Summary
The latest update to the TrustKeeper scan engine that powers our Trustwave Vulnerability Management product (including both internal and external vulnerability scanning) is now available.
This week we bring you 15 new vulnerability checks including Oracle Critical Product Update checks for multiple products, covering 37 distinct CVEs, and various PHP issues. Enjoy!
New Vulnerability Test Highlights
Some of the more interesting vulnerability tests we added recently are as follows:
Apache
- PHP php_handler function possible remote code execution with Apache HTTP Server (CVE-2015-3330)
Oracle
- Oracle Database July 2015 CPU (CVE-2015-2629, CVE-2015-2595, CVE-2015-0468, CVE-2015-4740, CVE-2015-4755, CVE-2015-2599, CVE-2015-4753)
- Oracle Enterprise Manager July 2015 CPU (CVE-2015-2647, CVE-2015-4735, CVE-2015-2646)
- Oracle MySQL July 2015 CPU (CVE-2015-2617, CVE-2015-2648, CVE-2015-2611, CVE-2015-2582, CVE-2015-4752, CVE-2015-4756, CVE-2015-2643, CVE-2015-4772, CVE-2015-4761, CVE-2015-4757, CVE-2015-4737, CVE-2015-4771, CVE-2015-4769, CVE-2015-2639, CVE-2015-2620, CVE-2015-2641, CVE-2015-2661, CVE-2015-4767)
- Oracle Solaris July 2015 CPU (CVE-2015-2580, CVE-2015-2589, CVE-2015-2609, CVE-2015-2614, CVE-2015-2616, CVE-2015-2631, CVE-2015-2651, CVE-2015-2662, CVE-2015-4770)
PHP
- PHP ftp_genlist function integer overflow vulnerability (CVE-2015-4022)
- PHP Multipart/form-data remote denial of service Vulnerability (CVE-2015-4024)
- PHP NULL Character in Path Access Restriction Bypass (CVE-2015-4025)
- PHP pcntl_exec NULL character path access restriction bypass (CVE-2015-4026)
- PHP Phar Extension Buffer Over-read (CVE-2015-2783)
- PHP phar extension buffer overflow in phar_set_inode function (CVE-2015-3329)
- PHP phar_parse_metadata function in phar extension denial of service (CVE-2015-3307)
- PHP phar_parse_tarfile function denial of service vulnerability (CVE-2015-4021)
- PHP SoapClient's do_soap_call function type confusion through unserialize function (CVE-2015-4148)
- PHP SoapClient's __call type confusion through unserialize function (CVE-2015-4147)
How to Update?
All Trustwave customers using the TrustKeeper Scan Engine receive the updates automatically as soon as an update is available. No action is required.