This update for php7 fixes the following issues :

CVE-2020-7069: Fixed an issue when AES-CCM mode was used with openssl_encrypt() function with 12 bytes IV, only first 7 bytes of the IV was used (bsc#1177351).

CVE-2020-7070: Fixed an issue where percent-encoded cookies could have been used to overwrite existing prefixed cookie names (bsc#1177352).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:4067-1 advisory.

    - Version update to 7.2.34 [jsc#SLE-23639]

    - CVE-2022-37454: Fixed SHA-3 buffer overflow (bsc#1204577).
    - Fix integer overflow in PHP_SHA3##bits (bsc#1204577#c26).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when AES-CCM mode is used     with openssl_encrypt() function with 12 bytes IV, only first 7 bytes of the IV is actually used. This can     lead to both decreased security and incorrect encryption data. (CVE-2020-7069)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
143640	SUSE SLED15 / SLES15 Security Update : php7 (SUSE-SU-2020:2941-1)	Nessus	SuSE Local Security Checks	2020/12/9	2024/2/6	medium
167950	SUSE SLES15: apache2-mod_php7 / php7 / php7-bcmath / php7-bz2 / php7-calendar / etc (SUSE-SU-2022:4067-1)	Nessus	SuSE Local Security Checks	2022/11/19	2026/6/25	critical
230246	Linux Distros Unpatched Vulnerability : CVE-2020-7069	Nessus	Misc.	2025/3/5	2026/11/5	medium

検出

プラグインの検索

medium

critical

medium