(PVS) Signatures - Tenable Network Security

(CVE-2010-2068)
Solution: Either ensure the affected module is not in use or upgrade to Apache version 2.2.16 or later.
CVE-2010-2068
PHP < 5.3.3 / 5.2.14 Multiple Vulnerabilities
PVS ID: 5616 FAMILY: Web Servers RISK: HIGH NESSUS ID:48245
Description: Synopsis :\n\nThe remote web server uses a version of PHP that is affected by multiple
vulnerabilities.\n\nAccording to its banner the version of PHP installed on the remote host
is earlier than 5.3.3 / 5.2.14. Such version are potentially affected by multiple
vulnerabilities :\n\n - An information disclosure vulnerability in var_export() when a fatal
error occurs.\n\n - A resource destruction issue in shm_put_var().\n\n - A possible
information leak because of an interruption of XOR operator.\n\n - A memory corruption
issue caused by an unexpected call-time pass by reference and the following memory
clobbering through callbacks.\n\n - A memory corruption issue in
ArrayObject::uasort().\n\n - A memory corruption issue in parse_str().\n\n - A memory
corruption issue in pack().\n\n - A memory corruption issue in substr_replace().\n\n - A
memory corruption issue in addcslashes().\n\n - A stack exhaustion issue in fnmatch().\n\n -
A buffer overflow vulnerability in the dechunking filter.\n\n - An arbitrary memory access
issue in the sqlite extension.\n\n - A string format validation issue in the phar extension.\n\n
- An unspecified issue relating to the handling of session variable serialization on certain
prefix characters.\n\n - A NULL pointer dereference issue when processing invalid
XML-RPC requests.\n\n - An unserialization issue in SplObjectStorage.\n\n - Buffer
overflow vulnerabilities in mysqlnd_list_fields and mysqlnd_change_user.\n\n - Buffer
overflows when handling error packets in mysqlnd.
Solution: Upgrade to PHP version 5.2.14, 5.3.3, or later.
CVE-2010-2531
Safari < 4.1.1 / 5.0.1 Multiple Vulnerabilities
Passive Vulnerability Scanner (PVS) Signatures
PVS ID: 5617 FAMILY: Web Clients RISK: HIGH NESSUS ID:47888
Description: Synopsis :\n\nThe remote host contains a web browser that is vulnerable to multiple attack
vectors.\n\nFor your information, the observed version of Safari is %L.\n\nThe remote host
has Safari installed. For your information, the observed version of Safari is
%L.\n\nVersions of Safari earlier than 4.1.1 / 5.0.1 are potentially affected by multiple
vulnerabilities :\n\n - Safari's AutoFill feature may disclose information to websites without
user interaction. (CVE-2010-1796)\n\n - A use after free issue exists in WebKit's handling
of element focus may lead to an application crash or arbitrary code execution.
(CVE-2010-1780)\n\n - A memory corruption issue exists in WebKit's rendering of inline
elements . (CVE-2010-1782)\n\n - A memory corruption issue exists in WebKit's handling
of dynamic modifications to text nodes .\n\n - A memory corruption issue exists in
WebKit's handling of CSS counters . (CVE-2010-1784)\n\n - An uninitialized memory
access issue exists in WebKit's handling of the ':first-letter' and ':first-line' pseudo-elements
in SVG text elements . (CVE-2010-1785)\n\n - A use after free issue exists in WebKit's
Family Internet Services 1510