This update for php5 fixes the following issues :

Security issues fixed :

CVE-2019-11041: Fixed heap buffer over-read in exif_scan_thumbnail() (bsc#1146360).

CVE-2019-11042: Fixed heap buffer over-read in exif_process_user_comment() (bsc#1145095).

CVE-2019-11043: Fixed possible remote code execution via env_path_info underflow in fpm_main.c (bsc#1154999).

CVE-2019-11045: Fixed an issue with the PHP DirectoryIterator class that accepts filenames with embedded \0 bytes (bsc#1159923).

CVE-2019-11046: Fixed an out-of-bounds read in bc_shift_addsub (bsc#1159924).

CVE-2019-11047: Fixed an information disclosure in exif_read_data (bsc#1159922).

CVE-2019-11050: Fixed a buffer over-read in the EXIF extension (bsc#1159927).

CVE-2020-7059: Fixed an out-of-bounds read in php_strip_tags_ex (bsc#1162629).

CVE-2020-7060: Fixed a global buffer-overflow in mbfl_filt_conv_big5_wchar (bsc#1162632).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for php72 fixes the following issues :

Security issues fixed :

CVE-2019-11041: Fixed heap buffer over-read in exif_scan_thumbnail() (bsc#1146360).

CVE-2019-11042: Fixed heap buffer over-read in exif_process_user_comment() (bsc#1145095).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the php packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - When PHP EXIF extension is parsing EXIF information     from an image, e.g. via exif_read_data() function, in     PHP versions 7.1.x below 7.1.31, 7.2.x below 7.2.21 and     7.3.x below 7.3.8 it is possible to supply it with data     what will cause it to read past the allocated buffer.
    This may lead to information disclosure or     crash.(CVE-2019-11042)

  - When PHP EXIF extension is parsing EXIF information     from an image, e.g. via exif_read_data() function, in     PHP versions 7.1.x below 7.1.31, 7.2.x below 7.2.21 and     7.3.x below 7.3.8 it is possible to supply it with data     what will cause it to read past the allocated buffer.
    This may lead to information disclosure or     crash.(CVE-2019-11041)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for php7 fixes the following issues :

Security issues fixed :

  - CVE-2019-11041: Fixed heap buffer over-read in     exif_scan_thumbnail() (bsc#1146360).

  - CVE-2019-11042: Fixed heap buffer over-read in     exif_process_user_comment() (bsc#1145095).

Non-security issue fixed :

  - Drop -n from php invocation from pecl (bsc#1151793).

This update was imported from the SUSE:SLE-15:Update update project.

The CentOS Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS6:CLSA-2026:1787229717 advisory.

  - An issue was discovered in PHP before 5.6.36, 7.0.x before 7.0.30, 7.1.x before 7.1.17, and 7.2.x before     7.2.5. An infinite loop exists in ext/iconv/iconv.c because the iconv stream filter does not reject     invalid multibyte sequences. (CVE-2018-10546)

  - An issue was discovered in PHP before 5.6.36, 7.0.x before 7.0.30, 7.1.x before 7.1.17, and 7.2.x before     7.2.5. ext/ldap/ldap.c allows remote LDAP servers to cause a denial of service (NULL pointer dereference     and application crash) because of mishandling of the ldap_get_dn return value. (CVE-2018-10548)

  - When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in     PHP versions 7.1.x below 7.1.31, 7.2.x below 7.2.21 and 7.3.x below 7.3.8 it is possible to supply it with     data what will cause it to read past the allocated buffer. This may lead to information disclosure or     crash. (CVE-2019-11041, CVE-2019-11042)

  - A use-after-free in onig_new_deluxe() in regext.c in Oniguruma 6.9.2 allows attackers to potentially cause     information disclosure, denial of service, or possibly code execution by providing a crafted regular     expression. The attacker provides a pair of a regex pattern and a string, with a multi-byte encoding that     gets handled by onig_new_deluxe(). Oniguruma issues often affect Ruby, as well as common optional     libraries for PHP and Rust. (CVE-2019-13224)

  - gdImageColorMatch in gd_color_match.c in the GD Graphics Library (aka LibGD) 2.2.5, as used in the     imagecolormatch function in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before     7.3.1, has a heap-based buffer overflow. This can be exploited by an attacker who is able to trigger     imagecolormatch calls with crafted image data. (CVE-2019-6977)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
131592	EulerOS 2.0 SP2 : php (EulerOS-SA-2019-2438)	Nessus	Huawei Local Security Checks	2019/12/4	2023/4/25	critical
134199	SUSE SLES12 Security Update : php5 (SUSE-SU-2020:0522-1)	Nessus	SuSE Local Security Checks	2020/3/2	2023/4/25	critical
128473	SUSE SLES12 Security Update : php72 (SUSE-SU-2019:2270-1)	Nessus	SuSE Local Security Checks	2019/9/3	2024/4/30	high
129448	EulerOS 2.0 SP8 : php (EulerOS-SA-2019-2089)	Nessus	Huawei Local Security Checks	2019/9/30	2024/4/22	high
129671	openSUSE Security Update : php7 (openSUSE-2019-2271)	Nessus	SuSE Local Security Checks	2019/10/7	2024/4/19	high
359568	CentOS Linux 6 [TuxCare] Security Update: php / php-bcmath / php-cli / php-common / php-dba / php-devel / etc Multiple Vulnerabilities (CENTOS6:CLSA-2026:1787229717)	Nessus	CentOS Local Security Checks	2026/10/1	2026/10/20	high

検出

プラグインの検索

critical

critical

high

high

high

high