This update for php7 fixes the following issues :

Security issues fixed :

  - CVE-2019-9637: Fixed improper implementation of rename     function and multiple invalid memory access in EXIF     extension (bsc#1128892).

  - CVE-2019-9675: Fixed improper implementation of rename     function and multiple invalid memory access in EXIF     extension (bsc#1128886).

  - CVE-2019-9638: Fixed improper implementation of rename     function and multiple invalid memory access in EXIF     extension ((bsc#1128889).

  - CVE-2019-9639: Fixed improper implementation of rename     function and multiple invalid memory access in EXIF     extension (bsc#1128887).

  - CVE-2019-9640: Fixed improper implementation of rename     function and multiple invalid memory access in EXIF     extension (bsc#1128883).

  - CVE-2019-9022: Fixed a vulnerability which could allow a     hostile DNS server to make PHP misuse memcpy     (bsc#1126827).

  - CVE-2019-9024: Fixed a vulnerability in xmlrpc_decode     function which could allow to a hostile XMLRPC server to     cause memory read outside the allocated areas     (bsc#1126821).

  - CVE-2019-9020: Fixed a heap out of bounds in     xmlrpc_decode function (bsc#1126711).

  - CVE-2018-20783: Fixed a buffer over-read in PHAR reading     functions which could allow an attacker to read     allocated and unallocated memory when parsing a phar     file (bsc#1127122).

  - CVE-2019-9021: Fixed a heap buffer-based buffer     over-read in PHAR reading functions which could allow an     attacker to read allocated and unallocated memory when     parsing a phar file (bsc#1126713).

  - CVE-2019-9023: Fixed multiple heap-based buffer     over-read instances in mbstring regular expression     functions (bsc#1126823).

  - CVE-2019-9641: Fixed multiple invalid memory access in     EXIF extension and improved insecure implementation of     rename function (bsc#1128722).

  - CVE-2018-19935: Fixed a Denial of Service in php_imap.c     which could be triggered via an empty string in the     message argument to imap_mail (bsc#1118832).

  - CVE-2019-11034: Fixed a heap-buffer overflow in     php_ifd_get32si() (bsc#1132838).

  - CVE-2019-11035: Fixed a heap-buffer overflow in     exif_iif_add_value() (bsc#1132837).

  - CVE-2019-11036: Fixed buffer over-read in     exif_process_IFD_TAG function leading to information     disclosure (bsc#1134322).

Other issue addressed :

  - Deleted README.default_socket_timeout which is not     needed anymore (bsc#1129032).

  - Enabled php7 testsuite (bsc#1119396).

This update was imported from the SUSE:SLE-15:Update update project.

This update for php5 fixes the following issues :

Security issues fixed :

CVE-2019-9024: Fixed a vulnerability in xmlrpc_decode function which could allow to a hostile XMLRPC server to cause memory read outside the allocated areas (bsc#1126821).

CVE-2019-9020: Fixed a heap out of bounds in xmlrpc_decode function (bsc#1126711).

CVE-2018-20783: Fixed a buffer over-read in PHAR reading functions which could allow an attacker to read allocated and unallocated memory when parsing a phar file (bsc#1127122).

CVE-2019-9021: Fixed a heap buffer-based buffer over-read in PHAR reading functions which could allow an attacker to read allocated and unallocated memory when parsing a phar file (bsc#1126713).

CVE-2019-9023: Fixed multiple heap-based buffer over-read instances in mbstring regular expression functions (bsc#1126823).

CVE-2019-9641: Fixed multiple invalid memory access in EXIF extension and improved insecure implementation of rename function (bsc#1128722).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the php packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in PHP before 5.6.40, 7.x     before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before     7.3.1. Invalid input to the function xmlrpc_decode()     can lead to an invalid memory access (heap out of     bounds read or read after free). This is related to     xml_elem_parse_buf in     ext/xmlrpc/libxmlrpc/xml_element.c.(CVE-2019-9020)

  - In PHP before 5.6.39, 7.x before 7.0.33, 7.1.x before     7.1.25, and 7.2.x before 7.2.13, a buffer over-read in     PHAR reading functions may allow an attacker to read     allocated or unallocated memory past the actual data     when trying to parse a .phar file. This is related to     phar_parse_pharfile in ext/phar/phar.c.(CVE-2018-20783)

  - An issue was discovered in PHP before 5.6.40, 7.x     before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before     7.3.1. A number of heap-based buffer over-read     instances are present in mbstring regular expression     functions when supplied with invalid multibyte data.
    These occur in ext/mbstring/oniguruma/regcomp.c,     ext/mbstring/oniguruma/regexec.c,     ext/mbstring/oniguruma/regparse.c,     ext/mbstring/oniguruma/enc/unicode.c, and     ext/mbstring/oniguruma/src/utf32_be.c when a multibyte     regular expression pattern contains invalid multibyte     sequences.(CVE-2019-9023)

  - An issue was discovered in PHP before 5.6.40, 7.x     before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before     7.3.1. A heap-based buffer over-read in PHAR reading     functions in the PHAR extension may allow an attacker     to read allocated or unallocated memory past the actual     data when trying to parse the file name, a different     vulnerability than CVE-2018-20783. This is related to     phar_detect_phar_fname_ext in     ext/phar/phar.c.(CVE-2019-9021)

  - An issue was discovered in PHP before 7.1.27, 7.2.x     before 7.2.16, and 7.3.x before 7.3.3. Due to the way     rename() across filesystems is implemented, it is     possible that file being renamed is briefly available     with wrong permissions while the rename is ongoing,     thus enabling unauthorized users to access the     data.(CVE-2019-9637)

  - An issue was discovered in PHP before 5.6.40, 7.x     before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before     7.3.1. xmlrpc_decode() can allow a hostile XMLRPC     server to cause PHP to read memory outside of allocated     areas in base64_decode_xmlrpc in     ext/xmlrpc/libxmlrpc/base64.c.(CVE-2019-9024)

  - An integer overflow flaw, leading to a heap-based     buffer overflow was found in the way libgd read some     specially-crafted gd2 files. A remote attacker could     use this flaw to crash an application compiled with     libgd or in certain cases execute arbitrary code with     the privileges of the user running that     application.(CVE-2016-1016)

  - A null pointer dereference flaw was found in libgd. An     attacker could use a specially-crafted .gd2 file to     cause an application linked with libgd to crash,     leading to denial of service.(CVE-2016-10167)

  - A data leak was found in gdImageCreateFromGifCtx() in     GD Graphics Library used in PHP before 5.6.31 and     7.1.7. An attacker could craft a malicious GIF image     and read up to 762 bytes from stack.(CVE-2017-7890)

  - gdImageColorMatch in gd_color_match.c in the GD     Graphics Library (aka LibGD) 2.2.5, as used in the     imagecolormatch function in PHP before 5.6.40, 7.x     before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before     7.3.1, has a heap-based buffer overflow. This can be     exploited by an attacker who is able to trigger     imagecolormatch calls with crafted image     data.(CVE-2019-6977)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:1624 advisory.

  - php: Buffer over-read in PHAR reading functions (CVE-2018-20783)

  - php: Heap buffer overflow in function exif_process_IFD_TAG() (CVE-2019-11034)

  - php: Heap buffer overflow in function exif_iif_add_value() (CVE-2019-11035)

  - php: Buffer over-read in exif_process_IFD_TAG() leading to information disclosure (CVE-2019-11036)

  - php: Out-of-bounds read due to integer overflow in iconv_mime_decode_headers() (CVE-2019-11039)

  - php: Buffer over-read in exif_read_data() (CVE-2019-11040)

  - php: Heap buffer over-read in exif_scan_thumbnail() (CVE-2019-11041)

  - php: Heap buffer over-read in exif_process_user_comment() (CVE-2019-11042)

  - php: Invalid memory access in function xmlrpc_decode() (CVE-2019-9020)

  - php: Heap-based buffer over-read in PHAR reading functions (CVE-2019-9021)

  - php: memcpy with negative length via crafted DNS response (CVE-2019-9022)

  - php: Heap-based buffer over-read in mbstring regular expression functions (CVE-2019-9023)

  - php: Out-of-bounds read in base64_decode_xmlrpc in ext/xmlrpc/libxmlrpc/base64.c (CVE-2019-9024)

  - php: File rename across filesystems may allow unwanted access during processing (CVE-2019-9637)

  - php: Uninitialized read in exif_process_IFD_in_MAKERNOTE (CVE-2019-9638, CVE-2019-9639)

  - php: Invalid read in exif_process_SOFn() (CVE-2019-9640)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2020:1624 advisory.

  - In PHP before 5.6.39, 7.x before 7.0.33, 7.1.x before 7.1.25, and 7.2.x before 7.2.13, a buffer over-read     in PHAR reading functions may allow an attacker to read allocated or unallocated memory past the actual     data when trying to parse a .phar file. This is related to phar_parse_pharfile in ext/phar/phar.c.
    (CVE-2018-20783)

  - When processing certain files, PHP EXIF extension in versions 7.1.x below 7.1.28, 7.2.x below 7.2.17 and     7.3.x below 7.3.4 can be caused to read past allocated buffer in exif_process_IFD_TAG function. This may     lead to information disclosure or crash. (CVE-2019-11034)

  - When processing certain files, PHP EXIF extension in versions 7.1.x below 7.1.28, 7.2.x below 7.2.17 and     7.3.x below 7.3.4 can be caused to read past allocated buffer in exif_iif_add_value function. This may     lead to information disclosure or crash. (CVE-2019-11035)

  - When processing certain files, PHP EXIF extension in versions 7.1.x below 7.1.29, 7.2.x below 7.2.18 and     7.3.x below 7.3.5 can be caused to read past allocated buffer in exif_process_IFD_TAG function. This may     lead to information disclosure or crash. (CVE-2019-11036)

  - Function iconv_mime_decode_headers() in PHP versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and 7.3.x     below 7.3.6 may perform out-of-buffer read due to integer overflow when parsing MIME headers. This may     lead to information disclosure or crash. (CVE-2019-11039)

  - When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in     PHP versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and 7.3.x below 7.3.6 it is possible to supply it with     data what will cause it to read past the allocated buffer. This may lead to information disclosure or     crash. (CVE-2019-11040)

  - When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in     PHP versions 7.1.x below 7.1.31, 7.2.x below 7.2.21 and 7.3.x below 7.3.8 it is possible to supply it with     data what will cause it to read past the allocated buffer. This may lead to information disclosure or     crash. (CVE-2019-11041, CVE-2019-11042)

  - An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before     7.3.1. Invalid input to the function xmlrpc_decode() can lead to an invalid memory access (heap out of     bounds read or read after free). This is related to xml_elem_parse_buf in     ext/xmlrpc/libxmlrpc/xml_element.c. (CVE-2019-9020)

  - An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before     7.3.1. A heap-based buffer over-read in PHAR reading functions in the PHAR extension may allow an attacker     to read allocated or unallocated memory past the actual data when trying to parse the file name, a     different vulnerability than CVE-2018-20783. This is related to phar_detect_phar_fname_ext in     ext/phar/phar.c. (CVE-2019-9021)

  - An issue was discovered in PHP 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.2.
    dns_get_record misparses a DNS response, which can allow a hostile DNS server to cause PHP to misuse     memcpy, leading to read operations going past the buffer allocated for DNS data. This affects php_parserr     in ext/standard/dns.c for DNS_CAA and DNS_ANY queries. (CVE-2019-9022)

  - An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before     7.3.1. A number of heap-based buffer over-read instances are present in mbstring regular expression     functions when supplied with invalid multibyte data. These occur in ext/mbstring/oniguruma/regcomp.c,     ext/mbstring/oniguruma/regexec.c, ext/mbstring/oniguruma/regparse.c, ext/mbstring/oniguruma/enc/unicode.c,     and ext/mbstring/oniguruma/src/utf32_be.c when a multibyte regular expression pattern contains invalid     multibyte sequences. (CVE-2019-9023)

  - An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before     7.3.1. xmlrpc_decode() can allow a hostile XMLRPC server to cause PHP to read memory outside of allocated     areas in base64_decode_xmlrpc in ext/xmlrpc/libxmlrpc/base64.c. (CVE-2019-9024)

  - An issue was discovered in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. Due to the way     rename() across filesystems is implemented, it is possible that file being renamed is briefly available     with wrong permissions while the rename is ongoing, thus enabling unauthorized users to access the data.
    (CVE-2019-9637)

  - An issue was discovered in the EXIF component in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before     7.3.3. There is an uninitialized read in exif_process_IFD_in_MAKERNOTE because of mishandling the     maker_note->offset relationship to value_len. (CVE-2019-9638)

  - An issue was discovered in the EXIF component in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before     7.3.3. There is an uninitialized read in exif_process_IFD_in_MAKERNOTE because of mishandling the data_len     variable. (CVE-2019-9639)

  - An issue was discovered in the EXIF component in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before     7.3.3. There is an Invalid Read in exif_process_SOFn. (CVE-2019-9640)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its banner, the version of PHP running on the remote web server is 7.3.x prior to 7.3.1. It is, therefore, affected by multiple vulnerabilities:

  - An integer underflow condition exists in _gdContributionsAlloc   function in gd_interpolation.c. An unauthenticated, remote attacker   can have unspecified impact via vectors related to decrementing   the u variable.
  (CVE-2016-10166)

  - A heap-based buffer overflow condition exists in   gdImageColorMatch due to improper calculation of the allocated   buffer size. An attacker can exploit this, via calling   imagecolormatch function with crafted image data as parameters.
  (CVE-2019-6977)

  - A heap-based buffer over-read exists in the xmlrpc_decode function   due to improper validation of input data. An unauthenticated, remote   attacker can exploit this, via a specially crafted request, to cause   a heap out-of-bounds read or read-after-free condition, which could   result in a complete system compromise.
  (CVE-2019-9020)

  - A heap-based buffer over-read exists in the PHAR reading functions   in the PHAR extension, due to improper implementation of memory   operations. An unauthenticated, remote attacker can exploit this,   via persuading a user to parse a specially crafted file name on the   targeted system, to disclose sensitive information.
  (CVE-2019-9021)

  - Multiple heap-based buffer over-read instances exist in mbstring   regular expression functions due to improper implementation of   memory operations. An unauthenticated, remote attacker can exploit   this by sending a specially crafted regular expression that contains   multibyte sequences, to cause a condition that could allow the   attacker to completely compromise the target system.
  (CVE-2019-9023)

  - An out-of-bounds read error exists in the xmlrpc_decode function   due to improper implementation of memory operations. An   unauthenticated, remote attacker can exploit this, via a hostile   XMLRPC server to cause PHP to read from memory outside of allocated   areas.
  (CVE-2019-9024)

  - An out-of-bounds read and write error exists in the mb_split   function due to improper implementation of memory operations. An   unauthenticated, remote attacker can exploit this by causing PHP to   execute the memcpy function with a negative argument, to cause   buffer over-read and over-write conditions which could allow the   attacker to completely compromise the system.
  (CVE-2019-9025)

According to its banner, the version of PHP running on the remote web server is 7.1.x prior to 7.1.26. It is, therefore, affected by multiple vulnerabilities:

  - An integer underflow condition exists in _gdContributionsAlloc   function in gd_interpolation.c. An unauthenticated, remote attacker   can have unspecified impact via vectors related to decrementing   the u variable. (CVE-2016-10166)

  - A denial of service (DoS) vulnerability exists in   ext/imap/php_imap.c. An unauthenticated, remote attacker can   exploit this issue, via an empty string in the message argument   to the imap_mail function, to cause the application to stop   responding. (CVE-2018-19935)

  - A heap-based buffer overflow condition exists in gdImageColorMatch   due to improper calculation of the allocated buffer size. An   unauthenticated, remote attacker can exploit this via calling the   imagecolormatch function with crafted image data as parameters, to   cause a denial of service condition or the execution of arbitrary   code. (CVE-2019-6977)

  - A heap-based buffer over-read exists in the xmlrpc_decode function   due to improper validation of input data. An unauthenticated, remote   attacker can exploit this, via a specially crafted request, to cause   a heap out-of-bounds read or read-after-free condition, which could   result in a complete system compromise. (CVE-2019-9020)

  - A heap-based buffer over-read exists in the PHAR reading functions   in the PHAR extension, due to improper implementation of memory   operations. An unauthenticated, remote attacker can exploit this,   via persuading a user to parse a specially crafted file name on the   targeted system, to disclose sensitive information. (CVE-2019-9021)

  - An information disclosure vulnerability exists in the   dns_get_record function due to improper parsing of DNS responses. An   unauthenticated, remote attacker can exploit this, via a specially   crafted DNS reply sent from a rogue DNS server to disclose   potentially sensitive information. (CVE-2019-9022)

  - Multiple heap-based buffer over-read instances exist in mbstring   regular expression functions due to improper implementation of   memory operations. An unauthenticated, remote attacker can exploit   this by sending a specially crafted regular expression that contains   multibyte sequences, to cause a condition that could allow the   attacker to completely compromise the target system. (CVE-2019-9023)

  - An out-of-bounds read error exists in the xmlrpc_decode function   due to improper implementation of memory operations. An   unauthenticated, remote attacker can exploit this, via a hostile   XMLRPC server to cause PHP to read from memory outside of allocated   areas. (CVE-2019-9024)

According to the versions of the php packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - In PHP before 5.6.39, 7.x before 7.0.33, 7.1.x before     7.1.25, and 7.2.x before 7.2.13, a buffer over-read in     PHAR reading functions may allow an attacker to read     allocated or unallocated memory past the actual data     when trying to parse a .phar file. This is related to     phar_parse_pharfile in ext/phar/phar.c.(CVE-2018-20783)

  - An issue was discovered in PHP before 5.6.40, 7.x     before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before     7.3.1. Invalid input to the function xmlrpc_decode()     can lead to an invalid memory access (heap out of     bounds read or read after free). This is related to     xml_elem_parse_buf in     ext/xmlrpc/libxmlrpc/xml_element.c.(CVE-2019-9020)

  - An issue was discovered in PHP before 5.6.40, 7.x     before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before     7.3.1. A heap-based buffer over-read in PHAR reading     functions in the PHAR extension may allow an attacker     to read allocated or unallocated memory past the actual     data when trying to parse the file name, a different     vulnerability than CVE-2018-20783. This is related to     phar_detect_phar_fname_ext in     ext/phar/phar.c.(CVE-2019-9021)

  - An issue was discovered in PHP before 5.6.40, 7.x     before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before     7.3.1. A number of heap-based buffer over-read     instances are present in mbstring regular expression     functions when supplied with invalid multibyte data.
    These occur in ext/mbstring/oniguruma/regcomp.c,     ext/mbstring/oniguruma/regexec.c,     ext/mbstring/oniguruma/regparse.c,     ext/mbstring/oniguruma/enc/unicode.c, and     ext/mbstring/oniguruma/src/utf32_be.c when a multibyte     regular expression pattern contains invalid multibyte     sequences.(CVE-2019-9023)

  - An issue was discovered in PHP before 5.6.40, 7.x     before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before     7.3.1. xmlrpc_decode() can allow a hostile XMLRPC     server to cause PHP to read memory outside of allocated     areas in base64_decode_xmlrpc in     ext/xmlrpc/libxmlrpc/base64.c.(CVE-2019-9024)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for php5 fixes the following issues :

Security issues fixed: &#9; 

  - CVE-2019-9024: Fixed a vulnerability in xmlrpc_decode     function which could allow to a hostile XMLRPC server to     cause memory read outside the allocated areas     (bsc#1126821).

  - CVE-2019-9020: Fixed a heap out of bounds in     xmlrpc_decode function (bsc#1126711).

  - CVE-2018-20783: Fixed a buffer over-read in PHAR reading     functions which could allow an attacker to read     allocated and unallocated memory when parsing a phar     file (bsc#1127122).

  - CVE-2019-9021: Fixed a heap buffer-based buffer     over-read in PHAR reading functions which could allow an     attacker to read allocated and unallocated memory when     parsing a phar file (bsc#1126713).

  - CVE-2019-9023: Fixed multiple heap-based buffer     over-read instances in mbstring regular expression     functions (bsc#1126823).

  - CVE-2019-9641: Fixed multiple invalid memory access in     EXIF extension and improved insecure implementation of     rename function (bsc#1128722).

This update was imported from the SUSE:SLE-12:Update update project.

According to the versions of the php packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - In PHP before 5.6.39, 7.x before 7.0.33, 7.1.x before     7.1.25, and 7.2.x before 7.2.13, a buffer over-read in     PHAR reading functions may allow an attacker to read     allocated or unallocated memory past the actual data     when trying to parse a .phar file. This is related to     phar_parse_pharfile in ext/phar/phar.c.(CVE-2018-20783)

  - An issue was discovered in PHP before 5.6.40, 7.x     before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before     7.3.1. Invalid input to the function xmlrpc_decode()     can lead to an invalid memory access (heap out of     bounds read or read after free). This is related to     xml_elem_parse_buf in     ext/xmlrpc/libxmlrpc/xml_element.c.(CVE-2019-9020)

  - An issue was discovered in PHP before 5.6.40, 7.x     before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before     7.3.1. A heap-based buffer over-read in PHAR reading     functions in the PHAR extension may allow an attacker     to read allocated or unallocated memory past the actual     data when trying to parse the file name, a different     vulnerability than CVE-2018-20783. This is related to     phar_detect_phar_fname_ext in     ext/phar/phar.c.(CVE-2019-9021)

  - An issue was discovered in PHP before 5.6.40, 7.x     before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before     7.3.1. A number of heap-based buffer over-read     instances are present in mbstring regular expression     functions when supplied with invalid multibyte data.
    These occur in ext/mbstring/oniguruma/regcomp.c,     ext/mbstring/oniguruma/regexec.c,     ext/mbstring/oniguruma/regparse.c,     ext/mbstring/oniguruma/enc/unicode.c, and     ext/mbstring/oniguruma/src/utf32_be.c when a multibyte     regular expression pattern contains invalid multibyte     sequences.(CVE-2019-9023)

  - An issue was discovered in PHP before 5.6.40, 7.x     before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before     7.3.1. xmlrpc_decode() can allow a hostile XMLRPC     server to cause PHP to read memory outside of allocated     areas in base64_decode_xmlrpc in     ext/xmlrpc/libxmlrpc/base64.c.(CVE-2019-9024)

  - gdImageColorMatch in gd_color_match.c in the GD     Graphics Library (aka LibGD) 2.2.5, as used in the     imagecolormatch function in PHP before 5.6.40, 7.x     before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before     7.3.1, has a heap-based buffer overflow. This can be     exploited by an attacker who is able to trigger     imagecolormatch calls with crafted image     data.(CVE-2019-6977)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:2519 advisory.

    PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

    The following packages have been upgraded to a later upstream version: rh-php71-php (7.1.30). (BZ#1631672)

    Security Fix(es):

    * gd: Unsigned integer underflow _gdContributionsAlloc() (CVE-2016-10166)

    * php: Out of bounds access in php_pcre.c:php_pcre_replace_impl() (CVE-2017-9118)

    * php: Integer overflow in mysqli_api.c:mysqli_real_escape_string() (CVE-2017-9120)

    * php: Heap use after free in ext/standard/var_unserializer.re (CVE-2017-12932)

    * php: Reflected XSS in .phar 404 page (CVE-2018-5712)

    * php: Stack-based buffer under-read in php_stream_url_wrap_http_ex() in http_fopen_wrapper.c when parsing     HTTP response (CVE-2018-7584)

    * php: Infinite loop in ext/iconv/iconv.c when using stream filter with convert.incov on invalid sequence     leads to denial-of-service (CVE-2018-10546)

    * php: Reflected XSS vulnerability on PHAR 403 and 404 error pages (CVE-2018-10547)

    * php: NULL pointer dereference due to mishandling of ldap_get_dn return value allows DoS via malicious     LDAP server reply (CVE-2018-10548)

    * php: Mishandled http_header_value in an atoi() call in http_fopen_wrapper.c (CVE-2018-14884)

    * php: Cross-site scripting (XSS) flaw in Apache2 component via body of 'Transfer-Encoding: chunked'     request (CVE-2018-17082)

    * gd: Heap based buffer overflow in gdImageColorMatch() in gd_color_match.c (CVE-2019-6977)

    * php: Invalid memory access in function xmlrpc_decode() (CVE-2019-9020)

    * php: File rename across filesystems may allow unwanted access during processing (CVE-2019-9637)

    * php: Uninitialized read in exif_process_IFD_in_MAKERNOTE (CVE-2019-9638)

    * php: Uninitialized read in exif_process_IFD_in_MAKERNOTE (CVE-2019-9639)

    * php: Invalid read in exif_process_SOFn() (CVE-2019-9640)

    * php: Out-of-bounds read due to integer overflow in iconv_mime_decode_headers() (CVE-2019-11039)

    * php: Buffer over-read in exif_read_data() (CVE-2019-11040)

    * php: Out-of-bound read in timelib_meridian() (CVE-2017-16642)

    * gd: Infinite loop in gdImageCreateFromGifCtx() in gd_gif_in.c (CVE-2018-5711)

    * php: Dumpable FPM child processes allow bypassing opcache access controls (CVE-2018-10545)

    * php: Out-of-bounds read in ext/exif/exif.c:exif_read_data() when reading crafted JPEG data     (CVE-2018-10549)

    * php: exif: Buffer over-read in exif_process_IFD_in_MAKERNOTE() (CVE-2018-14851)

    * php: Buffer over-read in PHAR reading functions (CVE-2018-20783)

    * php: Heap-based buffer over-read in PHAR reading functions (CVE-2019-9021)

    * php: memcpy with negative length via crafted DNS response (CVE-2019-9022)

    * php: Heap-based buffer over-read in mbstring regular expression functions (CVE-2019-9023)

    * php: Out-of-bounds read in base64_decode_xmlrpc in ext/xmlrpc/libxmlrpc/base64.c (CVE-2019-9024)

    * php: Heap buffer overflow in function exif_process_IFD_TAG() (CVE-2019-11034)

    * php: Heap buffer overflow in function exif_iif_add_value() (CVE-2019-11035)

    * php: Buffer over-read in exif_process_IFD_TAG() leading to information disclosure (CVE-2019-11036)

    * gd: Information disclosure in gdImageCreateFromXbm() (CVE-2019-11038)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
126034	openSUSE Security Update : php7 (openSUSE-2019-1572)	Nessus	SuSE Local Security Checks	2019/6/19	2024/5/15	critical
124190	SUSE SLES12 Security Update : php5 (SUSE-SU-2019:0985-1)	Nessus	SuSE Local Security Checks	2019/4/19	2024/5/31	critical
124905	EulerOS Virtualization for ARM 64 3.0.1.0 : php (EulerOS-SA-2019-1402)	Nessus	Huawei Local Security Checks	2019/5/14	2024/5/23	critical
145814	CentOS 8 : php:7.2 (CESA-2020:1624)	Nessus	CentOS Local Security Checks	2021/2/1	2024/1/25	critical
184778	Rocky Linux 8 : php:7.2 (RLSA-2020:1624)	Nessus	Rocky Linux Local Security Checks	2023/11/6	2023/11/6	critical
121475	PHP 7.3.x < 7.3.1 Multiple vulnerabilities.	Nessus	CGI abuses	2019/1/30	2025/5/26	critical
121510	PHP 7.1.x < 7.1.26 Multiple vulnerabilities.	Nessus	CGI abuses	2019/1/31	2025/5/26	critical
123594	EulerOS 2.0 SP2 : php (EulerOS-SA-2019-1120)	Nessus	Huawei Local Security Checks	2019/4/2	2024/6/6	critical
124263	openSUSE Security Update : php5 (openSUSE-2019-1256)	Nessus	SuSE Local Security Checks	2019/4/24	2024/5/31	critical
123113	EulerOS 2.0 SP3 : php (EulerOS-SA-2019-1100)	Nessus	Huawei Local Security Checks	2019/3/26	2024/6/12	critical
194152	RHEL 7 : rh-php71-php (RHSA-2019:2519)	Nessus	Red Hat Local Security Checks	2024/4/28	2024/11/6	critical

検出

プラグインの検索

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical