KLA10747 Obsolete PHP version in XAMPP & WAMP

Obsolete version of PHP was found in XAMPP & WAMP. Details about PHP vulnerabilities you can get at KLA10746.

Original advisories

Related products

PHP

CVE list

CVE-2016-1904 critical

CVE-2016-1903 high

CVE-2015-8617 critical

CVE-2015-8616 critical

CVE-2015-6836 critical

CVE-2015-6833 warning

CVE-2015-6832 critical

CVE-2015-6831 critical

CVE-2015-6527 critical

CVE-2015-5590 critical

Solution

Update XAMPP or WAMP if vendor released corresponding patch or update PHP module individually.XAMPP downloads page

WAMP downloads page

Impacts

• ACE

Arbitrary code execution. Exploitation of vulnerabilities with this impact can lead to executing by abuser any code or commands at vulnerable machine or process.

• OSI

Obtain sensitive information. Exploitation of vulnerabilities with this impact can lead to capturing by abuser information, critical for user or system.

• DoS

Denial of service. Exploitation of vulnerabilities with this impact can lead to loss of system availability or critical functional fault.

• SB

Security bypass. Exploitation of vulnerabilities with this impact can lead to performing actions restricted by current security settings.

• WLF

Write Local Files. Exploitation of vulnerabilities with this impact can lead to writing into some inaccessible files. Files that can be read depends on concrete program errors.

Affected Products

• PHP 7 versions earlier than 7.0.2PHP 5.6 versions earlier than 5.6.17PHP versions earlier than 5.5.31