CVE-2015-4642
The escapeshellarg function in ext/standard/exec.c in PHP before 5.4.42, 5.5.x before 5.5.26, and 5.6.x before 5.6.10…
Severidad por fuente
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD. Más baja según Amazon (media).
Descripción
The escapeshellarg function in ext/standard/exec.c in PHP before 5.4.42, 5.5.x before 5.5.26, and 5.6.x before 5.6.10 on Windows allows remote attackers to execute arbitrary OS commands via a crafted string to an application that accepts command-line arguments for a call to the PHP system function.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| amazon linux 1 | php54, php54-bcmath, php54-cli y 90 más | 5.4.42-1.71.amzn1 y 2 más |
Mostrar las 93 entradas de 1 fuente
| Fuente | Paquete | Corregido en |
|---|---|---|
| amazon linux 1 | php54 | 5.4.42-1.71.amzn1 |
| amazon linux 1 | php54-bcmath | 5.4.42-1.71.amzn1 |
| amazon linux 1 | php54-cli | 5.4.42-1.71.amzn1 |
| amazon linux 1 | php54-common | 5.4.42-1.71.amzn1 |
| amazon linux 1 | php54-dba | 5.4.42-1.71.amzn1 |
| amazon linux 1 | php54-debuginfo | 5.4.42-1.71.amzn1 |
| amazon linux 1 | php54-devel | 5.4.42-1.71.amzn1 |
| amazon linux 1 | php54-embedded | 5.4.42-1.71.amzn1 |
| amazon linux 1 | php54-enchant | 5.4.42-1.71.amzn1 |
| amazon linux 1 | php54-fpm | 5.4.42-1.71.amzn1 |
| amazon linux 1 | php54-gd | 5.4.42-1.71.amzn1 |
| amazon linux 1 | php54-imap | 5.4.42-1.71.amzn1 |
| amazon linux 1 | php54-intl | 5.4.42-1.71.amzn1 |
| amazon linux 1 | php54-ldap | 5.4.42-1.71.amzn1 |
| amazon linux 1 | php54-mbstring | 5.4.42-1.71.amzn1 |
| amazon linux 1 | php54-mcrypt | 5.4.42-1.71.amzn1 |
| amazon linux 1 | php54-mssql | 5.4.42-1.71.amzn1 |
| amazon linux 1 | php54-mysql | 5.4.42-1.71.amzn1 |
| amazon linux 1 | php54-mysqlnd | 5.4.42-1.71.amzn1 |
| amazon linux 1 | php54-odbc | 5.4.42-1.71.amzn1 |
| amazon linux 1 | php54-pdo | 5.4.42-1.71.amzn1 |
| amazon linux 1 | php54-pgsql | 5.4.42-1.71.amzn1 |
| amazon linux 1 | php54-process | 5.4.42-1.71.amzn1 |
| amazon linux 1 | php54-pspell | 5.4.42-1.71.amzn1 |
| amazon linux 1 | php54-recode | 5.4.42-1.71.amzn1 |
| amazon linux 1 | php54-snmp | 5.4.42-1.71.amzn1 |
| amazon linux 1 | php54-soap | 5.4.42-1.71.amzn1 |
| amazon linux 1 | php54-tidy | 5.4.42-1.71.amzn1 |
| amazon linux 1 | php54-xml | 5.4.42-1.71.amzn1 |
| amazon linux 1 | php54-xmlrpc | 5.4.42-1.71.amzn1 |
| amazon linux 1 | php55 | 5.5.26-1.103.amzn1 |
| amazon linux 1 | php55-bcmath | 5.5.26-1.103.amzn1 |
| amazon linux 1 | php55-cli | 5.5.26-1.103.amzn1 |
| amazon linux 1 | php55-common | 5.5.26-1.103.amzn1 |
| amazon linux 1 | php55-dba | 5.5.26-1.103.amzn1 |
| amazon linux 1 | php55-debuginfo | 5.5.26-1.103.amzn1 |
| amazon linux 1 | php55-devel | 5.5.26-1.103.amzn1 |
| amazon linux 1 | php55-embedded | 5.5.26-1.103.amzn1 |
| amazon linux 1 | php55-enchant | 5.5.26-1.103.amzn1 |
| amazon linux 1 | php55-fpm | 5.5.26-1.103.amzn1 |
| amazon linux 1 | php55-gd | 5.5.26-1.103.amzn1 |
| amazon linux 1 | php55-gmp | 5.5.26-1.103.amzn1 |
| amazon linux 1 | php55-imap | 5.5.26-1.103.amzn1 |
| amazon linux 1 | php55-intl | 5.5.26-1.103.amzn1 |
| amazon linux 1 | php55-ldap | 5.5.26-1.103.amzn1 |
| amazon linux 1 | php55-mbstring | 5.5.26-1.103.amzn1 |
| amazon linux 1 | php55-mcrypt | 5.5.26-1.103.amzn1 |
| amazon linux 1 | php55-mssql | 5.5.26-1.103.amzn1 |
| amazon linux 1 | php55-mysqlnd | 5.5.26-1.103.amzn1 |
| amazon linux 1 | php55-odbc | 5.5.26-1.103.amzn1 |
| amazon linux 1 | php55-opcache | 5.5.26-1.103.amzn1 |
| amazon linux 1 | php55-pdo | 5.5.26-1.103.amzn1 |
| amazon linux 1 | php55-pgsql | 5.5.26-1.103.amzn1 |
| amazon linux 1 | php55-process | 5.5.26-1.103.amzn1 |
| amazon linux 1 | php55-pspell | 5.5.26-1.103.amzn1 |
| amazon linux 1 | php55-recode | 5.5.26-1.103.amzn1 |
| amazon linux 1 | php55-snmp | 5.5.26-1.103.amzn1 |
| amazon linux 1 | php55-soap | 5.5.26-1.103.amzn1 |
| amazon linux 1 | php55-tidy | 5.5.26-1.103.amzn1 |
| amazon linux 1 | php55-xml | 5.5.26-1.103.amzn1 |
| amazon linux 1 | php55-xmlrpc | 5.5.26-1.103.amzn1 |
| amazon linux 1 | php56 | 5.6.10-1.115.amzn1 |
| amazon linux 1 | php56-bcmath | 5.6.10-1.115.amzn1 |
| amazon linux 1 | php56-cli | 5.6.10-1.115.amzn1 |
| amazon linux 1 | php56-common | 5.6.10-1.115.amzn1 |
| amazon linux 1 | php56-dba | 5.6.10-1.115.amzn1 |
| amazon linux 1 | php56-dbg | 5.6.10-1.115.amzn1 |
| amazon linux 1 | php56-debuginfo | 5.6.10-1.115.amzn1 |
| amazon linux 1 | php56-devel | 5.6.10-1.115.amzn1 |
| amazon linux 1 | php56-embedded | 5.6.10-1.115.amzn1 |
| amazon linux 1 | php56-enchant | 5.6.10-1.115.amzn1 |
| amazon linux 1 | php56-fpm | 5.6.10-1.115.amzn1 |
| amazon linux 1 | php56-gd | 5.6.10-1.115.amzn1 |
| amazon linux 1 | php56-gmp | 5.6.10-1.115.amzn1 |
| amazon linux 1 | php56-imap | 5.6.10-1.115.amzn1 |
| amazon linux 1 | php56-intl | 5.6.10-1.115.amzn1 |
| amazon linux 1 | php56-ldap | 5.6.10-1.115.amzn1 |
| amazon linux 1 | php56-mbstring | 5.6.10-1.115.amzn1 |
| amazon linux 1 | php56-mcrypt | 5.6.10-1.115.amzn1 |
| amazon linux 1 | php56-mssql | 5.6.10-1.115.amzn1 |
| amazon linux 1 | php56-mysqlnd | 5.6.10-1.115.amzn1 |
| amazon linux 1 | php56-odbc | 5.6.10-1.115.amzn1 |
| amazon linux 1 | php56-opcache | 5.6.10-1.115.amzn1 |
| amazon linux 1 | php56-pdo | 5.6.10-1.115.amzn1 |
| amazon linux 1 | php56-pgsql | 5.6.10-1.115.amzn1 |
| amazon linux 1 | php56-process | 5.6.10-1.115.amzn1 |
| amazon linux 1 | php56-pspell | 5.6.10-1.115.amzn1 |
| amazon linux 1 | php56-recode | 5.6.10-1.115.amzn1 |
| amazon linux 1 | php56-snmp | 5.6.10-1.115.amzn1 |
| amazon linux 1 | php56-soap | 5.6.10-1.115.amzn1 |
| amazon linux 1 | php56-tidy | 5.6.10-1.115.amzn1 |
| amazon linux 1 | php56-xml | 5.6.10-1.115.amzn1 |
| amazon linux 1 | php56-xmlrpc | 5.6.10-1.115.amzn1 |
Referencias
- http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=d2ac264ffea5ca2e85640b6736e0c7cd4ee9a4a9
- http://openwall.com/lists/oss-security/2015/06/18/6
- http://php.net/ChangeLog-5.php
- http://www.securityfocus.com/bid/75290
- http://www.securitytracker.com/id/1032709
- https://bugs.php.net/bug.php?id=69646
- https://security.gentoo.org/glsa/201606-10