre: heap buffer overflow in compile_branch()\n1207202 - CVE-2015-2326 pcre: heap buffer over-read in pcre_compile2() (8.37/23)\n1228283 - CVE-2015-3217 pcre: stack overflow caused by mishandled group empty match (8.38/11)\n1237223 - CVE-2015-5073 CVE-2015-8388 pcre: buffer overflow for forward reference within backward assertion with excess closing parenthesis (8.38/18)\n1260716 - CVE-2014-9767 php: ZipArchive::extractTo allows for directory traversal when creating directories\n1285399 - CVE-2015-2328 pcre: infinite recursion compiling pattern with recursive reference in a group with indefinite repeat (8.36/20)\n1285408 - CVE-2015-2327 pcre: infinite recursion compiling pattern with zero-repeated groups that include recursive back reference (8.36/19)\n1287614 - CVE-2015-8383 pcre: Buffer overflow caused by repeated conditional group (8.38/3)\n1287623 - CVE-2015-3210 CVE-2015-8384 pcre: buffer overflow caused by recursive back reference by name within certain group (8.38/4)\n1287629 - CVE-2015-8385 pcre: buffer overflow caused by named forward reference to duplicate group number (8.38/30)\n1287636 - CVE-2015-8386 pcre: Buffer overflow caused by lookbehind assertion (8.38/6)\n1287671 - CVE-2015-8391 pcre: inefficient posix character class syntax check (8.38/16)\n1287690 - CVE-2015-8392 pcre: buffer overflow caused by patterns with duplicated named groups with (?| (8.38/27)\n1287711 - CVE-2015-8381 CVE-2015-8395 pcre: Buffer overflow caused by duplicate named references (8.38/36)\n1297710 - CVE-2016-5114 php: out-of-bounds write in fpm_log.c\n1297717 - CVE-2016-1903 php: Out-of-bounds memory read via gdImageRotateInterpolated\n1305536 - CVE-2016-4342 php: use of uninitialized pointer in PharFileInfo::getContent\n1305543 - CVE-2016-2554 php: buffer overflow in handling of long link names in tar phar archives\n1315312 - CVE-2016-3142 php: Out-of-bounds read in phar_parse_zipfile()\n1315328 - CVE-2016-3141 php: Use after free in WDDX Deserialize when processing XML data\n1321893 - CVE-2016-3074 php: Signedness vulnerability causing heap overflow in libgd\n1323074 - CVE-2015-8835 php: type confusion issue in Soap Client call() method\n1323103 - CVE-2016-4073 php: Negative size parameter in memcpy\n1323106 - CVE-2016-4072 php: Invalid memory write in phar on filename containing \\0 inside name\n1323108 - CVE-2016-4071 php: Format string vulnerability in php_snmp_error()\n1323114 - CVE-2016-4070 php: Integer overflow in php_raw_url_encode\n1323118 - CVE-2015-8865 file: Buffer over-write in finfo_open with malformed magic file\n1330418 - CVE-2015-8866 php: libxml_disable_entity_loader setting is shared between threads\n1330420 - CVE-2015-8867 php: openssl_random_pseudo_bytes() is not cryptographically secure\n1332454 - CVE-2016-4343 php: Uninitialized pointer in phar_make_dirstream()\n1332860 - CVE-2016-4537 CVE-2016-4538 php: bcpowmod accepts negative scale causing heap buffer overflow corrupting _one_ definition\n1332865 - CVE-2016-4542 CVE-2016-4543 CVE-2016-4544 php: Out-of-bounds heap memory read in exif_read_data() caused by malformed input\n1332872 - CVE-2016-4540 CVE-2016-4541 php: OOB read in grapheme_stripos and grapheme_strpos when negative offset is used\n1332877 - CVE-2016-4539 php: xml_parse_into_struct() can crash when XML parser is re-used\n1336772 - CVE-2015-8874 gd: gdImageFillToBorder deep recursion leading to stack overflow\n1336775 - CVE-2015-8873 php: Stack consumption vulnerability in Zend/zend_exceptions.c\n1338896 - CVE-2015-8876 php: Zend/zend_exceptions.c does not validate certain Exception objects\n1338907 - CVE-2015-8877 gd: gdImageScaleTwoPass function in gd_interpolation.c uses inconsistent allocate and free approaches\n1338912 - CVE-2015-8879 php: odbc_bindcols function mishandles driver behavior for SQL_WVARCHAR columns\n1339590 - CVE-2016-5093 php: improper nul termination leading to out-of-bounds read in get_icu_value_internal\n1339949 - CVE-2016-5096 php: Integer underflow causing arbitrary null write in fread/gzread\n1340433 - CVE-2013-7456 gd: incorrect boundary adjustment in _gdContributionsCalc\n1340738 - CVE-2016-5094 php: Integer overflow in php_html_entities()\n1347772 - CVE-2016-4473 php: Invalid free() instead of efree() in phar_extract_file()\n1351068 - CVE-2016-5766 gd: Integer Overflow in _gd2GetHeader() resulting in heap overflow\n1351069 - CVE-2016-5767 gd: Integer Overflow in gdImagePaletteToTrueColor() resulting in heap overflow\n1351168 - CVE-2016-5768 php: Double free in _php_mb_regex_ereg_replace_exec\n1351171 - CVE-2016-5770 php: Int/size_t confusion in SplFileObject::fread\n1351173 - CVE-2016-5771 php: Use After Free Vulnerability in PHP\u0027s GC algorithm and unserialize\n1351175 - CVE-2016-5772 php: Double Free Corruption in wddx_deserialize\n1351179 - CVE-2016-5773 php: ZipArchive class Use After Free Vulnerability in PHP\u0027s GC algorithm and unserialize\n1351603 - CVE-2016-6128 gd: Invalid color index not properly handled\n1358395 - CVE-2016-5399 php: Improper error handling in bzread()\n1359698 - CVE-2016-6289 php: Integer overflow leads to buffer overflow in virtual_file_ex\n1359710 - CVE-2016-6290 php: Use after free in unserialize() with Unexpected Session Deserialization\n1359718 - CVE-2016-6291 php: Out-of-bounds access in exif_process_IFD_in_MAKERNOTE\n1359756 - CVE-2016-6292 php: Null pointer dereference in exif_process_user_comment\n1359800 - CVE-2016-6207 php,gd: Integer overflow error within _gdContributionsAlloc()\n1359811 - CVE-2016-6294 php: Out-of-bounds access in locale_accept_from_http\n1359815 - CVE-2016-6295 php: Use after free in SNMP with GC and unserialize()\n1359822 - CVE-2016-6296 php: Heap buffer overflow vulnerability in simplestring_addn in simplestring.c\n1359828 - CVE-2016-6297 php: Stack-based buffer overflow vulnerability in php_stream_zip_opener\n1360322 - CVE-2016-6288 php: Buffer over-read in php_url_parse_ex\n1374697 - CVE-2016-7124 php: bypass __wakeup() in deserialization of an unexpected object\n1374698 - CVE-2016-7125 php: Session Data Injection Vulnerability\n1374699 - CVE-2016-7126 php: select_colors write out-of-bounds\n1374701 - CVE-2016-7127 php: imagegammacorrect allows arbitrary write access\n1374704 - CVE-2016-7128 php: Memory Leakage In exif_process_IFD_in_TIFF\n1374705 - CVE-2016-7129 php: wddx_deserialize allows illegal memory access\n1374707 - CVE-2016-7130 php: wddx_deserialize null dereference\n1374708 - CVE-2016-7131 php: wddx_deserialize null dereference with invalid xml\n1374711 - CVE-2016-7132 php: wddx_deserialize null dereference in php_wddx_pop_element\n\n6. Package List:\n\nRed Hat Software Collections for Red Hat Enterprise Linux Server (v. 6):\n\nSource:\nrh-php56-2.3-1.el6.src.rpm\nrh-php56-php-5.6.25-1.el6.src.rpm\nrh-php56-php-pear-1.9.5-4.el6.src.rpm\n\nnoarch:\nrh-php56-php-pear-1.9.5-4.el6.noarch.rpm\n\nx86_64:\nrh-php56-2.3-1.el6.x86_64.rpm\nrh-php56-php-5.6.25-1.el6.x86_64.rpm\nrh-php56-php-bcmath-5.6.25-1.el6.x86_64.rpm\nrh-php56-php-cli-5.6.25-1.el6.x86_64.rpm\nrh-php56-php-common-5.6.25-1.el6.x86_64.rpm\nrh-php56-php-dba-5.6.25-1.el6.x86_64.rpm\nrh-php56-php-dbg-5.6.25-1.el6.x86_64.rpm\nrh-php56-php-debuginfo-5.6.25-1.el6.x86_64.rpm\nrh-php56-php-devel-5.6.25-1.el6.x86_64.rpm\nrh-php56-php-embedded-5.6.25-1.el6.x86_64.rpm\nrh-php56-php-enchant-5.6.25-1.el6.x86_64.rpm\nrh-php56-php-fpm-5.6.25-1.el6.x86_64.rpm\nrh-php56-php-gd-5.6.25-1.el6.x86_64.rpm\nrh-php56-php-gmp-5.6.25-1.el6.x86_64.rpm\nrh-php56-php-imap-5.6.25-1.el6.x86_64.rpm\nrh-php56-php-intl-5.6.25-1.el6.x86_64.rpm\nrh-php56-php-ldap-5.6.25-1.el6.x86_64.rpm\nrh-php56-php-mbstring-5.6.25-1.el6.x86_64.rpm\nrh-php56-php-mysqlnd-5.6.25-1.el6.x86_64.rpm\nrh-php56-php-odbc-5.6.25-1.el6.x86_64.rpm\nrh-php56-php-opcache-5.6.25-1.el6.x86_64.rpm\nrh-php56-php-pdo-5.6.25-1.el6.x86_64.rpm\nrh-php56-php-pgsql-5.6.25-1.el6.x86_64.rpm\nrh-php56-php-process-5.6.25-1.el6.x86_64.rpm\nrh-php56-php-pspell-5.6.25-1.el6.x86_64.rpm\nrh-php56-php-recode-5.6.25-1.el6.x86_64.rpm\nrh-php56-php-snmp-5.6.25-1.el6.x86_64.rpm\nrh-php56-php-soap-5.6.25-1.el6.x86_64.rpm\nrh-php56-php-tidy-5.6.25-1.el6.x86_64.rpm\nrh-php56-php-xml-5.6.25-1.el6.x86_64.rpm\nrh-php56-php-xmlrpc-5.6.25-1.el6.x86_64.rpm\nrh-php56-runtime-2.3-1.el6.x86_64.rpm\nrh-php56-scldevel-2.3-1.el6.x86_64.rpm\n\nRed Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7):\n\nSource:\nrh-php56-2.3-1.el6.src.rpm\nrh-php56-php-5.6.25-1.el6.src.rpm\nrh-php56-php-pear-1.9.5-4.el6.src.rpm\n\nnoarch:\nrh-php56-php-pear-1.9.5-4.el6.noarch.rpm\n\nx86_64:\nrh-php56-2.3-1.el6.x86_64.rpm\nrh-php56-php-5.6.25-1.el6.x86_64.rpm\nrh-php56-php-bcmath-5.6.25-1.el6.x86_64.rpm\nrh-php56-php-cli-5.6.25-1.el6.x86_64.rpm\nrh-php56-php-common-5.6.25-1.el6.x86_64.rpm\nrh-php56-php-dba-5.6.25-1.el6.x86_64.rpm\nrh-php56-php-dbg-5.6.25-1.el6.x86_64.rpm\nrh-php56-php-debuginfo-5.6.25-1.el6.x86_64.rpm\nrh-php56-php-devel-5.6.25-1.el6.x86_64.rpm\nrh-php56-php-embedded-5.6.25-1.el6.x86_64.rpm\nrh-php56-php-enchant-5.6.25-1.el6.x86_64.rpm\nrh-php56-php-fpm-5.6.25-1.el6.x86_64.rpm\nrh-php56-php-gd-5.6.25-1.el6.x86_64.rpm\nrh-php56-php-gmp-5.6.25-1.el6.x86_64.rpm\nrh-php56-php-imap-5.6.25-1.el6.x86_64.rpm\nrh-php56-php-intl-5.6.25-1.el6.x86_64.rpm\nrh-php56-php-ldap-5.6.25-1.el6.x86_64.rpm\nrh-php56-php-mbstring-5.6.25-1.el6.x86_64.rpm\nrh-php56-php-mysqlnd-5.6.25-1.el6.x86_64.rpm\nrh-php56-php-odbc-5.6.25-1.el6.x86_64.rpm\nrh-php56-php-opcache-5.6.25-1.el6.x86_64.rpm\nrh-php56-php-pdo-5.6.25-1.el6.x86_64.rpm\nrh-php56-php-pgsql-5.6.25-1.el6.x86_64.rpm\nrh-php56-php-process-5.6.25-1.el6.x86_64.rpm\nrh-php56-php-pspell-5.6.25-1.el6.x86_64.rpm\nrh-php56-php-recode-5.6.25-1.el6.x86_64.rpm\nrh-php56-php-snmp-5.6.25-1.el6.x86_64.rpm\nrh-php56-php-soap-5.6.25-1.el6.x86_64.rpm\nrh-php56-php-tidy-5.6.25-1.el6.x86_64.rpm\nrh-php56-php-xml-5.6.25-1.el6.x86_64.rpm\nrh-php56-php-xmlrpc-5.6.25-1.el6.x86_64.rpm\nrh-php56-runtime-2.3-1.el6.x86_64.rpm\nrh-php56-scldevel-2.3-1.el6.x86_64.rpm\n\nRed Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6):\n\nSource:\nrh-php56-2.3-1.el6.src.rpm\nrh-php56-php-5.6.25-1.el6.src.rpm\nrh-php56-php-pear-1.9.5-4.el6.src.rpm\n\nnoarch:\nrh-php56-php-pear-1.9.5-4.el6.noarch.rpm\n\nx86_64:\nrh-php56-2.3-1.el6.x86_64.rpm\nrh-php56-php-5.6.25-1.el6.x86_64.rpm\nrh-php56-php-bcmath-5.6.25-1.el6.x86_64.rpm\nrh-php56-php-cli-5.6.25-1.el6.x86_64.rpm\nrh-php56-php-common-5.6.25-1.el6.x86_64.rpm\nrh-php56-php-dba-5.6.25-1.el6.x86_64.rpm\nrh-php56-php-dbg-5.6.25-1.el6.x86_64.rpm\nrh-php56-php-debuginfo-5.6.25-1.el6.x86_64.rpm\nrh-php56-php-devel-5.6.25-1.el6.x86_64.rpm\nrh-php56-php-embedded-5.6.25-1.el6.x86_64.rpm\nrh-php56-php-enchant-5.6.25-1.el6.x86_64.rpm\nrh-php56-php-fpm-5.6.25-1.el6.x86_64.rpm\nrh-php56-php-gd-5.6.25-1.el6.x86_64.rpm\nrh-php56-php-gmp-5.6.25-1.el6.x86_64.rpm\nrh-php56-php-imap-5.6.25-1.el6.x86_64.rpm\nrh-php56-php-intl-5.6.25-1.el6.x86_64.rpm\nrh-php56-php-ldap-5.6.25-1.el6.x86_64.rpm\nrh-php56-php-mbstring-5.6.25-1.el6.x86_64.rpm\nrh-php56-php-mysqlnd-5.6.25-1.el6.x86_64.rpm\nrh-php56-php-odbc-5.6.25-1.el6.x86_64.rpm\nrh-php56-php-opcache-5.6.25-1.el6.x86_64.rpm\nrh-php56-php-pdo-5.6.25-1.el6.x86_64.rpm\nrh-php56-php-pgsql-5.6.25-1.el6.x86_64.rpm\nrh-php56-php-process-5.6.25-1.el6.x86_64.rpm\nrh-php56-php-pspell-5.6.25-1.el6.x86_64.rpm\nrh-php56-php-recode-5.6.25-1.el6.x86_64.rpm\nrh-php56-php-snmp-5.6.25-1.el6.x86_64.rpm\nrh-php56-php-soap-5.6.25-1.el6.x86_64.rpm\nrh-php56-php-tidy-5.6.25-1.el6.x86_64.rpm\nrh-php56-php-xml-5.6.25-1.el6.x86_64.rpm\nrh-php56-php-xmlrpc-5.6.25-1.el6.x86_64.rpm\nrh-php56-runtime-2.3-1.el6.x86_64.rpm\nrh-php56-scldevel-2.3-1.el6.x86_64.rpm\n\nRed Hat Software Collections for Red Hat Enterprise Linux Server (v. 7):\n\nSource:\nrh-php56-2.3-1.el7.src.rpm\nrh-php56-php-5.6.25-1.el7.src.rpm\nrh-php56-php-pear-1.9.5-4.el7.src.rpm\n\nnoarch:\nrh-php56-php-pear-1.9.5-4.el7.noarch.rpm\n\nx86_64:\nrh-php56-2.3-1.el7.x86_64.rpm\nrh-php56-php-5.6.25-1.el7.x86_64.rpm\nrh-php56-php-bcmath-5.6.25-1.el7.x86_64.rpm\nrh-php56-php-cli-5.6.25-1.el7.x86_64.rpm\nrh-php56-php-common-5.6.25-1.el7.x86_64.rpm\nrh-php56-php-dba-5.6.25-1.el7.x86_64.rpm\nrh-php56-php-dbg-5.6.25-1.el7.x86_64.rpm\nrh-php56-php-debuginfo-5.6.25-1.el7.x86_64.rpm\nrh-php56-php-devel-5.6.25-1.el7.x86_64.rpm\nrh-php56-php-embedded-5.6.25-1.el7.x86_64.rpm\nrh-php56-php-enchant-5.6.25-1.el7.x86_64.rpm\nrh-php56-php-fpm-5.6.25-1.el7.x86_64.rpm\nrh-php56-php-gd-5.6.25-1.el7.x86_64.rpm\nrh-php56-php-gmp-5.6.25-1.el7.x86_64.rpm\nrh-php56-php-intl-5.6.25-1.el7.x86_64.rpm\nrh-php56-php-ldap-5.6.25-1.el7.x86_64.rpm\nrh-php56-php-mbstring-5.6.25-1.el7.x86_64.rpm\nrh-php56-php-mysqlnd-5.6.25-1.el7.x86_64.rpm\nrh-php56-php-odbc-5.6.25-1.el7.x86_64.rpm\nrh-php56-php-opcache-5.6.25-1.el7.x86_64.rpm\nrh-php56-php-pdo-5.6.25-1.el7.x86_64.rpm\nrh-php56-php-pgsql-5.6.25-1.el7.x86_64.rpm\nrh-php56-php-process-5.6.25-1.el7.x86_64.rpm\nrh-php56-php-pspell-5.6.25-1.el7.x86_64.rpm\nrh-php56-php-recode-5.6.25-1.el7.x86_64.rpm\nrh-php56-php-snmp-5.6.25-1.el7.x86_64.rpm\nrh-php56-php-soap-5.6.25-1.el7.x86_64.rpm\nrh-php56-php-xml-5.6.25-1.el7.x86_64.rpm\nrh-php56-php-xmlrpc-5.6.25-1.el7.x86_64.rpm\nrh-php56-runtime-2.3-1.el7.x86_64.rpm\nrh-php56-scldevel-2.3-1.el7.x86_64.rpm\n\nRed Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2):\n\nSource:\nrh-php56-2.3-1.el7.src.rpm\nrh-php56-php-5.6.25-1.el7.src.rpm\nrh-php56-php-pear-1.9.5-4.el7.src.rpm\n\nnoarch:\nrh-php56-php-pear-1.9.5-4.el7.noarch.rpm\n\nx86_64:\nrh-php56-2.3-1.el7.x86_64.rpm\nrh-php56-php-5.6.25-1.el7.x86_64.rpm\nrh-php56-php-bcmath-5.6.25-1.el7.x86_64.rpm\nrh-php56-php-cli-5.6.25-1.el7.x86_64.rpm\nrh-php56-php-common-5.6.25-1.el7.x86_64.rpm\nrh-php56-php-dba-5.6.25-1.el7.x86_64.rpm\nrh-php56-php-dbg-5.6.25-1.el7.x86_64.rpm\nrh-php56-php-debuginfo-5.6.25-1.el7.x86_64.rpm\nrh-php56-php-devel-5.6.25-1.el7.x86_64.rpm\nrh-php56-php-embedded-5.6.25-1.el7.x86_64.rpm\nrh-php56-php-enchant-5.6.25-1.el7.x86_64.rpm\nrh-php56-php-fpm-5.6.25-1.el7.x86_64.rpm\nrh-php56-php-gd-5.6.25-1.el7.x86_64.rpm\nrh-php56-php-gmp-5.6.25-1.el7.x86_64.rpm\nrh-php56-php-intl-5.6.25-1.el7.x86_64.rpm\nrh-php56-php-ldap-5.6.25-1.el7.x86_64.rpm\nrh-php56-php-mbstring-5.6.25-1.el7.x86_64.rpm\nrh-php56-php-mysqlnd-5.6.25-1.el7.x86_64.rpm\nrh-php56-php-odbc-5.6.25-1.el7.x86_64.rpm\nrh-php56-php-opcache-5.6.25-1.el7.x86_64.rpm\nrh-php56-php-pdo-5.6.25-1.el7.x86_64.rpm\nrh-php56-php-pgsql-5.6.25-1.el7.x86_64.rpm\nrh-php56-php-process-5.6.25-1.el7.x86_64.rpm\nrh-php56-php-pspell-5.6.25-1.el7.x86_64.rpm\nrh-php56-php-recode-5.6.25-1.el7.x86_64.rpm\nrh-php56-php-snmp-5.6.25-1.el7.x86_64.rpm\nrh-php56-php-soap-5.6.25-1.el7.x86_64.rpm\nrh-php56-php-xml-5.6.25-1.el7.x86_64.rpm\nrh-php56-php-xmlrpc-5.6.25-1.el7.x86_64.rpm\nrh-php56-runtime-2.3-1.el7.x86_64.rpm\nrh-php56-scldevel-2.3-1.el7.x86_64.rpm\n\nRed Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3):\n\nSource:\nrh-php56-2.3-1.el7.src.rpm\nrh-php56-php-5.6.25-1.el7.src.rpm\nrh-php56-php-pear-1.9.5-4.el7.src.rpm\n\nnoarch:\nrh-php56-php-pear-1.9.5-4.el7.noarch.rpm\n\nx86_64:\nrh-php56-2.3-1.el7.x86_64.rpm\nrh-php56-php-5.6.25-1.el7.x86_64.rpm\nrh-php56-php-bcmath-5.6.25-1.el7.x86_64.rpm\nrh-php56-php-cli-5.6.25-1.el7.x86_64.rpm\nrh-php56-php-common-5.6.25-1.el7.x86_64.rpm\nrh-php56-php-dba-5.6.25-1.el7.x86_64.rpm\nrh-php56-php-dbg-5.6.25-1.el7.x86_64.rpm\nrh-php56-php-debuginfo-5.6.25-1.el7.x86_64.rpm\nrh-php56-php-devel-5.6.25-1.el7.x86_64.rpm\nrh-php56-php-embedded-5.6.25-1.el7.x86_64.rpm\nrh-php56-php-enchant-5.6.25-1.el7.x86_64.rpm\nrh-php56-php-fpm-5.6.25-1.el7.x86_64.rpm\nrh-php56-php-gd-5.6.25-1.el7.x86_64.rpm\nrh-php56-php-gmp-5.6.25-1.el7.x86_64.rpm\nrh-php56-php-intl-5.6.25-1.el7.x86_64.rpm\nrh-php56-php-ldap-5.6.25-1.el7.x86_64.rpm\nrh-php56-php-mbstring-5.6.25-1.el7.x86_64.rpm\nrh-php56-php-mysqlnd-5.6.25-1.el7.x86_64.rpm\nrh-php56-php-odbc-5.6.25-1.el7.x86_64.rpm\nrh-php56-php-opcache-5.6.25-1.el7.x86_64.rpm\nrh-php56-php-pdo-5.6.25-1.el7.x86_64.rpm\nrh-php56-php-pgsql-5.6.25-1.el7.x86_64.rpm\nrh-php56-php-process-5.6.25-1.el7.x86_64.rpm\nrh-php56-php-pspell-5.6.25-1.el7.x86_64.rpm\nrh-php56-php-recode-5.6.25-1.el7.x86_64.rpm\nrh-php56-php-snmp-5.6.25-1.el7.x86_64.rpm\nrh-php56-php-soap-5.6.25-1.el7.x86_64.rpm\nrh-php56-php-xml-5.6.25-1.el7.x86_64.rpm\nrh-php56-php-xmlrpc-5.6.25-1.el7.x86_64.rpm\nrh-php56-runtime-2.3-1.el7.x86_64.rpm\nrh-php56-scldevel-2.3-1.el7.x86_64.rpm\n\nRed Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7):\n\nSource:\nrh-php56-2.3-1.el7.src.rpm\nrh-php56-php-5.6.25-1.el7.src.rpm\nrh-php56-php-pear-1.9.5-4.el7.src.rpm\n\nnoarch:\nrh-php56-php-pear-1.9.5-4.el7.noarch.rpm\n\nx86_64:\nrh-php56-2.3-1.el7.x86_64.rpm\nrh-php56-php-5.6.25-1.el7.x86_64.rpm\nrh-php56-php-bcmath-5.6.25-1.el7.x86_64.rpm\nrh-php56-php-cli-5.6.25-1.el7.x86_64.rpm\nrh-php56-php-common-5.6.25-1.el7.x86_64.rpm\nrh-php56-php-dba-5.6.25-1.el7.x86_64.rpm\nrh-php56-php-dbg-5.6.25-1.el7.x86_64.rpm\nrh-php56-php-debuginfo-5.6.25-1.el7.x86_64.rpm\nrh-php56-php-devel-5.6.25-1.el7.x86_64.rpm\nrh-php56-php-embedded-5.6.25-1.el7.x86_64.rpm\nrh-php56-php-enchant-5.6.25-1.el7.x86_64.rpm\nrh-php56-php-fpm-5.6.25-1.el7.x86_64.rpm\nrh-php56-php-gd-5.6.25-1.el7.x86_64.rpm\nrh-php56-php-gmp-5.6.25-1.el7.x86_64.rpm\nrh-php56-php-intl-5.6.25-1.el7.x86_64.rpm\nrh-php56-php-ldap-5.6.25-1.el7.x86_64.rpm\nrh-php56-php-mbstring-5.6.25-1.el7.x86_64.rpm\nrh-php56-php-mysqlnd-5.6.25-1.el7.x86_64.rpm\nrh-php56-php-odbc-5.6.25-1.el7.x86_64.rpm\nrh-php56-php-opcache-5.6.25-1.el7.x86_64.rpm\nrh-php56-php-pdo-5.6.25-1.el7.x86_64.rpm\nrh-php56-php-pgsql-5.6.25-1.el7.x86_64.rpm\nrh-php56-php-process-5.6.25-1.el7.x86_64.rpm\nrh-php56-php-pspell-5.6.25-1.el7.x86_64.rpm\nrh-php56-php-recode-5.6.25-1.el7.x86_64.rpm\nrh-php56-php-snmp-5.6.25-1.el7.x86_64.rpm\nrh-php56-php-soap-5.6.25-1.el7.x86_64.rpm\nrh-php56-php-xml-5.6.25-1.el7.x86_64.rpm\nrh-php56-php-xmlrpc-5.6.25-1.el7.x86_64.rpm\nrh-php56-runtime-2.3-1.el7.x86_64.rpm\nrh-php56-scldevel-2.3-1.el7.x86_64.rpm\n\nThese packages are GPG signed by Red Hat for security.  Our key and\ndetails on how to verify the signature are available from\nhttps://access.redhat.com/security/team/key/\n\n7. References:\n\nhttps://access.redhat.com/security/cve/CVE-2013-7456\nhttps://access.redhat.com/security/cve/CVE-2014-9767\nhttps://access.redhat.com/security/cve/CVE-2015-2325\nhttps://access.redhat.com/security/cve/CVE-2015-2326\nhttps://access.redhat.com/security/cve/CVE-2015-2327\nhttps://access.redhat.com/security/cve/CVE-2015-2328\nhttps://access.redhat.com/security/cve/CVE-2015-3210\nhttps://access.redhat.com/security/cve/CVE-2015-3217\nhttps://access.redhat.com/security/cve/CVE-2015-5073\nhttps://access.redhat.com/security/cve/CVE-2015-8381\nhttps://access.redhat.com/security/cve/CVE-2015-8383\nhttps://access.redhat.com/security/cve/CVE-2015-8384\nhttps://access.redhat.com/security/cve/CVE-2015-8385\nhttps://access.redhat.com/security/cve/CVE-2015-8386\nhttps://access.redhat.com/security/cve/CVE-2015-8388\nhttps://access.redhat.com/security/cve/CVE-2015-8391\nhttps://access.redhat.com/security/cve/CVE-2015-8392\nhttps://access.redhat.com/security/cve/CVE-2015-8395\nhttps://access.redhat.com/security/cve/CVE-2015-8835\nhttps://access.redhat.com/security/cve/CVE-2015-8865\nhttps://access.redhat.com/security/cve/CVE-2015-8866\nhttps://access.redhat.com/security/cve/CVE-2015-8867\nhttps://access.redhat.com/security/cve/CVE-2015-8873\nhttps://access.redhat.com/security/cve/CVE-2015-8874\nhttps://access.redhat.com/security/cve/CVE-2015-8876\nhttps://access.redhat.com/security/cve/CVE-2015-8877\nhttps://access.redhat.com/security/cve/CVE-2015-8879\nhttps://access.redhat.com/security/cve/CVE-2016-1903\nhttps://access.redhat.com/security/cve/CVE-2016-2554\nhttps://access.redhat.com/security/cve/CVE-2016-3074\nhttps://access.redhat.com/security/cve/CVE-2016-3141\nhttps://access.redhat.com/security/cve/CVE-2016-3142\nhttps://access.redhat.com/security/cve/CVE-2016-4070\nhttps://access.redhat.com/security/cve/CVE-2016-4071\nhttps://access.redhat.com/security/cve/CVE-2016-4072\nhttps://access.redhat.com/security/cve/CVE-2016-4073\nhttps://access.redhat.com/security/cve/CVE-2016-4342\nhttps://access.redhat.com/security/cve/CVE-2016-4343\nhttps://access.redhat.com/security/cve/CVE-2016-4473\nhttps://access.redhat.com/security/cve/CVE-2016-4537\nhttps://access.redhat.com/security/cve/CVE-2016-4538\nhttps://access.redhat.com/security/cve/CVE-2016-4539\nhttps://access.redhat.com/security/cve/CVE-2016-4540\nhttps://access.redhat.com/security/cve/CVE-2016-4541\nhttps://access.redhat.com/security/cve/CVE-2016-4542\nhttps://access.redhat.com/security/cve/CVE-2016-4543\nhttps://access.redhat.com/security/cve/CVE-2016-4544\nhttps://access.redhat.com/security/cve/CVE-2016-5093\nhttps://access.redhat.com/security/cve/CVE-2016-5094\nhttps://access.redhat.com/security/cve/CVE-2016-5096\nhttps://access.redhat.com/security/cve/CVE-2016-5114\nhttps://access.redhat.com/security/cve/CVE-2016-5399\nhttps://access.redhat.com/security/cve/CVE-2016-5766\nhttps://access.redhat.com/security/cve/CVE-2016-5767\nhttps://access.redhat.com/security/cve/CVE-2016-5768\nhttps://access.redhat.com/security/cve/CVE-2016-5770\nhttps://access.redhat.com/security/cve/CVE-2016-5771\nhttps://access.redhat.com/security/cve/CVE-2016-5772\nhttps://access.redhat.com/security/cve/CVE-2016-5773\nhttps://access.redhat.com/security/cve/CVE-2016-6128\nhttps://access.redhat.com/security/cve/CVE-2016-6207\nhttps://access.redhat.com/security/cve/CVE-2016-6288\nhttps://access.redhat.com/security/cve/CVE-2016-6289\nhttps://access.redhat.com/security/cve/CVE-2016-6290\nhttps://access.redhat.com/security/cve/CVE-2016-6291\nhttps://access.redhat.com/security/cve/CVE-2016-6292\nhttps://access.redhat.com/security/cve/CVE-2016-6294\nhttps://access.redhat.com/security/cve/CVE-2016-6295\nhttps://access.redhat.com/security/cve/CVE-2016-6296\nhttps://access.redhat.com/security/cve/CVE-2016-6297\nhttps://access.redhat.com/security/cve/CVE-2016-7124\nhttps://access.redhat.com/security/cve/CVE-2016-7125\nhttps://access.redhat.com/security/cve/CVE-2016-7126\nhttps://access.redhat.com/security/cve/CVE-2016-7127\nhttps://access.redhat.com/security/cve/CVE-2016-7128\nhttps://access.redhat.com/security/cve/CVE-2016-7129\nhttps://access.redhat.com/security/cve/CVE-2016-7130\nhttps://access.redhat.com/security/cve/CVE-2016-7131\nhttps://access.redhat.com/security/cve/CVE-2016-7132\nhttps://access.redhat.com/security/updates/classification/#moderate\n\n8. Contact:\n\nThe Red Hat security contact is \u003csecalert@redhat.com\u003e. More contact\ndetails at https://access.redhat.com/security/team/contact/\n\nCopyright 2016 Red Hat, Inc. \n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1\n\niD8DBQFYKvj4XlSAg2UNWIIRAqg2AKCB6Jcysv4gkiktKAJA3gy+RKlAqwCeJpjs\nUCuj+0gWfBsWXOgFhgH0uL8=\n=FcPG\n-----END PGP SIGNATURE-----\n\n\n--\nRHSA-announce mailing list\nRHSA-announce@redhat.com\nhttps://www.redhat.com/mailman/listinfo/rhsa-announce\n. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA1\n\nNote: the current version of the following document is available here:\nhttps://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c05240731\n\nSUPPORT COMMUNICATION - SECURITY BULLETIN\n\nDocument ID: c05240731\nVersion: 1\n\nHPSBNS03635 rev.1 - HPE NonStop Servers OSS Script Languages running Perl and\nPHP, Multiple Local and Remote Vulnerabilities\n\nNOTICE: The information in this Security Bulletin should be acted upon as\nsoon as possible. \n\nRelease Date: 2016-08-19\nLast Updated: 2016-08-19\n\nPotential Security Impact: Local Denial of Service (DoS), Elevation of\nPrivilege, Remote Denial of Service (DoS), Execution of Arbitrary Code,\nUnauthorized Disclosure of Information, Unauthorized Modification\n\nSource: Hewlett Packard Enterprise, Product Security Response Team\n\nVULNERABILITY SUMMARY\nMultiple potential remote and local vulnerabilities impacting Perl and PHP\nhave been addressed by HPE NonStop Servers OSS Script Languages. The\nvulnerabilities include Perl\u0027s opportunistic loading of optional modules\nwhich might allow local users to gain elevation of privilege via a Trojan\nhorse library under the current working directory. \n\nReferences:\n\n    - CVE-2016-1238 - Perl Local Elevation of Privilege\n    - CVE-2016-2381 - Perl Remote Unauthorized Modification\n    - CVE-2014-4330 - Perl Local Denial of Service (DoS)\n\n        **Note:** applies only for the H/J-series SPR. Fix was already\nprovided in a previous L-series SPR. \n\n    - CVE-2015-8383 - Perl Remote Denial of Service (DoS)\n    - CVE-2015-8386 - Perl Remote Denial of Service (DoS)\n    - CVE-2015-8387 - Perl Remote Denial of Service (DoS)\n    - CVE-2015-8389 - Perl Remote Denial of Service (DoS)\n    - CVE-2015-8390 - Perl Remote Denial of Service (DoS)\n    - CVE-2015-8391 - Perl Remote Denial of Service (DoS)\n    - CVE-2015-8393 - Perl Remote Unauthorized Disclosure of Information\n    - CVE-2015-8394 - Perl Remote Denial of Service (DoS)\n    - CVE-2015-8607 - Perl Remote Unauthorized Disclosure of Information,\nUnauthorized Modification, Denial of Service (DoS)\n    - CVE-2015-8853 - Perl Remote Denial of Service (DoS)\n    - CVE-2015-8865 - Perl Remote Denial of Service (Dos), Execute Arbitrary\nCode\n    - CVE-2013-7456 - PHP Remote Denial of Service (DoS)\n    - CVE-2015-8874 - PHP Remote Denial of Service (DoS)\n    - CVE-2016-1903 - PHP Remote Unauthorized Disclosure of Information,\nDenial of Service (DoS)\n    - CVE-2016-2554 - PHP Remote Denial of Service (DoS)\n    - CVE-2016-3074 - PHP using GD Graphics Library 2.1.1 (aka libgd or\nlibgd2) Remote Denial of Service (Dos), Execute Arbitrary Code\n    - CVE-2016-4070 - PHP Remote Denial of Service (DoS)\n    - CVE-2016-4071 - PHP Remote Execute Arbitrary Code\n    - CVE-2016-4072 - PHP Remote Execute Arbitrary Code\n    - CVE-2016-4073 - PHP Remote Denial of Service (Dos), Execute Arbitrary\nCode\n    - CVE-2016-4342 - PHP Remote Denial of Service (DoS)\n    - CVE-2016-4343 - PHP Remote Denial of Service (DoS)\n    - CVE-2016-4537 - PHP Remote Denial of Service (DoS)\n    - CVE-2016-4538 - PHP Remote Denial of Service (DoS)\n    - CVE-2016-4539 - PHP Remote Denial of Service (DoS)\n    - CVE-2016-4540 - PHP Remote Denial of Service (DoS)\n    - CVE-2016-4541 - PHP Remote Denial of Service (DoS)\n    - CVE-2016-4542 - PHP Remote Denial of Service (DoS)\n    - CVE-2016-4543 - PHP Remote Denial of Service (DoS)\n    - CVE-2016-4544 - PHP Remote Denial of Service (DoS)\n    - CVE-2016-5093 - PHP Remote Denial of Service (DoS)\n    - CVE-2016-5094 - PHP Remote Denial of Service (DoS)\n    - CVE-2016-5096 - PHP Remote Denial of Service (DoS)\n    - CVE-2016-5114 - PHP Remote Unauthorized Disclosure of Information,\nDenial of Service (DoS)\n    - CVE-2016-5766 - PHP Remote Denial of Service (DoS)\n    - CVE-2016-5767 - PHP Remote Denial of Service (DoS)\n    - CVE-2016-5768 - PHP Remote Denial of Service (Dos), Execute Arbitrary\nCode\n    - CVE-2016-5769 - PHP Remote Denial of Service (DoS)\n    - CVE-2016-5770 - PHP Remote Denial of Service (DoS)\n    - CVE-2016-5771 - PHP Remote Denial of Service (Dos), Execute Arbitrary\nCode\n    - CVE-2016-5772 - PHP Remote Denial of Service (Dos), Execute Arbitrary\nCode\n    - CVE-2016-5773 - PHP Remote Denial of Service (Dos), Execute Arbitrary\nCode\n    - NonStop Hotstuff HS03333\n    - PSRT110206\n\nSUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed. \nOSS Script Languages (T1203) T1203H01 through T1203H01^AAD, T1203L01 and\nT1203L01^AAC\n\n    *Impacted releases:*\n\n    - L15.02\n    - L15.08.00, L15.08.01\n    - L16.05.00\n\n    - J06.14 through J06.16.02\n    - J06.17.00, J06.17.01\n    - J06.18.00, J06.18.01\n    - J06.19.00, J06.19.01, J06.19.02\n    - J06.20.00\n\n    - H06.25 through H06.26.01\n    - H06.27.00, H06.27.01\n    - H06.28.00, H06.28.01\n    - H06.29.00, H06.29.01\n\nBACKGROUND\n\n  CVSS Base Metrics\n  =================\n  Reference, CVSS V3 Score/Vector, CVSS V2 Score/Vector\n\n    CVE-2013-7456\n      7.6 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H\n      6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)\n\n    CVE-2014-4330\n      4.0 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L\n      2.1 (AV:L/AC:L/Au:N/C:N/I:N/A:P)\n\n    CVE-2015-8383\n      7.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L\n      7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)\n\n    CVE-2015-8386\n      7.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L\n      7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)\n\n    CVE-2015-8387\n      7.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L\n      7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)\n\n    CVE-2015-8389\n      7.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L\n      7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)\n\n    CVE-2015-8390\n      7.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L\n      7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)\n\n    CVE-2015-8391\n      8.6 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H\n      9.0 (AV:N/AC:L/Au:N/C:P/I:P/A:C)\n\n    CVE-2015-8393\n      5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\n      5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N)\n\n    CVE-2015-8394\n      7.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L\n      7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)\n\n    CVE-2015-8607\n      7.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L\n      7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)\n\n    CVE-2015-8853\n      7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\n      5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)\n\n    CVE-2015-8865\n      7.3 CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H\n      7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)\n\n    CVE-2015-8874\n      7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\n      5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)\n\n    CVE-2016-1238\n      6.7 CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H\n      6.2 (AV:L/AC:H/Au:N/C:C/I:C/A:C)\n\n    CVE-2016-1903\n      9.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H\n      6.4 (AV:N/AC:L/Au:N/C:P/I:N/A:P)\n\n    CVE-2016-2381\n      6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N\n      5.0 (AV:N/AC:L/Au:N/C:N/I:P/A:N)\n\n    CVE-2016-2554\n      9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n      10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)\n\n    CVE-2016-3074\n      9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n      7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)\n\n    CVE-2016-4070\n      7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\n      5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)\n\n    CVE-2016-4071\n      9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n      7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)\n\n    CVE-2016-4072\n      9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n      7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)\n\n    CVE-2016-4073\n      9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n      7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)\n\n    CVE-2016-4342\n      8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\n      8.3 (AV:N/AC:M/Au:N/C:P/I:P/A:C)\n\n    CVE-2016-4343\n      8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\n      6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)\n\n    CVE-2016-4537\n      9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n      7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)\n\n    CVE-2016-4538\n      9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n      7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)\n\n    CVE-2016-4539\n      9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n      7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)\n\n    CVE-2016-4540\n      9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n      7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)\n\n    CVE-2016-4541\n      9.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H\n      7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)\n\n    CVE-2016-4542\n      9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n      7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)\n\n    CVE-2016-4543\n      9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n      7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)\n\n    CVE-2016-4544\n      9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n      7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)\n\n    CVE-2016-5093\n      8.6 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H\n      7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)\n\n    CVE-2016-5094\n      8.6 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H\n      7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)\n\n    CVE-2016-5096\n      8.6 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H\n      7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)\n\n    CVE-2016-5114\n      9.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H\n      6.4 (AV:N/AC:L/Au:N/C:P/I:N/A:P)\n\n    CVE-2016-5766\n      8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\n      6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)\n\n    CVE-2016-5767\n      8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\n      6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)\n\n    CVE-2016-5768\n      9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n      7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)\n\n    CVE-2016-5769\n      9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n      7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)\n\n    CVE-2016-5770\n      9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n      7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)\n\n    CVE-2016-5771\n      9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n      7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)\n\n    CVE-2016-5772\n      9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n      7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)\n\n    CVE-2016-5773\n      9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n      7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)\n\n    Information on CVSS is documented in\n    HPE Customer Notice HPSN-2008-002 here:\n\nhttps://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c01345499\n\nRESOLUTION\n\nHPE has released the following software updates to resolve the\nvulnerabilities in NonStop Servers OSS Script Languages running Perl and PHP. \n\nInstall one of the SPRs below as appropriate for the system\u0027s release\nversion:\n\n  + L-Series:\n\n    * T1203L01^AAE (OSS Scripting Languages) - already available\n\n        This SPR already is present in these RVUs: None\n\n        This SPR is usable with the following RVUs:\n\n        - L15.02 through L16.05.00\n\n  + H and J-Series:\n\n    * T1203H01^AAF (OSS Scripting Languages) - already available\n\n        This SPR already is present in these RVUs: None\n\n        This SPR is usable with the following RVUs:\n\n         - J06.14 through J06.20.00\n\n         - H06.25 through H06.29.01\n\n**Note:** Please refer to *NonStop Hotstuff HS03333* for more information. \n\nHISTORY\nVersion:1 (rev.1) - 19 August 2016 Initial release\n\nThird Party Security Patches: Third party security patches that are to be\ninstalled on systems running Hewlett Packard Enterprise (HPE) software\nproducts should be applied in accordance with the customer\u0027s patch management\npolicy. \n\nSupport: For issues about implementing the recommendations of this Security\nBulletin, contact normal HPE Services support channel. For other issues about\nthe content of this Security Bulletin, send e-mail to security-alert@hpe.com. \n\nReport: To report a potential security vulnerability for any HPE supported\nproduct:\n  Web form: https://www.hpe.com/info/report-security-vulnerability\n  Email: security-alert@hpe.com\n\nSubscribe: To initiate a subscription to receive future HPE Security Bulletin\nalerts via Email: http://www.hpe.com/support/Subscriber_Choice\n\nSecurity Bulletin Archive: A list of recently released Security Bulletins is\navailable here: http://www.hpe.com/support/Security_Bulletin_Archive\n\nSoftware Product Category: The Software Product Category is represented in\nthe title by the two characters following HPSB. \n\n3C = 3COM\n3P = 3rd Party Software\nGN = HPE General Software\nHF = HPE Hardware and Firmware\nMU = Multi-Platform Software\nNS = NonStop Servers\nOV = OpenVMS\nPV = ProCurve\nST = Storage Software\nUX = HP-UX\n\nCopyright 2016 Hewlett Packard Enterprise\n\nHewlett Packard Enterprise shall not be liable for technical or editorial\nerrors or omissions contained herein. The information provided is provided\n\"as is\" without warranty of any kind. To the extent permitted by law, neither\nHP or its affiliates, subcontractors or suppliers will be liable for\nincidental,special or consequential damages including downtime cost; lost\nprofits; damages relating to the procurement of substitute products or\nservices; or damages for loss of data, or software restoration. The\ninformation in this document is subject to change without notice. Hewlett\nPackard Enterprise and the names of Hewlett Packard Enterprise products\nreferenced herein are trademarks of Hewlett Packard Enterprise in the United\nStates and other countries. Other product and company names mentioned herein\nmay be trademarks of their respective owners. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA512\n\nAPPLE-SA-2016-05-16-4 OS X El Capitan 10.11.5 and Security Update\n2016-003\n\nOS X El Capitan 10.11.5 and Security Update 2016-003 is now available\nand addresses the following:\n\nAMD\nAvailable for:  OS X El Capitan v10.11 and later\nImpact:  An application may be able to execute arbitrary code with\nkernel privileges\nDescription:  A memory corruption issue was addressed through\nimproved memory handling. \nCVE-ID\nCVE-2016-1792 : beist and ABH of BoB\n\nAMD\nAvailable for:  OS X Mavericks v10.9.5, OS X Yosemite v10.10.5,\nand OS X El Capitan v10.11 and later\nImpact:  An application may be able to determine kernel memory layout\nDescription:  An issue existed that led to the disclosure of kernel\nmemory content. This issue was addressed through improved bounds\nchecking. \nCVE-ID\nCVE-2016-1791 : daybreaker of Minionz\n\napache_mod_php\nAvailable for:  OS X El Capitan v10.11 and later\nImpact:  Multiple vulnerabilities in PHP\nDescription:  Multiple vulnerabilities existed in PHP versions prior\nto 5.5.34. These were addressed by updating PHP to version 5.5.34. \nCVE-ID\nCVE-2015-8865\nCVE-2016-3141\nCVE-2016-3142\nCVE-2016-4070\nCVE-2016-4071\nCVE-2016-4072\nCVE-2016-4073\n\nAppleGraphicsControl\nAvailable for:  OS X El Capitan v10.11 and later\nImpact:  An application may be able to execute arbitrary code with\nkernel privileges\nDescription:  A null pointer dereference was addressed through\nimproved validation. \nCVE-ID\nCVE-2016-1793 : Ian Beer of Google Project Zero\nCVE-2016-1794 : Ian Beer of Google Project Zero\n\nAppleGraphicsPowerManagement\nAvailable for:  OS X El Capitan v10.11 and later\nImpact:  An application may be able to execute arbitrary code with\nkernel privileges\nDescription:  A memory corruption issue was addressed through\nimproved memory handling. \nCVE-ID\nCVE-2016-1795 : Moony Li (@Flyic) and Jack Tang (@jacktang310) of\nTrend Micro\n\nATS\nAvailable for:  OS X El Capitan v10.11 and later\nImpact:  An application may be able to determine kernel memory layout\nDescription:  An out of bounds memory access issue was addressed\nthrough improved memory handling. \nCVE-ID\nCVE-2016-1796 : lokihardt working with Trend Micro\u0027s Zero Day\nInitiative\n\nATS\nAvailable for:  OS X El Capitan v10.11 and later\nImpact:  An application may be able to execute arbitrary code with\nsystem privileges\nDescription:  An issue existed in the sandbox policy. This was\naddressed by sandboxing FontValidator. \nCVE-ID\nCVE-2016-1797 : lokihardt working with Trend Micro\u0027s Zero Day\nInitiative\n\nAudio\nAvailable for:  \nOS X Yosemite v10.10.5 and OS X El Capitan v10.11 and later\nImpact:  An application may be able to cause a denial of service\nDescription:  A null pointer dereference was addressed through\nimproved validation. \nCVE-ID\nCVE-2016-1798 : Juwei Lin of TrendMicro\n\nAudio\nAvailable for:  OS X El Capitan v10.11 and later\nImpact:  An application may be able to execute arbitrary code with\nkernel privileges\nDescription:  A memory corruption issue was addressed through\nimproved input validation. \nCVE-ID\nCVE-2016-1799 : Juwei Lin of TrendMicro\n\nCaptive Network Assistant\nAvailable for:  OS X Mavericks v10.9.5, OS X Yosemite v10.10.5,\nand OS X El Capitan v10.11 and later\nImpact:  An attacker in a privileged network position may be able to\nexecute arbitrary code with user assistance\nDescription:  A custom URL scheme handling issue was addressed\nthrough improved input validation. \nCVE-ID\nCVE-2016-1800 : Apple\n\nCFNetwork Proxies\nAvailable for:  OS X El Capitan v10.11 and later\nImpact:  An attacker in a privileged network position may be able to\nleak sensitive user information\nDescription:  An information leak existed in the handling of HTTP and\nHTTPS requests. This issue was addressed through improved URL\nhandling. \nCVE-ID\nCVE-2016-1801 : Alex Chapman and Paul Stone of Context Information\nSecurity\n\nCommonCrypto\nAvailable for:  OS X El Capitan v10.11 and later\nImpact:  A malicious application may be able to leak sensitive user\ninformation\nDescription:  An issue existed in the handling of return values in\nCCCrypt. This issue was addressed through improved key length\nmanagement. \nCVE-ID\nCVE-2016-1802 : Klaus Rodewig\n\nCoreCapture\nAvailable for:  OS X El Capitan v10.11 and later\nImpact:  An application may be able to execute arbitrary code with\nkernel privileges\nDescription:  A null pointer dereference was addressed through\nimproved validation. \nCVE-ID\nCVE-2016-1803 : Ian Beer of Google Project Zero, daybreaker working\nwith Trend Micro\u2019s Zero Day Initiative\n\nCoreStorage\nAvailable for:  OS X El Capitan v10.11 and later\nImpact:  An application may be able to execute arbitrary code with\nkernel privileges\nDescription:  A configuration issue was addressed through additional\nrestrictions. \nCVE-ID\nCVE-2016-1805 : Stefan Esser\n\nCrash Reporter\nAvailable for:  OS X El Capitan v10.11 and later\nImpact:  An application may be able to execute arbitrary code with\nroot privileges\nDescription:  A configuration issue was addressed through additional\nrestrictions. \nCVE-ID\nCVE-2016-1806 : lokihardt working with Trend Micro\u0027s Zero Day\nInitiative\n\nDisk Images\nAvailable for:  OS X El Capitan v10.11 and later\nImpact:  A local attacker may be able to read kernel memory\nDescription:  A race condition was addressed through improved\nlocking. \nCVE-ID\nCVE-2016-1807 : Ian Beer of Google Project Zero\n\nDisk Images\nAvailable for:  OS X El Capitan v10.11 and later\nImpact:  An application may be able to execute arbitrary code with\nkernel privileges\nDescription:  A memory corruption issue existed in the parsing of\ndisk images. This issue was addressed through improved memory\nhandling. \nCVE-ID\nCVE-2016-1808 : Moony Li (@Flyic) and Jack Tang (@jacktang310) of\nTrend Micro\n\nDisk Utility\nAvailable for:  OS X El Capitan v10.11 and later\nImpact:  Disk Utility failed to compress and encrypt disk images\nDescription:  Incorrect keys were being used to encrypt disk images. \nThis issue was addressed by updating the encryption keys. \nCVE-ID\nCVE-2016-1809 : Ast A. Moore (@astamoore) and David Foster of\nTechSmartKids\n\nGraphics Drivers\nAvailable for:  OS X El Capitan v10.11 and later\nImpact:  An application may be able to execute arbitrary code with\nkernel privileges\nDescription:  Multiple memory corruption issues were addressed\nthrough improved memory handling. \nCVE-ID\nCVE-2016-1810 : Moony Li (@Flyic) and Jack Tang (@jacktang310) of\nTrend Micro\n\nImageIO\nAvailable for:  OS X El Capitan v10.11 and later\nImpact:  Processing a maliciously crafted image may lead to a denial\nof service\nDescription:  A null pointer dereference was addressed through\nimproved validation. \nCVE-ID\nCVE-2016-1811 : Lander Brandt (@landaire)\n\nIntel Graphics Driver\nAvailable for:  OS X El Capitan v10.11 and later\nImpact:  An application may be able to execute arbitrary code with\nkernel privileges\nDescription:  A buffer overflow was addressed through improved bounds\nchecking. \nCVE-ID\nCVE-2016-1812 : Juwei Lin of TrendMicro\n\nIOAcceleratorFamily\nAvailable for:  OS X El Capitan v10.11 and later\nImpact:  An application may be able to cause a denial of service\nDescription:  A null pointer dereference was addressed through\nimproved locking. \nCVE-ID\nCVE-2016-1814 : Juwei Lin of TrendMicro\n\nIOAcceleratorFamily\nAvailable for:  OS X El Capitan v10.11 and later\nImpact:  An application may be able to execute arbitrary code with\nkernel privileges\nDescription:  Multiple memory corruption issues were addressed\nthrough improved memory handling. \nCVE-ID\nCVE-2016-1815 : Liang Chen, Qidan He of KeenLab, Tencent working with\nTrend Micro\u0027s Zero Day Initiative\nCVE-2016-1817 : Moony Li (@Flyic) and Jack Tang (@jacktang310) of\nTrend Micro working with Trend Micro\u0027s Zero Day Initiative\nCVE-2016-1818 : Juwei Lin of TrendMicro\nCVE-2016-1819 : Ian Beer of Google Project Zero\n\nIOAcceleratorFamily\nAvailable for:  OS X El Capitan v10.11 and later\nImpact:  An application may be able to execute arbitrary code with\nkernel privileges\nDescription:  A null pointer dereference was addressed through\nimproved validation. \nCVE-ID\nCVE-2016-1813 : Ian Beer of Google Project Zero\nCVE-2016-1816 : Peter Pi (@heisecode) of Trend Micro and Juwei Lin of\nTrend Micro\n\nIOAudioFamily\nAvailable for:  OS X El Capitan v10.11 and later\nImpact:  An application may be able to execute arbitrary code with\nkernel privileges\nDescription:  A buffer overflow was addressed with improved bounds\nchecking. \nCVE-ID\nCVE-2016-1820 : Moony Li (@Flyic) and Jack Tang (@jacktang310) of\nTrend Micro working with Trend Micro\u2019s Zero Day Initiative\n\nIOAudioFamily\nAvailable for:  OS X El Capitan v10.11 and later\nImpact:  An application may be able to execute arbitrary code with\nkernel privileges\nDescription:  A null pointer dereference was addressed through\nimproved validation. \nCVE-ID\nCVE-2016-1821 : Ian Beer of Google Project Zero\n\nIOFireWireFamily\nAvailable for:  OS X El Capitan v10.11 and later\nImpact:  An application may be able to execute arbitrary code with\nkernel privileges\nDescription:  A memory corruption issue was addressed through\nimproved memory handling. \nCVE-ID\nCVE-2016-1822 : CESG\n\nIOHIDFamily\nAvailable for:  OS X El Capitan v10.11 and later\nImpact:  An application may be able to execute arbitrary code with\nkernel privileges\nDescription:  A memory corruption issue was addressed through\nimproved memory handling. \nCVE-ID\nCVE-2016-1823 : Ian Beer of Google Project Zero\nCVE-2016-1824 : Marco Grassi (@marcograss) of KeenLab (@keen_lab),\nTencent\n\nIOHIDFamily\nAvailable for:  OS X El Capitan v10.11 and later\nImpact:  An application may be able to execute arbitrary code with\nkernel privileges\nDescription:  Multiple memory corruption issues were addressed\nthrough improved memory handling. \nCVE-ID\nCVE-2016-1825 : Brandon Azad\n\nKernel\nAvailable for:  OS X El Capitan v10.11 and later\nImpact:  An application may be able to execute arbitrary code with\nkernel privileges\nDescription:  Multiple memory corruption issues were addressed\nthrough improved memory handling. \nCVE-ID\nCVE-2016-1827 : Brandon Azad\nCVE-2016-1828 : Brandon Azad\nCVE-2016-1829 : CESG\nCVE-2016-1830 : Brandon Azad\nCVE-2016-1831 : Brandon Azad\n\nKernel\nAvailable for:  OS X El Capitan v10.11 and later\nImpact:  An application may be able to execute arbitrary code with\nkernel privileges\nDescription:  An integer overflow existed in dtrace. This issue was\naddressed through improved bounds checking. \nCVE-ID\nCVE-2016-1826 : Ben Murphy working with Trend Micro\u2019s Zero Day\nInitiative\n\nlibc\nAvailable for:  OS X El Capitan v10.11 and later\nImpact:  A local attacker may be able to cause unexpected application\ntermination or arbitrary code execution\nDescription:  A memory corruption issue was addressed through\nimproved input validation. \nCVE-ID\nCVE-2016-1832 : Karl Williamson\n\nlibxml2\nAvailable for:  OS X Mavericks v10.9.5, OS X Yosemite v10.10.5,\nand OS X El Capitan v10.11 and later\nImpact:  Processing maliciously crafted XML may lead to an unexpected\napplication termination or arbitrary code execution\nDescription:  Multiple memory corruption issues were addressed\nthrough improved memory handling. \nCVE-ID\nCVE-2016-1833 : Mateusz Jurczyk\nCVE-2016-1834 : Apple\nCVE-2016-1835 : Wei Lei and Liu Yang of Nanyang Technological\nUniversity\nCVE-2016-1836 : Wei Lei and Liu Yang of Nanyang Technological\nUniversity\nCVE-2016-1837 : Wei Lei and Liu Yang of Nanyang Technological\nUniversity\nCVE-2016-1838 : Mateusz Jurczyk\nCVE-2016-1839 : Mateusz Jurczyk\nCVE-2016-1840 : Kostya Serebryany\n\nlibxslt\nAvailable for:  OS X Mavericks v10.9.5, OS X Yosemite v10.10.5,\nand OS X El Capitan v10.11 and later\nImpact:  Visiting a maliciously crafted website may lead to arbitrary\ncode execution\nDescription:  A memory corruption issue was addressed through\nimproved memory handling. \nCVE-ID\nCVE-2016-1841 : Sebastian Apelt\n\nMapKit\nAvailable for:  OS X El Capitan v10.11 and later\nImpact:  An attacker in a privileged network position may be able to\nleak sensitive user information\nDescription:  Shared links were sent with HTTP rather than HTTPS. \nThis was addressed by enabling HTTPS for shared links. \nCVE-ID\nCVE-2016-1842 : Richard Shupak (https://www.linkedin.com/in/rshupak)\n\nMessages\nAvailable for:  OS X El Capitan v10.11 and later\nImpact:  A malicious server or user may be able to modify another\nuser\u0027s contact list\nDescription:  A validation issue existed in roster changes. This\nissue was addressed through improved validation of roster sets. \nCVE-ID\nCVE-2016-1844 : Thijs Alkemade of Computest\n\nMessages\nAvailable for:  OS X El Capitan v10.11 and later\nImpact:  A remote attacker may be able to leak sensitive user\ninformation\nDescription:  An encoding issue existed in filename parsing. This\nissue was addressed through improved filename encoding. \nCVE-ID\nCVE-2016-1843 : Heige (a.k.a. SuperHei) of Knownsec 404 Security Team\n[http://www.knownsec.com]\n\nMulti-Touch\nAvailable for:  OS X El Capitan v10.11 and later\nImpact:  An application may be able to execute arbitrary code with\nsystem privileges\nDescription:  A memory corruption issue was addressed through\nimproved memory handling. \nCVE-ID\nCVE-2016-1804 : Liang Chen, Yubin Fu, Marco Grassi of KeenLab,\nTencent of Trend Micro\u0027s Zero Day Initiative\n\nNVIDIA Graphics Drivers\nAvailable for:  \nOS X Yosemite v10.10.5 and OS X El Capitan v10.11 and later\nImpact:  An application may be able to execute arbitrary code with\nkernel privileges\nDescription:  Multiple memory corruption issues were addressed\nthrough improved memory handling. \nCVE-ID\nCVE-2016-1846 : Ian Beer of Google Project Zero\n\nOpenGL\nAvailable for:  OS X Mavericks v10.9.5, OS X Yosemite v10.10.5,\nand OS X El Capitan v10.11 and later\nImpact:  Processing maliciously crafted web content may lead to\narbitrary code execution\nDescription:  Multiple memory corruption issues were addressed\nthrough improved memory handling. \nCVE-ID\nCVE-2016-1847 : Tongbo Luo and Bo Qu of Palo Alto Networks\n\nQuickTime\nAvailable for:  OS X El Capitan v10.11 and later\nImpact:  Opening a maliciously crafted file may lead to unexpected\napplication termination or arbitrary code execution\nDescription:  A memory corruption issue was addressed through\nimproved memory handling. \nCVE-ID\nCVE-2016-1848 : Francis Provencher from COSIG\n\nSceneKit\nAvailable for:  OS X El Capitan v10.11 and later\nImpact:  Opening a maliciously crafted file may lead to unexpected\napplication termination or arbitrary code execution\nDescription:  A memory corruption issue was addressed through\nimproved memory handling. \nCVE-ID\nCVE-2016-1850 : Tyler Bohan of Cisco Talos\n\nScreen Lock\nAvailable for:  OS X El Capitan v10.11 and later\nImpact:  A person with physical access to a computer may be able to\nreset an expired password from the lock screen\nDescription:  An issue existed in the management of password\nprofiles. This issue was addressed through improved password reset\nhandling. \nCVE-ID\nCVE-2016-1851 : an anonymous researcher\n\nTcl\nAvailable for:  OS X El Capitan v10.11 and later\nImpact:  An attacker in a privileged network position may be able to\nleak sensitive user information\nDescription:  A protocol security issue was addressed by disabling\nSSLv2. \nCVE-ID\nCVE-2016-1853 : researchers at Tel Aviv University, M\u00fcnster\nUniversity of Applied Sciences, Ruhr University Bochum, the\nUniversity of Pennsylvania, the Hashcat project, the University of\nMichigan, Two Sigma, Google, and the OpenSSL project: Nimrod Aviram,\nSebastian Schinzel, Juraj Somorovsky, Nadia Heninger, Maik Dankel,\nJens Steube, Luke Valenta, David Adrian, J. Alex Halderman, Viktor\nDukhovni, Emilia K\u00e4sper, Shaanan Cohney, Susanne Engels, Christof\nPaar, and Yuval Shavitt\n\nNote: OS X El Capitan 10.11.5 includes the security content of Safari\n9.1.1. For further details see https://support.apple.com/en-us/HT206565\n\n\nOS X El Capitan 10.11.5 and Security Update 2016-003 may be obtained\nfrom the Mac App Store or Apple\u0027s Software Downloads web site:\nhttp://www.apple.com/support/downloads/\n\nInformation will also be posted to the Apple Security Updates\nweb site: http://support.apple.com/kb/HT201222\n\nThis message is signed with Apple\u0027s Product Security PGP key,\nand details are available at:\nhttps://www.apple.com/support/security/pgp/\n-----BEGIN PGP SIGNATURE-----\nComment: GPGTools - https://gpgtools.org\n\niQIcBAEBCgAGBQJXOj0GAAoJEIOj74w0bLRGFp0QANQktsdXgOptLJWGqWXaDKmW\nHaY0fNyuXNLzGNH2GKQ1yXi2KjMqGnCuAwaS3Ku/4qx2Imq3X+BLLYrSOwttbAvQ\nyGdWaFo1ExK/WT4CI02QM7LDOZNXOyZq/ofQ4jXi/wDpuXXNV+I+RsMMUJL4Uon9\n2fngj7FHXk4fvCYs9lahjv+wDGkpIcVDTU6Liqxmje2KQzShYJ8tYwwacsOSQKxk\nbmsUiA9q9zkGbbo7mo5WikQUO1XWaBLQiBejzJMyNEFGECtOc9B4+irTJgERTSHb\nigd2875EmH/sNI6WkEQNZwpMfdKBhNI/W9e/DhZVSwAydK6xt8yr0vd5ZF/M8jCU\nCWGzoOQI1snlr862Ccx7H+db8umu1UmDMUjz1To+hqCEhnvMW2/oRvrKtk2Q65Pu\nSTqixhDl0HEamvX/72r7LNsZHjzmoGoKjpwjnGf0phZgSBP1bWKmhp9748Rcb12a\nLzwRy7KJ20W8XGGiMeqKoe4bFaBK6iBJok4+ZpROadGrxtjVumtqbZ5CrY1Hp8/F\nI4VMuReDqG39G4yyDeAEr9JWRdmV285Z1zaxOgd2CsPblDfEWp9HiBpC8Agd1p9x\nMf/EDssinL1K7dQQPIXgGUE5S6Z2DzGEeKvHzm8kLxl0OfwntATY/mf7TM0nj4JY\nYyNMZcKPuYVmF3b2PAfb\n=P+17\n-----END PGP SIGNATURE-----\n. \n\nBackground\n==========\n\nfile is a utility that guesses a file format by scanning binary data\nfor patterns. \n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\nGentoo Linux Security Advisory                           GLSA 201611-22\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n                                           https://security.gentoo.org/\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n\n Severity: Normal\n    Title: PHP: Multiple vulnerabilities\n     Date: November 30, 2016\n     Bugs: #578734, #581834, #584204, #587246, #591710, #594498,\n           #597586, #599326\n       ID: 201611-22\n\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n\nSynopsis\n========\n\nMultiple vulnerabilities have been found in PHP, the worst of which\ncould lead to arbitrary code execution or cause a Denial of Service\ncondition. \n\nBackground\n==========\n\nPHP is a widely-used general-purpose scripting language that is\nespecially suited for Web development and can be embedded into HTML. Please review the\nCVE identifiers referenced below for details. \n\nWorkaround\n==========\n\nThere is no known workaround at this time. \n\nResolution\n==========\n\nAll PHP users should upgrade to the latest version:\n\n  # emerge --sync\n  # emerge --ask --oneshot --verbose \"\u003e=dev=lang/php-5.6.28\"\n\nReferences\n==========\n\n[  1 ] CVE-2015-8865\n       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-8865\n[  2 ] CVE-2016-3074\n       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-3074\n[  3 ] CVE-2016-4071\n       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4071\n[  4 ] CVE-2016-4072\n       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4072\n[  5 ] CVE-2016-4073\n       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4073\n[  6 ] CVE-2016-4537\n       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4537\n[  7 ] CVE-2016-4538\n       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4538\n[  8 ] CVE-2016-4539\n       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4539\n[  9 ] CVE-2016-4540\n       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4540\n[ 10 ] CVE-2016-4541\n       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4541\n[ 11 ] CVE-2016-4542\n       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4542\n[ 12 ] CVE-2016-4543\n       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4543\n[ 13 ] CVE-2016-4544\n       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4544\n[ 14 ] CVE-2016-5385\n       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-5385\n[ 15 ] CVE-2016-6289\n       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6289\n[ 16 ] CVE-2016-6290\n       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6290\n[ 17 ] CVE-2016-6291\n       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6291\n[ 18 ] CVE-2016-6292\n       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6292\n[ 19 ] CVE-2016-6294\n       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6294\n[ 20 ] CVE-2016-6295\n       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6295\n[ 21 ] CVE-2016-6296\n       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6296\n[ 22 ] CVE-2016-6297\n       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6297\n[ 23 ] CVE-2016-7124\n       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-7124\n[ 24 ] CVE-2016-7125\n       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-7125\n[ 25 ] CVE-2016-7126\n       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-7126\n[ 26 ] CVE-2016-7127\n       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-7127\n[ 27 ] CVE-2016-7128\n       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-7128\n[ 28 ] CVE-2016-7129\n       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-7129\n[ 29 ] CVE-2016-7130\n       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-7130\n[ 30 ] CVE-2016-7131\n       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-7131\n[ 31 ] CVE-2016-7132\n       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-7132\n[ 32 ] CVE-2016-7133\n       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-7133\n[ 33 ] CVE-2016-7134\n       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-7134\n[ 34 ] CVE-2016-7411\n       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-7411\n[ 35 ] CVE-2016-7412\n       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-7412\n[ 36 ] CVE-2016-7413\n       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-7413\n[ 37 ] CVE-2016-7414\n       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-7414\n[ 38 ] CVE-2016-7416\n       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-7416\n[ 39 ] CVE-2016-7417\n       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-7417\n[ 40 ] CVE-2016-7418\n       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-7418\n\nAvailability\n============\n\nThis GLSA and any updates to it are available for viewing at\nthe Gentoo Security Website:\n\n https://security.gentoo.org/glsa/201611-22\n\nConcerns?\n=========\n\nSecurity is a primary focus of Gentoo Linux and ensuring the\nconfidentiality and security of our users\u0027 machines is of utmost\nimportance to us. Any security concerns should be addressed to\nsecurity@gentoo.org or alternatively, you may file a bug at\nhttps://bugs.gentoo.org. \n\nLicense\n=======\n\nCopyright 2016 Gentoo Foundation, Inc; referenced text\nbelongs to its owner(s). \n\nThe contents of this document are licensed under the\nCreative Commons - Attribution / Share Alike license. \n\nhttp://creativecommons.org/licenses/by-sa/2.5\n\n\n. ==========================================================================\nUbuntu Security Notice USN-3686-1\nJune 14, 2018\n\nfile vulnerabilities\n==========================================================================\n\nA security issue affects these releases of Ubuntu and its derivatives:\n\n- Ubuntu 18.04 LTS\n- Ubuntu 17.10\n- Ubuntu 16.04 LTS\n- Ubuntu 14.04 LTS\n\nSummary:\n\nSeveral security issues were fixed in file. \n\nSoftware Description:\n- file: Tool to determine file types\n\nDetails:\n\nAlexander Cherepanov discovered that file incorrectly handled a large\nnumber of notes. An attacker could use this issue to cause a denial of\nservice. This issue only affected Ubuntu 14.04 LTS. (CVE-2014-9620)\n\nAlexander Cherepanov discovered that file incorrectly handled certain long\nstrings. An attacker could use this issue to cause a denial of service. \nThis issue only affected Ubuntu 14.04 LTS. (CVE-2014-9620)\n\nAlexander Cherepanov discovered that file incorrectly handled certain\nmalformed ELF files. This issue only affected\nUbuntu 14.04 LTS. (CVE-2014-9653)\n\nIt was discovered that file incorrectly handled certain magic files. This issue only\naffected Ubuntu 14.04 LTS. (CVE-2015-8865)\n\nIt was discovered that file incorrectly handled certain malformed ELF\nfiles. An attacker could use this issue to cause a denial of service. \n(CVE-2018-10360)\n\nUpdate instructions:\n\nThe problem can be corrected by updating your system to the following\npackage versions:\n\nUbuntu 18.04 LTS:\n  file                            1:5.32-2ubuntu0.1\n  libmagic1                       1:5.32-2ubuntu0.1\n\nUbuntu 17.10:\n  file                            1:5.32-1ubuntu0.1\n  libmagic1                       1:5.32-1ubuntu0.1\n\nUbuntu 16.04 LTS:\n  file                            1:5.25-2ubuntu1.1\n  libmagic1                       1:5.25-2ubuntu1.1\n\nUbuntu 14.04 LTS:\n  file                            1:5.14-2ubuntu3.4\n  libmagic1                       1:5.14-2ubuntu3.4\n\nIn general, a standard system update will make all the necessary changes",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2015-8865"
      },
      {
        "db": "BID",
        "id": "85802"
      },
      {
        "db": "VULHUB",
        "id": "VHN-86826"
      },
      {
        "db": "VULMON",
        "id": "CVE-2015-8865"
      },
      {
        "db": "PACKETSTORM",
        "id": "148367"
      },
      {
        "db": "PACKETSTORM",
        "id": "139729"
      },
      {
        "db": "PACKETSTORM",
        "id": "138463"
      },
      {
        "db": "PACKETSTORM",
        "id": "137086"
      },
      {
        "db": "PACKETSTORM",
        "id": "140540"
      },
      {
        "db": "PACKETSTORM",
        "id": "139968"
      },
      {
        "db": "PACKETSTORM",
        "id": "148192"
      }
    ],
    "trust": 1.98
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2015-8865",
        "trust": 2.8
      },
      {
        "db": "OPENWALL",
        "id": "OSS-SECURITY/2016/04/24/1",
        "trust": 1.8
      },
      {
        "db": "BID",
        "id": "85802",
        "trust": 1.5
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201604-556",
        "trust": 0.7
      },
      {
        "db": "PACKETSTORM",
        "id": "148367",
        "trust": 0.2
      },
      {
        "db": "PACKETSTORM",
        "id": "139968",
        "trust": 0.2
      },
      {
        "db": "PACKETSTORM",
        "id": "137086",
        "trust": 0.2
      },
      {
        "db": "PACKETSTORM",
        "id": "136841",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "137174",
        "trust": 0.1
      },
      {
        "db": "VULHUB",
        "id": "VHN-86826",
        "trust": 0.1
      },
      {
        "db": "VULMON",
        "id": "CVE-2015-8865",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "139729",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "138463",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "140540",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "148192",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-86826"
      },
      {
        "db": "VULMON",
        "id": "CVE-2015-8865"
      },
      {
        "db": "BID",
        "id": "85802"
      },
      {
        "db": "PACKETSTORM",
        "id": "148367"
      },
      {
        "db": "PACKETSTORM",
        "id": "139729"
      },
      {
        "db": "PACKETSTORM",
        "id": "138463"
      },
      {
        "db": "PACKETSTORM",
        "id": "137086"
      },
      {
        "db": "PACKETSTORM",
        "id": "140540"
      },
      {
        "db": "PACKETSTORM",
        "id": "139968"
      },
      {
        "db": "PACKETSTORM",
        "id": "148192"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201604-556"
      },
      {
        "db": "NVD",
        "id": "CVE-2015-8865"
      }
    ]
  },
  "id": "VAR-201605-0133",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-86826"
      }
    ],
    "trust": 0.01
  },
  "last_update_date": "2026-03-09T20:47:55.968000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "PHP Fileinfo Fixes for component buffer overflow vulnerabilities",
        "trust": 0.6,
        "url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=61239"
      },
      {
        "title": "Debian CVElist Bug Report Logs: file: CVE-2015-8865: file_check_mem() misbehaves on some input",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=debian_cvelist_bugreportlogs\u0026qid=357578556d837956c999174963fd2eea"
      },
      {
        "title": "Ubuntu Security Notice: file vulnerabilities",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=ubuntu_security_notice\u0026qid=USN-3686-2"
      },
      {
        "title": "Red Hat: CVE-2015-8865",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_cve_database\u0026qid=CVE-2015-8865"
      },
      {
        "title": "Ubuntu Security Notice: file vulnerabilities",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=ubuntu_security_notice\u0026qid=USN-3686-1"
      },
      {
        "title": "Debian Security Advisories: DSA-3560-1 php5 -- security update",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=debian_security_advisories\u0026qid=9f33dfec360e1186a6d0f52314de3ce6"
      },
      {
        "title": "Amazon Linux AMI: ALAS-2016-698",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=amazon_linux_ami\u0026qid=ALAS-2016-698"
      },
      {
        "title": "Ubuntu Security Notice: php5, php7.0 vulnerabilities",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=ubuntu_security_notice\u0026qid=USN-2984-1"
      },
      {
        "title": "Debian CVElist Bug Report Logs: hhvm: Various CVEs (CVE-2014-9709 CVE-2015-8865 CVE-2016-1903 CVE-2016-4070 CVE-2016-4539 CVE-2016-6870 CVE-2016-6871 CVE-2016-6872 CVE-2016-6873 CVE-2016-6874 CVE-2016-6875)",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=debian_cvelist_bugreportlogs\u0026qid=98d16dc1a3e1824eeb9ad5c28e1a0a02"
      },
      {
        "title": "Red Hat: Moderate: rh-php56 security, bug fix, and enhancement update",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20162750 - Security Advisory"
      },
      {
        "title": "Apple: OS X El Capitan v10.11.5 and Security Update 2016-003",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=apple_security_advisories\u0026qid=3c550201b398ce302f3a9adf27215fda"
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2015-8865"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201604-556"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-119",
        "trust": 1.1
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-86826"
      },
      {
        "db": "NVD",
        "id": "CVE-2015-8865"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 2.1,
        "url": "https://bugs.php.net/bug.php?id=71527"
      },
      {
        "trust": 1.8,
        "url": "http://lists.apple.com/archives/security-announce/2016/may/msg00004.html"
      },
      {
        "trust": 1.8,
        "url": "http://bugs.gw.com/view.php?id=522"
      },
      {
        "trust": 1.8,
        "url": "http://www.php.net/changelog-5.php"
      },
      {
        "trust": 1.8,
        "url": "http://www.php.net/changelog-7.php"
      },
      {
        "trust": 1.8,
        "url": "https://github.com/file/file/commit/6713ca45e7757297381f4b4cdb9cf5e624a9ad36"
      },
      {
        "trust": 1.8,
        "url": "https://support.apple.com/ht206567"
      },
      {
        "trust": 1.8,
        "url": "http://www.openwall.com/lists/oss-security/2016/04/24/1"
      },
      {
        "trust": 1.3,
        "url": "https://security.gentoo.org/glsa/201611-22"
      },
      {
        "trust": 1.3,
        "url": "https://security.gentoo.org/glsa/201701-42"
      },
      {
        "trust": 1.3,
        "url": "http://rhn.redhat.com/errata/rhsa-2016-2750.html"
      },
      {
        "trust": 1.3,
        "url": "https://usn.ubuntu.com/3686-2/"
      },
      {
        "trust": 1.2,
        "url": "http://www.securityfocus.com/bid/85802"
      },
      {
        "trust": 1.2,
        "url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docdisplay?docid=emr_na-c05240731"
      },
      {
        "trust": 1.2,
        "url": "http://www.debian.org/security/2016/dsa-3560"
      },
      {
        "trust": 1.2,
        "url": "http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00057.html"
      },
      {
        "trust": 1.2,
        "url": "http://www.ubuntu.com/usn/usn-2952-1"
      },
      {
        "trust": 1.2,
        "url": "http://www.ubuntu.com/usn/usn-2952-2"
      },
      {
        "trust": 1.2,
        "url": "https://usn.ubuntu.com/3686-1/"
      },
      {
        "trust": 1.1,
        "url": "http://git.php.net/?p=php-src.git;a=commit;h=fe13566c93f118a15a96320a546c7878fd0cfc5e"
      },
      {
        "trust": 1.0,
        "url": "http://git.php.net/?p=php-src.git%3ba=commit%3bh=fe13566c93f118a15a96320a546c7878fd0cfc5e"
      },
      {
        "trust": 0.7,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2015-8865"
      },
      {
        "trust": 0.3,
        "url": "http://php.net/changelog-5.php"
      },
      {
        "trust": 0.3,
        "url": "http://php.net/changelog-7.php"
      },
      {
        "trust": 0.3,
        "url": "http://www.php.net/"
      },
      {
        "trust": 0.2,
        "url": "https://usn.ubuntu.com/usn/usn-3686-1"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-10360"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2015-8386"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2013-7456"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2015-8391"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-1903"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2015-8383"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2015-8874"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-4537"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-3074"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-4538"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-4072"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-4071"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-4073"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-4539"
      },
      {
        "trust": 0.2,
        "url": "http://creativecommons.org/licenses/by-sa/2.5"
      },
      {
        "trust": 0.2,
        "url": "https://bugs.gentoo.org."
      },
      {
        "trust": 0.2,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2015-8865"
      },
      {
        "trust": 0.2,
        "url": "https://security.gentoo.org/"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2014-9653"
      },
      {
        "trust": 0.1,
        "url": "https://cwe.mitre.org/data/definitions/119.html"
      },
      {
        "trust": 0.1,
        "url": "https://www.rapid7.com/db/vulnerabilities/apple-osx-apachemodphp-cve-2015-8865"
      },
      {
        "trust": 0.1,
        "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=827377"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov"
      },
      {
        "trust": 0.1,
        "url": "https://usn.ubuntu.com/usn/usn-3686-2"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2016-6292"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2015-8395"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2016-6288"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2016-6290"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2015-3217"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2016-4073"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2015-8384"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2015-8877"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2015-8381"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/articles/11258"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2015-8876"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2016-7125"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2015-8879"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2016-4541"
      },
      {
        "trust": 0.1,
        "url": "https://www.redhat.com/mailman/listinfo/rhsa-announce"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2016-5093"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2015-8383"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2016-6128"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2015-2326"
      },
      {
        "trust": 0.1,
        "url": "https://bugzilla.redhat.com/):"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2016-5771"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2016-5094"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2015-8392"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2016-6207"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2015-2325"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2016-1903"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2015-8395"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2016-7129"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2016-4540"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2016-4343"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2016-7132"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2016-4072"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2016-6294"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2016-5114"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2015-8866"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2016-4538"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2015-8385"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2016-7130"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2015-2327"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2016-6291"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/team/contact/"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2015-8835"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2015-8384"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2016-4342"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2015-8392"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2016-5773"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2015-8865"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2015-8877"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2015-3210"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2016-7124"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2016-5766"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2016-5767"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2014-9767"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2013-7456"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2016-7128"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2016-4543"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2016-4537"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2015-8385"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2015-8386"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2016-6297"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2015-8867"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2015-5073"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2016-7126"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2015-8391"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2016-5772"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2015-8388"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2016-5399"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2016-3074"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2015-5073"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2016-6295"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2016-4544"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2015-2327"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2015-8835"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2016-2554"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2015-3217"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2016-4539"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2015-2325"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2016-6289"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2016-6296"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2015-8867"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2016-4473"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2015-8876"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2015-8874"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2015-8873"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2015-2326"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2016-5770"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2015-8388"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2014-9767"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2015-2328"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2016-4542"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2016-5768"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2015-8866"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2016-5096"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2016-4071"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2015-8381"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2016-3141"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2015-8873"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2016-7127"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2015-8879"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2016-4070"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2016-3142"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/team/key/"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2015-3210"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2016-7131"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2015-2328"
      },
      {
        "trust": 0.1,
        "url": "http://www.hpe.com/support/security_bulletin_archive"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2015-8853"
      },
      {
        "trust": 0.1,
        "url": "https://h20564.www2.hpe.com/hpsc/doc/public/display?docid=emr_na-c05240731"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-4070"
      },
      {
        "trust": 0.1,
        "url": "http://www.hpe.com/support/subscriber_choice"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2015-8393"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-1238"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-2381"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2015-8387"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-2554"
      },
      {
        "trust": 0.1,
        "url": "https://h20564.www2.hpe.com/hpsc/doc/public/display?docid=emr_na-c01345499"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2014-4330"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-4343"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2015-8389"
      },
      {
        "trust": 0.1,
        "url": "https://www.hpe.com/info/report-security-vulnerability"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2015-8394"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2015-8607"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2015-8390"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-4342"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-1795"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-1799"
      },
      {
        "trust": 0.1,
        "url": "https://gpgtools.org"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-1806"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-1814"
      },
      {
        "trust": 0.1,
        "url": "http://www.knownsec.com]"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-1798"
      },
      {
        "trust": 0.1,
        "url": "http://www.apple.com/support/downloads/"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-1817"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-1805"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-1804"
      },
      {
        "trust": 0.1,
        "url": "https://www.linkedin.com/in/rshupak)"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-1803"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-1797"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-1793"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-1800"
      },
      {
        "trust": 0.1,
        "url": "https://support.apple.com/en-us/ht206565"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-1808"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-1794"
      },
      {
        "trust": 0.1,
        "url": "https://www.apple.com/support/security/pgp/"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-1810"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-1813"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-1811"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-1796"
      },
      {
        "trust": 0.1,
        "url": "http://support.apple.com/kb/ht201222"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-1816"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-1807"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-1815"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-1791"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-1801"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-1812"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-1792"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-1802"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-1809"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-9652"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2014-9652"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-3710"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-9653"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2014-3710"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2016-6297"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2016-7131"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2016-7417"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2016-4542"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-6297"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-7124"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2016-7124"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2016-7125"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2016-7129"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2016-4538"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2016-7132"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-4542"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2016-6292"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2016-7416"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-5385"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-7126"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-4544"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-6289"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2016-6289"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2016-7128"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2016-4073"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-6295"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2016-6296"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2016-5385"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2016-4539"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2016-4072"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-7128"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-6290"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2016-7134"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2016-7411"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2016-4537"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2016-7413"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2016-4541"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2016-7130"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-6292"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2016-6290"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2016-7414"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-6291"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2016-4544"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-7127"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-4543"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2016-6294"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2016-7126"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-4541"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2016-4071"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2016-7133"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2016-6295"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2016-6291"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-6294"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-7125"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2016-4543"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2016-4540"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-4540"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-7129"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2016-7412"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-6296"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2016-7418"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2016-7127"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2016-3074"
      },
      {
        "trust": 0.1,
        "url": "https://launchpad.net/ubuntu/+source/file/1:5.25-2ubuntu1.1"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2014-9621"
      },
      {
        "trust": 0.1,
        "url": "https://launchpad.net/ubuntu/+source/file/1:5.14-2ubuntu3.4"
      },
      {
        "trust": 0.1,
        "url": "https://launchpad.net/ubuntu/+source/file/1:5.32-2ubuntu0.1"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2014-9620"
      },
      {
        "trust": 0.1,
        "url": "https://launchpad.net/ubuntu/+source/file/1:5.32-1ubuntu0.1"
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-86826"
      },
      {
        "db": "VULMON",
        "id": "CVE-2015-8865"
      },
      {
        "db": "BID",
        "id": "85802"
      },
      {
        "db": "PACKETSTORM",
        "id": "148367"
      },
      {
        "db": "PACKETSTORM",
        "id": "139729"
      },
      {
        "db": "PACKETSTORM",
        "id": "138463"
      },
      {
        "db": "PACKETSTORM",
        "id": "137086"
      },
      {
        "db": "PACKETSTORM",
        "id": "140540"
      },
      {
        "db": "PACKETSTORM",
        "id": "139968"
      },
      {
        "db": "PACKETSTORM",
        "id": "148192"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201604-556"
      },
      {
        "db": "NVD",
        "id": "CVE-2015-8865"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "VULHUB",
        "id": "VHN-86826"
      },
      {
        "db": "VULMON",
        "id": "CVE-2015-8865"
      },
      {
        "db": "BID",
        "id": "85802"
      },
      {
        "db": "PACKETSTORM",
        "id": "148367"
      },
      {
        "db": "PACKETSTORM",
        "id": "139729"
      },
      {
        "db": "PACKETSTORM",
        "id": "138463"
      },
      {
        "db": "PACKETSTORM",
        "id": "137086"
      },
      {
        "db": "PACKETSTORM",
        "id": "140540"
      },
      {
        "db": "PACKETSTORM",
        "id": "139968"
      },
      {
        "db": "PACKETSTORM",
        "id": "148192"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201604-556"
      },
      {
        "db": "NVD",
        "id": "CVE-2015-8865"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2016-05-20T00:00:00",
        "db": "VULHUB",
        "id": "VHN-86826"
      },
      {
        "date": "2016-05-20T00:00:00",
        "db": "VULMON",
        "id": "CVE-2015-8865"
      },
      {
        "date": "2016-04-02T00:00:00",
        "db": "BID",
        "id": "85802"
      },
      {
        "date": "2018-06-29T00:19:16",
        "db": "PACKETSTORM",
        "id": "148367"
      },
      {
        "date": "2016-11-15T16:44:45",
        "db": "PACKETSTORM",
        "id": "139729"
      },
      {
        "date": "2016-08-22T18:18:17",
        "db": "PACKETSTORM",
        "id": "138463"
      },
      {
        "date": "2016-05-17T16:06:24",
        "db": "PACKETSTORM",
        "id": "137086"
      },
      {
        "date": "2017-01-17T15:34:19",
        "db": "PACKETSTORM",
        "id": "140540"
      },
      {
        "date": "2016-12-01T16:38:01",
        "db": "PACKETSTORM",
        "id": "139968"
      },
      {
        "date": "2018-06-14T15:57:22",
        "db": "PACKETSTORM",
        "id": "148192"
      },
      {
        "date": "2016-04-25T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201604-556"
      },
      {
        "date": "2016-05-20T10:59:00.137000",
        "db": "NVD",
        "id": "CVE-2015-8865"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2018-06-30T00:00:00",
        "db": "VULHUB",
        "id": "VHN-86826"
      },
      {
        "date": "2018-06-30T00:00:00",
        "db": "VULMON",
        "id": "CVE-2015-8865"
      },
      {
        "date": "2017-01-23T09:11:00",
        "db": "BID",
        "id": "85802"
      },
      {
        "date": "2016-05-23T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201604-556"
      },
      {
        "date": "2025-04-12T10:46:40.837000",
        "db": "NVD",
        "id": "CVE-2015-8865"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "PACKETSTORM",
        "id": "140540"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201604-556"
      }
    ],
    "trust": 0.7
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "PHP Fileinfo Component file Security hole",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201604-556"
      }
    ],
    "trust": 0.6
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "buffer overflow",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201604-556"
      }
    ],
    "trust": 0.6
  }
}

CVE-2015-8865 (GCVE-0-2015-8865)

Vulnerability from cvelistv5 – Published: 2016-05-20 10:00 – Updated: 2024-08-06 08:29

Summary

Severity ?

No CVSS data available.

CWE

Assigner

mitre

References

URL

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

VAR-201605-0133

Background

Synopsis

Background

Workaround

Resolution

References

Availability

Concerns?

License

file vulnerabilities

CVE-2015-8865 (GCVE-0-2015-8865)

Tags

Sightings

Nomenclature