Executive Summary



This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
Summary
Title php security update
Informations
Name RHSA-2007:0891 First vendor Publication 2007-10-25
Vendor RedHat Last vendor Modification 2007-10-25
Severity (Vendor) Moderate Revision 01

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:P/I:P/A:P)
Cvss Base Score 7.5 Attack Range Network
Cvss Impact Score 6.4 Attack Complexity Low
Cvss Expoit Score 10 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Problem Description:

Updated PHP packages that fix several security issues are now available for Red Hat Application Stack.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

2. Relevant releases/architectures:

Red Hat Application Stack v1 for Enterprise Linux AS (v.4) - i386, x86_64 Red Hat Application Stack v1 for Enterprise Linux ES (v.4) - i386, x86_64

3. Problem description:

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Web server.

These updated packages address the following vulnerabilities:

Various integer overflow flaws were found in the PHP gd extension. A script that could be forced to resize images from an untrusted source could possibly allow a remote attacker to execute arbitrary code as the apache user. (CVE-2007-3996)

An integer overflow flaw was found in the PHP chunk_split function. If a remote attacker was able to pass arbitrary data to the third argument of chunk_split they could possibly execute arbitrary code as the apache user. Note that it is unusual for a PHP script to use the chunk_script function with a user-supplied third argument. (CVE-2007-2872)

A previous security update introduced a bug into PHP session cookie handling. This could allow an attacker to stop a victim from viewing a vulnerable web site if the victim has first visited a malicious web page under the control of the attacker, and that page can set a cookie for the vulnerable web site. (CVE-2007-4670)

A flaw was found in the PHP money_format function. If a remote attacker was able to pass arbitrary data to the money_format function this could possibly result in an information leak or denial of service. Note that is is unusual for a PHP script to pass user-supplied data to the money_format function. (CVE-2007-4658)

A flaw was found in the PHP wordwrap function. If a remote attacker was able to pass arbitrary data to the wordwrap function this could possibly result in a denial of service. (CVE-2007-3998)

A bug was found in PHP session cookie handling. This could allow an attacker to create a cross-site cookie insertion attack if a victim follows an untrusted carefully-crafted URL. (CVE-2007-3799)

An infinite-loop flaw was discovered in the PHP gd extension. A script that could be forced to process PNG images from an untrusted source could allow a remote attacker to cause a denial of service. (CVE-2007-2756)

Users of PHP should upgrade to these updated packages which contain backported patches to correct these issues.

4. Solution:

Before applying this update, make sure that all previously-released errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at http://kbase.redhat.com/faq/FAQ_58_10188

5. Bug IDs fixed (http://bugzilla.redhat.com/):

242032 - CVE-2007-2872 php chunk_split integer overflow 242033 - CVE-2007-2756 php imagecreatefrompng infinite loop 250726 - CVE-2007-3799 php cross-site cookie insertion 276081 - CVE-2007-3998 php floating point exception inside wordwrap 278011 - CVE-2007-4658 php money_format format string issue 278031 - CVE-2007-3996 php multiple integer overflows in gd 278041 - CVE-2007-4670 php malformed cookie handling

Original Source

Url : https://rhn.redhat.com/errata/RHSA-2007-0891.html

CWE : Common Weakness Enumeration

% Id Name
50 % CWE-189 Numeric Errors (CWE/SANS Top 25)
50 % CWE-20 Improper Input Validation

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:10363
 
Oval ID: oval:org.mitre.oval:def:10363
Title: The money_format function in PHP 5 before 5.2.4, and PHP 4 before 4.4.8, permits multiple (1) %i and (2) %n tokens, which has unknown impact and attack vectors, possibly related to a format string vulnerability.
Description: The money_format function in PHP 5 before 5.2.4, and PHP 4 before 4.4.8, permits multiple (1) %i and (2) %n tokens, which has unknown impact and attack vectors, possibly related to a format string vulnerability.
Family: unix Class: vulnerability
Reference(s): CVE-2007-4658
 Version: 5
Platform(s): Red Hat Enterprise Linux 3
CentOS Linux 3
Red Hat Enterprise Linux 4
CentOS Linux 4
Oracle Linux 4
Red Hat Enterprise Linux 5
CentOS Linux 5
Oracle Linux 5
 Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:10603
 
Oval ID: oval:org.mitre.oval:def:10603
Title: The wordwrap function in PHP 4 before 4.4.8, and PHP 5 before 5.2.4, does not properly use the breakcharlen variable, which allows remote attackers to cause a denial of service (divide-by-zero error and application crash, or infinite loop) via certain arguments, as demonstrated by a 'chr(0), 0, ""' argument set.
Description: The wordwrap function in PHP 4 before 4.4.8, and PHP 5 before 5.2.4, does not properly use the breakcharlen variable, which allows remote attackers to cause a denial of service (divide-by-zero error and application crash, or infinite loop) via certain arguments, as demonstrated by a 'chr(0), 0, ""' argument set.
Family: unix Class: vulnerability
Reference(s): CVE-2007-3998
 Version: 5
Platform(s): Red Hat Enterprise Linux 3
CentOS Linux 3
Red Hat Enterprise Linux 4
CentOS Linux 4
Oracle Linux 4
Red Hat Enterprise Linux 5
CentOS Linux 5
Oracle Linux 5
 Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:10779
 
Oval ID: oval:org.mitre.oval:def:10779
Title: The gdPngReadData function in libgd 2.0.34 allows user-assisted attackers to cause a denial of service (CPU consumption) via a crafted PNG image with truncated data, which causes an infinite loop in the png_read_info function in libpng.
Description: The gdPngReadData function in libgd 2.0.34 allows user-assisted attackers to cause a denial of service (CPU consumption) via a crafted PNG image with truncated data, which causes an infinite loop in the png_read_info function in libpng.
Family: unix Class: vulnerability
Reference(s): CVE-2007-2756
 Version: 5
Platform(s): Red Hat Enterprise Linux 3
CentOS Linux 3
Red Hat Enterprise Linux 4
CentOS Linux 4
Oracle Linux 4
Red Hat Enterprise Linux 5
CentOS Linux 5
Oracle Linux 5
 Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:11028
 
Oval ID: oval:org.mitre.oval:def:11028
Title: Unspecified vulnerability in PHP before 5.2.4 has unknown impact and attack vectors, related to an "Improved fix for MOPB-03-2007," probably a variant of CVE-2007-1285.
Description: Unspecified vulnerability in PHP before 5.2.4 has unknown impact and attack vectors, related to an "Improved fix for MOPB-03-2007," probably a variant of CVE-2007-1285.
Family: unix Class: vulnerability
Reference(s): CVE-2007-4670
 Version: 5
Platform(s): Red Hat Enterprise Linux 3
CentOS Linux 3
Red Hat Enterprise Linux 4
CentOS Linux 4
Oracle Linux 4
Red Hat Enterprise Linux 5
CentOS Linux 5
Oracle Linux 5
 Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:11147
 
Oval ID: oval:org.mitre.oval:def:11147
Title: Multiple integer overflows in libgd in PHP before 5.2.4 allow remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a large (1) srcW or (2) srcH value to the (a) gdImageCopyResized function, or a large (3) sy (height) or (4) sx (width) value to the (b) gdImageCreate or the (c) gdImageCreateTrueColor function.
Description: Multiple integer overflows in libgd in PHP before 5.2.4 allow remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a large (1) srcW or (2) srcH value to the (a) gdImageCopyResized function, or a large (3) sy (height) or (4) sx (width) value to the (b) gdImageCreate or the (c) gdImageCreateTrueColor function.
Family: unix Class: vulnerability
Reference(s): CVE-2007-3996
 Version: 5
Platform(s): Red Hat Enterprise Linux 3
CentOS Linux 3
Red Hat Enterprise Linux 4
CentOS Linux 4
Oracle Linux 4
Red Hat Enterprise Linux 5
CentOS Linux 5
Oracle Linux 5
 Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:13729
 
Oval ID: oval:org.mitre.oval:def:13729
Title: USN-720-1 -- php5 vulnerabilities
Description: It was discovered that PHP did not properly enforce php_admin_value and php_admin_flag restrictions in the Apache configuration file. A local attacker could create a specially crafted PHP script that would bypass intended security restrictions. This issue only applied to Ubuntu 6.06 LTS, 7.10, and 8.04 LTS. It was discovered that PHP did not correctly handle certain malformed font files. If a PHP application were tricked into processing a specially crafted font file, an attacker may be able to cause a denial of service and possibly execute arbitrary code with application privileges. It was discovered that PHP did not properly check the delimiter argument to the explode function. If a script passed untrusted input to the explode function, an attacker could cause a denial of service and possibly execute arbitrary code with application privileges. It was discovered that PHP, when used as FastCGI module, did not properly sanitize requests. By performing a request with multiple dots preceding the extension, an attacker could cause a denial of service. It was discovered that PHP did not properly handle Unicode conversion in the mbstring extension. If a PHP application were tricked into processing a specially crafted string containing an HTML entity, an attacker could execute arbitrary code with application privileges. It was discovered that PHP did not properly initialize the page_uid and page_gid global variables for use by the SAPI php_getuid function. An attacker could exploit this issue to bypass safe_mode restrictions. It was dicovered that PHP did not properly enforce error_log safe_mode restrictions when set by php_admin_flag in the Apache configuration file. A local attacker could create a specially crafted PHP script that would overwrite arbitrary files. It was discovered that PHP contained a flaw in the ZipArchive::extractTo function. If a PHP application were tricked into processing a specially crafted zip file that had filenames containing "..", an attacker could write arbitrary files within the filesystem. This issue only applied to Ubuntu 7.10, 8.04 LTS, and 8.10. USN-557-1 fixed a vulnerability in the GD library. When using the GD library, PHP did not properly handle the return codes that were added in the security update. An attacker could exploit this issue with a specially crafted image file and cause PHP to crash, leading to a denial of service. This issue only applied to Ubuntu 6.06 LTS, and 7.10
Family: unix Class: patch
Reference(s): USN-720-1
CVE-2007-5900
CVE-2008-3658
CVE-2008-3659
CVE-2008-3660
CVE-2008-5557
CVE-2008-5624
CVE-2008-5625
CVE-2008-5658
CVE-2007-3996
 Version: 5
Platform(s): Ubuntu 7.10
Ubuntu 8.04
Ubuntu 6.06
Ubuntu 8.10
 Product(s): php5
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:17679
 
Oval ID: oval:org.mitre.oval:def:17679
Title: USN-557-1 -- libgd2 vulnerability
Description: Mattias Bengtsson and Philip Olausson discovered that the GD library did not properly perform bounds checking when creating images.
Family: unix Class: patch
Reference(s): USN-557-1
CVE-2007-3996
 Version: 7
Platform(s): Ubuntu 6.06
Ubuntu 6.10
Ubuntu 7.04
Ubuntu 7.10
 Product(s): libgd2
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:22339
 
Oval ID: oval:org.mitre.oval:def:22339
Title: ELSA-2007:0890: php security update (Moderate)
Description: Unspecified vulnerability in PHP before 5.2.4 has unknown impact and attack vectors, related to an "Improved fix for MOPB-03-2007," probably a variant of CVE-2007-1285.
Family: unix Class: patch
Reference(s): ELSA-2007:0890-03
CVE-2007-2756
CVE-2007-2872
CVE-2007-3799
CVE-2007-3996
CVE-2007-3998
CVE-2007-4658
CVE-2007-4670
 Version: 33
Platform(s): Oracle Linux 5
 Product(s): php
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:9424
 
Oval ID: oval:org.mitre.oval:def:9424
Title: Multiple integer overflows in the chunk_split function in PHP 5 before 5.2.3 and PHP 4 before 4.4.8 allow remote attackers to cause a denial of service (crash) or execute arbitrary code via the (1) chunks, (2) srclen, and (3) chunklen arguments.
Description: Multiple integer overflows in the chunk_split function in PHP 5 before 5.2.3 and PHP 4 before 4.4.8 allow remote attackers to cause a denial of service (crash) or execute arbitrary code via the (1) chunks, (2) srclen, and (3) chunklen arguments.
Family: unix Class: vulnerability
Reference(s): CVE-2007-2872
 Version: 5
Platform(s): Red Hat Enterprise Linux 3
CentOS Linux 3
Red Hat Enterprise Linux 4
CentOS Linux 4
Oracle Linux 4
Red Hat Enterprise Linux 5
CentOS Linux 5
Oracle Linux 5
 Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:9792
 
Oval ID: oval:org.mitre.oval:def:9792
Title: The session_start function in ext/session in PHP 4.x up to 4.4.7 and 5.x up to 5.2.3 allows remote attackers to insert arbitrary attributes into the session cookie via special characters in a cookie that is obtained from (1) PATH_INFO, (2) the session_id function, and (3) the session_start function, which are not encoded or filtered when the new session cookie is generated, a related issue to CVE-2006-0207.
Description: The session_start function in ext/session in PHP 4.x up to 4.4.7 and 5.x up to 5.2.3 allows remote attackers to insert arbitrary attributes into the session cookie via special characters in a cookie that is obtained from (1) PATH_INFO, (2) the session_id function, and (3) the session_start function, which are not encoded or filtered when the new session cookie is generated, a related issue to CVE-2006-0207.
Family: unix Class: vulnerability
Reference(s): CVE-2007-3799
 Version: 5
Platform(s): Red Hat Enterprise Linux 3
CentOS Linux 3
Red Hat Enterprise Linux 4
CentOS Linux 4
Oracle Linux 4
Red Hat Enterprise Linux 5
CentOS Linux 5
Oracle Linux 5
 Product(s):
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 1
Application 298
Os 4
Os 2

OpenVAS Exploits

Date Description
2012-06-21 Name : PHP version smaller than 4.4.8
File : nvt/nopsec_php_4_4_8.nasl
2012-06-21 Name : PHP version smaller than 5.2.3
File : nvt/nopsec_php_5_2_3.nasl
2012-06-21 Name : PHP version smaller than 5.2.4
File : nvt/nopsec_php_5_2_4.nasl
2012-06-21 Name : PHP version smaller than 5.2.5
File : nvt/nopsec_php_5_2_5.nasl
2009-10-19 Name : Mandrake Security Advisory MDVSA-2009:264 (gd)
File : nvt/mdksa_2009_264.nasl
2009-10-10 Name : SLES9: Security update for PHP4
File : nvt/sles9p5015662.nasl
2009-10-10 Name : SLES9: Security update for PHP4
File : nvt/sles9p5015608.nasl
2009-10-10 Name : SLES9: Security update for PHP4
File : nvt/sles9p5012110.nasl
2009-10-10 Name : SLES9: Security update for gd
File : nvt/sles9p5009393.nasl
2009-06-05 Name : Ubuntu USN-720-1 (php5)
File : nvt/ubuntu_720_1.nasl
2009-06-05 Name : Ubuntu USN-719-1 (libpam-krb5)
File : nvt/ubuntu_719_1.nasl
2009-05-05 Name : HP-UX Update for Apache HPSBUX02262
File : nvt/gb_hp_ux_HPSBUX02262.nasl
2009-05-05 Name : HP-UX Update for Apache HPSBUX02308
File : nvt/gb_hp_ux_HPSBUX02308.nasl
2009-05-05 Name : HP-UX Update for Apache With PHP HPSBUX02332
File : nvt/gb_hp_ux_HPSBUX02332.nasl
2009-04-09 Name : Mandriva Update for gd MDKSA-2007:122 (gd)
File : nvt/gb_mandriva_MDKSA_2007_122.nasl
2009-04-09 Name : Mandriva Update for libwmf MDKSA-2007:123 (libwmf)
File : nvt/gb_mandriva_MDKSA_2007_123.nasl
2009-04-09 Name : Mandriva Update for tetex MDKSA-2007:124 (tetex)
File : nvt/gb_mandriva_MDKSA_2007_124.nasl
2009-04-09 Name : Mandriva Update for php MDKSA-2007:187 (php)
File : nvt/gb_mandriva_MDKSA_2007_187.nasl
2009-03-23 Name : Ubuntu Update for libgd2 vulnerabilities USN-473-1
File : nvt/gb_ubuntu_USN_473_1.nasl
2009-03-23 Name : Ubuntu Update for php5 vulnerabilities USN-549-1
File : nvt/gb_ubuntu_USN_549_1.nasl
2009-03-23 Name : Ubuntu Update for php5 regression USN-549-2
File : nvt/gb_ubuntu_USN_549_2.nasl
2009-03-23 Name : Ubuntu Update for libgd2 vulnerability USN-557-1
File : nvt/gb_ubuntu_USN_557_1.nasl
2009-03-06 Name : RedHat Update for gd RHSA-2008:0146-01
File : nvt/gb_RHSA-2008_0146-01_gd.nasl
2009-02-27 Name : Fedora Update for php FEDORA-2007-709
File : nvt/gb_fedora_2007_709_php_fc6.nasl
2009-02-27 Name : CentOS Update for gd CESA-2008:0146 centos4 i386
File : nvt/gb_CESA-2008_0146_gd_centos4_i386.nasl
2009-02-27 Name : CentOS Update for gd CESA-2008:0146 centos4 x86_64
File : nvt/gb_CESA-2008_0146_gd_centos4_x86_64.nasl
2009-02-27 Name : Fedora Update for php FEDORA-2007-2215
File : nvt/gb_fedora_2007_2215_php_fc7.nasl
2009-01-23 Name : SuSE Update for php4, php5 SUSE-SA:2008:004
File : nvt/gb_suse_2008_004.nasl
2008-09-24 Name : Gentoo Security Advisory GLSA 200805-13 (ptex)
File : nvt/glsa_200805_13.nasl
2008-09-24 Name : Gentoo Security Advisory GLSA 200711-34 (cstetex)
File : nvt/glsa_200711_34.nasl
2008-09-24 Name : Gentoo Security Advisory GLSA 200710-02 (php)
File : nvt/glsa_200710_02.nasl
2008-09-24 Name : Gentoo Security Advisory GLSA 200708-05 (gd)
File : nvt/glsa_200708_05.nasl
2008-09-04 Name : FreeBSD Ports: php5
File : nvt/freebsd_php51.nasl
2008-08-15 Name : Debian Security Advisory DSA 1613-1 (libgd2)
File : nvt/deb_1613_1.nasl
2008-05-27 Name : Debian Security Advisory DSA 1578-1 (php4)
File : nvt/deb_1578_1.nasl
2008-01-31 Name : Debian Security Advisory DSA 1444-2 (php5)
File : nvt/deb_1444_2.nasl
2008-01-17 Name : Debian Security Advisory DSA 1444-1 (php5)
File : nvt/deb_1444_1.nasl
0000-00-00 Name : Slackware Advisory SSA:2008-045-03 php
File : nvt/esoft_slk_ssa_2008_045_03.nasl
0000-00-00 Name : Slackware Advisory SSA:2007-152-01 php5
File : nvt/esoft_slk_ssa_2007_152_01.nasl

Open Source Vulnerability Database (OSVDB)

Id Description
36870 PHP libgd Multiple Functions Overflow
36865 PHP money_format Function Unspecified Issue
36863 PHP Unspecified Issue (Zend Engine)
36858 PHP wordwrap Function breakcharlen Variable DoS
36855 PHP ext/session session_start Function Cookie Manipulation
36643 GD Graphics Library (libgd) gdPngReadData() Function Truncated PNG Data Handl...
36083 PHP chunk_split Function Multiple Argument Overflows
35788 GD Graphics Library (libgd) gdPngReadData() Function Truncated PNG Handling DoS

Nessus® Vulnerability Scanner

Date Description
2018-05-01 Name : The remote Slackware host is missing a security update.
File : Slackware_SSA_2018-120-01.nasl - Type : ACT_GATHER_INFO
2015-10-29 Name : The remote Amazon Linux AMI host is missing a security update.
File : ala_ALAS-2015-604.nasl - Type : ACT_GATHER_INFO
2015-07-16 Name : The remote FreeBSD host is missing a security-related update.
File : freebsd_pkg_ca139c7f2a8c11e5a4a5002590263bf5.nasl - Type : ACT_GATHER_INFO
2014-10-10 Name : The remote device is missing a vendor-supplied security patch.
File : f5_bigip_SOL13519.nasl - Type : ACT_GATHER_INFO
2013-07-12 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2007-0889.nasl - Type : ACT_GATHER_INFO
2013-07-12 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2007-0890.nasl - Type : ACT_GATHER_INFO
2013-07-12 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2008-0146.nasl - Type : ACT_GATHER_INFO
2012-08-01 Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20080228_gd_on_SL4_x.nasl - Type : ACT_GATHER_INFO
2012-08-01 Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20070926_php_on_SL3.nasl - Type : ACT_GATHER_INFO
2012-08-01 Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20070920_php_on_SL5_x.nasl - Type : ACT_GATHER_INFO
2009-09-24 Name : The remote SuSE 9 host is missing a security-related patch.
File : suse9_12049.nasl - Type : ACT_GATHER_INFO
2009-09-24 Name : The remote SuSE 9 host is missing a security-related patch.
File : suse9_11666.nasl - Type : ACT_GATHER_INFO
2009-04-23 Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-720-1.nasl - Type : ACT_GATHER_INFO
2008-07-23 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-1613.nasl - Type : ACT_GATHER_INFO
2008-05-19 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-1578.nasl - Type : ACT_GATHER_INFO
2008-03-19 Name : The remote host is missing a Mac OS X update that fixes various security issues.
File : macosx_SecUpd2008-002.nasl - Type : ACT_GATHER_INFO
2008-02-29 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2008-0146.nasl - Type : ACT_GATHER_INFO
2008-02-28 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2008-0146.nasl - Type : ACT_GATHER_INFO
2008-02-18 Name : The remote Slackware host is missing a security update.
File : Slackware_SSA_2008-045-03.nasl - Type : ACT_GATHER_INFO
2008-01-27 Name : The remote openSUSE host is missing a security update.
File : suse_apache2-mod_php5-4909.nasl - Type : ACT_GATHER_INFO
2008-01-08 Name : The remote openSUSE host is missing a security update.
File : suse_apache2-mod_php5-4810.nasl - Type : ACT_GATHER_INFO
2008-01-04 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-1444.nasl - Type : ACT_GATHER_INFO
2008-01-03 Name : The remote web server uses a version of PHP that is affected by multiple issues.
File : php_4_4_8.nasl - Type : ACT_GATHER_INFO
2007-12-24 Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_apache2-mod_php5-4808.nasl - Type : ACT_GATHER_INFO
2007-12-19 Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-557-1.nasl - Type : ACT_GATHER_INFO
2007-12-13 Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_php5-3754.nasl - Type : ACT_GATHER_INFO
2007-12-13 Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_gd-3748.nasl - Type : ACT_GATHER_INFO
2007-12-13 Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_apache2-mod_php5-3980.nasl - Type : ACT_GATHER_INFO
2007-12-04 Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-549-2.nasl - Type : ACT_GATHER_INFO
2007-11-30 Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-549-1.nasl - Type : ACT_GATHER_INFO
2007-11-12 Name : The remote web server uses a version of PHP that is affected by multiple flaws.
File : php_5_2_5.nasl - Type : ACT_GATHER_INFO
2007-11-10 Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-473-1.nasl - Type : ACT_GATHER_INFO
2007-11-06 Name : The remote Fedora host is missing a security update.
File : fedora_2007-2215.nasl - Type : ACT_GATHER_INFO
2007-10-25 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2007-0888.nasl - Type : ACT_GATHER_INFO
2007-10-17 Name : The remote openSUSE host is missing a security update.
File : suse_php5-3753.nasl - Type : ACT_GATHER_INFO
2007-10-17 Name : The remote openSUSE host is missing a security update.
File : suse_php5-3745.nasl - Type : ACT_GATHER_INFO
2007-10-17 Name : The remote openSUSE host is missing a security update.
File : suse_gd-3747.nasl - Type : ACT_GATHER_INFO
2007-10-17 Name : The remote openSUSE host is missing a security update.
File : suse_gd-3700.nasl - Type : ACT_GATHER_INFO
2007-10-17 Name : The remote openSUSE host is missing a security update.
File : suse_apache2-mod_php5-3978.nasl - Type : ACT_GATHER_INFO
2007-10-17 Name : The remote openSUSE host is missing a security update.
File : suse_apache2-mod_php5-3979.nasl - Type : ACT_GATHER_INFO
2007-10-09 Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-200710-02.nasl - Type : ACT_GATHER_INFO
2007-10-03 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2007-0889.nasl - Type : ACT_GATHER_INFO
2007-09-26 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2007-0889.nasl - Type : ACT_GATHER_INFO
2007-09-25 Name : The remote Fedora Core host is missing a security update.
File : fedora_2007-709.nasl - Type : ACT_GATHER_INFO
2007-09-24 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2007-0890.nasl - Type : ACT_GATHER_INFO
2007-09-24 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2007-0890.nasl - Type : ACT_GATHER_INFO
2007-09-24 Name : The remote Mandrake Linux host is missing one or more security updates.
File : mandrake_MDKSA-2007-187.nasl - Type : ACT_GATHER_INFO
2007-09-14 Name : The remote FreeBSD host is missing one or more security-related updates.
File : freebsd_pkg_71d903fc602d11dc898c001921ab2fa4.nasl - Type : ACT_GATHER_INFO
2007-09-03 Name : The remote web server uses a version of PHP that is affected by multiple flaws.
File : php_5_2_4.nasl - Type : ACT_GATHER_INFO
2007-08-13 Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-200708-05.nasl - Type : ACT_GATHER_INFO
2007-06-14 Name : The remote Mandrake Linux host is missing one or more security updates.
File : mandrake_MDKSA-2007-124.nasl - Type : ACT_GATHER_INFO
2007-06-14 Name : The remote Mandrake Linux host is missing one or more security updates.
File : mandrake_MDKSA-2007-122.nasl - Type : ACT_GATHER_INFO
2007-06-14 Name : The remote Mandrake Linux host is missing one or more security updates.
File : mandrake_MDKSA-2007-123.nasl - Type : ACT_GATHER_INFO
2007-06-04 Name : The remote Slackware host is missing a security update.
File : Slackware_SSA_2007-152-01.nasl - Type : ACT_GATHER_INFO
2007-06-02 Name : The remote web server uses a version of PHP that is affected by multiple flaws.
File : php_5_2_3.nasl - Type : ACT_GATHER_INFO
2007-05-04 Name : The remote web server uses a version of PHP that is affected by multiple flaws.
File : php_4_4_7_or_5_2_2.nasl - Type : ACT_GATHER_INFO