Vulnerabilities Weekly Summary Ending May 27

By Jerry Adams on May 26, 2016

This past week vulnerabilities were announced affecting WordPress and PHP.  WordPress mostly suffered from XSS vulnerabilities and the PHP vulnerabilities mostly caused denial of service.  In regards to updates, Adobe has released an update for their Connect which fixes one vulnerability and Google released an update for Chrome which addresses 49 vulnerabilities.

WordPress had four vulnerabilities, which were actually discovered last year, however they were not completely addressed and are still relevant today.

  • CVE-2015-5714 – Cross-site scripting (XSS) vulnerability in WordPress before 4.3.1 allows remote attackers to inject arbitrary web script or HTML by leveraging the mishandling of unclosed HTML elements during processing of shortcode tags.
  • CVE-2015-7989 – Cross-site scripting (XSS) vulnerability in the user list table in WordPress before 4.3.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted e-mail address.
  • CVE-2015-8834 – Cross-site scripting (XSS) vulnerability in wp-includes/wp-db.php in WordPress before 4.2.2 allows remote attackers to inject arbitrary web script or HTML via a long comment that is improperly stored because of limitations on the MySQL TEXT data type. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-3440.
  • CVE-2015-5715 – The mw_editPost function in wp-includes/class-wp-xmlrpc-server.php in the XMLRPC subsystem in WordPress before 4.3.1 allows remote authenticated users to bypass intended access restrictions, and arrange for a private post to be published and sticky, via unspecified vectors.

Below are the vulnerabilities relating to PHP, many of which impacts denial of service:

  • CVE-2015-8867 – The openssl_random_pseudo_bytes function in ext/openssl/openssl.c in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 incorrectly relies on the deprecated RAND_pseudo_bytes function, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via unspecified vectors.
  • CVE-2015-8876 – Zend/zend_exceptions.c in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 does not validate certain Exception objects, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or trigger unintended method execution via crafted serialized data.
  • CVE-2015-8877 – The gdImageScaleTwoPass function in gd_interpolation.c in the GD Graphics Library (aka libgd) before 2.2.0, as used in PHP before 5.6.12, uses inconsistent allocate and free approaches, which allows remote attackers to cause a denial of service (memory consumption) via a crafted call, as demonstrated by a call to the PHP imagescale function.
  • CVE-2015-8878 – main/php_open_temporary_file.c in PHP before 5.5.28 and 5.6.x before 5.6.12 does not ensure thread safety, which allows remote attackers to cause a denial of service (race condition and heap memory corruption) by leveraging an application that performs many temporary-file accesses.
  • CVE-2015-8879 – The odbc_bindcols function in ext/odbc/php_odbc.c in PHP before 5.6.12 mishandles driver behavior for SQL_WVARCHAR columns, which allows remote attackers to cause a denial of service (application crash) in opportunistic circumstances by leveraging use of the odbc_fetch_array function to access a certain type of Microsoft SQL Server table.
  • CVE-2015-8880 – Double free vulnerability in the format printer in PHP 7.x before 7.0.1 allows remote attackers to have an unspecified impact by triggering an error.
  • CVE-2015-8866 – ext/libxml/libxml.c in PHP before 5.5.22 and 5.6.x before 5.6.6, when PHP-FPM is used, does not isolate each thread from libxml_disable_entity_loader changes in other threads, which allows remote attackers to conduct XML External Entity (XXE) and XML Entity Expansion (XEE) attacks via a crafted XML document, a related issue to CVE-2015-5161.

Google also released a security update for their Chrome browser, fixing 42 vulnerabilities, 9 of which below were deemed, high priority (Govind, K., 2016 May 25):

Also Adobe released a patch for their Adobe Connect on Windows which address a untrusted search path vulnerability (CVE-2016-4118), in the add-in installer  (“Adobe Security Bulletin“, 2016 May 23).

References:

(2016 May 23).  “Adobe Security Bulletin“. Adobe Systems. Retrieved from https://helpx.adobe.com/security/products/connect/apsb16-17.html

Govind, Krishna. (2016 May 25).  “Stable Channel Update”. Google Inc. Retrieved from http://googlechromereleases.blogspot.com/2016/05/stable-channel-update_25.html

Related Posts