An issue was discovered in PHP before 5.6.36, 7.0.x before 7.0.30, 7.1.x before 7.1.17, and 7.2.x before 7.2.5. exif_read_data in ext/exif/exif.c has an out-of-bounds read for crafted JPEG data because exif_iif_add_value mishandles the case of a MakerNote that lacks a final '\0' character.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:2519 advisory.

    PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

    The following packages have been upgraded to a later upstream version: rh-php71-php (7.1.30). (BZ#1631672)

    Security Fix(es):

    * gd: Unsigned integer underflow _gdContributionsAlloc() (CVE-2016-10166)

    * php: Out of bounds access in php_pcre.c:php_pcre_replace_impl() (CVE-2017-9118)

    * php: Integer overflow in mysqli_api.c:mysqli_real_escape_string() (CVE-2017-9120)

    * php: Heap use after free in ext/standard/var_unserializer.re (CVE-2017-12932)

    * php: Reflected XSS in .phar 404 page (CVE-2018-5712)

    * php: Stack-based buffer under-read in php_stream_url_wrap_http_ex() in http_fopen_wrapper.c when parsing     HTTP response (CVE-2018-7584)

    * php: Infinite loop in ext/iconv/iconv.c when using stream filter with convert.incov on invalid sequence     leads to denial-of-service (CVE-2018-10546)

    * php: Reflected XSS vulnerability on PHAR 403 and 404 error pages (CVE-2018-10547)

    * php: NULL pointer dereference due to mishandling of ldap_get_dn return value allows DoS via malicious     LDAP server reply (CVE-2018-10548)

    * php: Mishandled http_header_value in an atoi() call in http_fopen_wrapper.c (CVE-2018-14884)

    * php: Cross-site scripting (XSS) flaw in Apache2 component via body of 'Transfer-Encoding: chunked'     request (CVE-2018-17082)

    * gd: Heap based buffer overflow in gdImageColorMatch() in gd_color_match.c (CVE-2019-6977)

    * php: Invalid memory access in function xmlrpc_decode() (CVE-2019-9020)

    * php: File rename across filesystems may allow unwanted access during processing (CVE-2019-9637)

    * php: Uninitialized read in exif_process_IFD_in_MAKERNOTE (CVE-2019-9638)

    * php: Uninitialized read in exif_process_IFD_in_MAKERNOTE (CVE-2019-9639)

    * php: Invalid read in exif_process_SOFn() (CVE-2019-9640)

    * php: Out-of-bounds read due to integer overflow in iconv_mime_decode_headers() (CVE-2019-11039)

    * php: Buffer over-read in exif_read_data() (CVE-2019-11040)

    * php: Out-of-bound read in timelib_meridian() (CVE-2017-16642)

    * gd: Infinite loop in gdImageCreateFromGifCtx() in gd_gif_in.c (CVE-2018-5711)

    * php: Dumpable FPM child processes allow bypassing opcache access controls (CVE-2018-10545)

    * php: Out-of-bounds read in ext/exif/exif.c:exif_read_data() when reading crafted JPEG data     (CVE-2018-10549)

    * php: exif: Buffer over-read in exif_process_IFD_in_MAKERNOTE() (CVE-2018-14851)

    * php: Buffer over-read in PHAR reading functions (CVE-2018-20783)

    * php: Heap-based buffer over-read in PHAR reading functions (CVE-2019-9021)

    * php: memcpy with negative length via crafted DNS response (CVE-2019-9022)

    * php: Heap-based buffer over-read in mbstring regular expression functions (CVE-2019-9023)

    * php: Out-of-bounds read in base64_decode_xmlrpc in ext/xmlrpc/libxmlrpc/base64.c (CVE-2019-9024)

    * php: Heap buffer overflow in function exif_process_IFD_TAG() (CVE-2019-11034)

    * php: Heap buffer overflow in function exif_iif_add_value() (CVE-2019-11035)

    * php: Buffer over-read in exif_process_IFD_TAG() leading to information disclosure (CVE-2019-11036)

    * gd: Information disclosure in gdImageCreateFromXbm() (CVE-2019-11038)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its banner, the version of PHP running on the remote web server is 7.2.x prior to 7.2.5. It is, therefore, affected by multiple vulnerabilities.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its banner, the version of PHP running on the remote web server is 7.1.x prior to 7.1.17. It is, therefore, affected by multiple vulnerabilities.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its banner, the version of PHP running on the remote web server is 7.0.x prior to 7.0.30. It is, therefore, affected by multiple vulnerabilities.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its banner, the version of PHP running on the remote web server is 5.6.x prior to 5.6.36. It is, therefore, affected by multiple vulnerabilities.

Note that the scanner has not attempted to exploit this issue but has instead relied only on the application's self-reported version number.

**PHP version 7.2.5** (26 Apr 2018)

**Core:**

  - Fixed bug php#75722 (Convert valgrind detection to     configure option). (Michael Heimpold)

**Date:**

  - Fixed bug php#76131 (mismatch arginfo for date_create).
    (carusogabriel)

**Exif:**

  - Fixed bug php#76130 (Heap Buffer Overflow (READ: 1786)     in exif_iif_add_value). (Stas)

**FPM:**

  - Fixed bug php#68440 (ERROR: failed to reload: execvp()     failed: Argument list too long). (Jacob Hipps)

  - Fixed incorrect write to getenv result in FPM reload.
    (Jakub Zelenka)

**GD:**

  - Fixed bug php#52070 (imagedashedline() - dashed line     sometimes is not visible). (cmb)

**intl:**

  - Fixed bug php#76153 (Intl compilation fails with icu4c     61.1). (Anatol)

**iconv:**

  - Fixed bug php#76249 (stream filter convert.iconv leads     to infinite loop on invalid sequence). (Stas)

**ldap:**

  - Fixed bug php#76248 (Malicious LDAP-Server Response     causes Crash). (Stas)

**mbstring:**

  - Fixed bug php#75944 (Wrong cp1251 detection). (dmk001)

  - Fixed bug php#76113 (mbstring does not build with     Oniguruma 6.8.1). (chrullrich, cmb)

**ODBC:**

  - Fixed bug php#76088 (ODBC functions are not available by     default on Windows). (cmb)

**Opcache:**

  - Fixed bug php#76094 (Access violation when using     opcache). (Laruence)

**Phar:**

  - Fixed bug php#76129 (fix for CVE-2018-5712 may not be     complete). (Stas)

**phpdbg:**

  - Fixed bug php#76143 (Memory corruption: arbitrary NUL     overwrite). (Laruence)

**SPL:**

  - Fixed bug php#76131 (mismatch arginfo for splarray     constructor). (carusogabriel)

**standard:**

  - Fixed bug php#74139 (mail.add_x_header default     inconsistent with docs). (cmb)

  - Fixed bug php#75996 (incorrect url in header for     mt_rand). (tatarbj)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201812-01 (PHP: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in PHP. Please review the       referenced CVE identifiers for details.
  Impact :

    An attacker could cause a Denial of Service condition or obtain       sensitive information.
  Workaround :

    There is no known workaround at this time.

According to its self-reported version, the Tenable SecurityCenter application installed on the remote host is prior to 5.7.1. It is, therefore, affected by multiple vulnerabilities.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several vulnerabilities were found in PHP, a widely-used open source general purpose scripting language :

  - CVE-2018-7584     Buffer underread in parsing HTTP responses

  - CVE-2018-10545     Dumpable FPM child processes allowed the bypass of     opcache access controls

  - CVE-2018-10546     Denial of service via infinite loop in convert.iconv     stream filter

  - CVE-2018-10547     The fix for CVE-2018-5712 (shipped in DSA 4080) was     incomplete

  - CVE-2018-10548     Denial of service via malformed LDAP server responses

  - CVE-2018-10549     Out-of-bounds read when parsing malformed JPEG files

Several vulnerabilities were found in PHP, a widely-used open source general purpose scripting language :

CVE-2018-7584

A stack-buffer-overflow while parsing HTTP response results in copying a large string and possible memory corruption and/or denial of service

CVE-2018-10545

Dumpable FPM child processes allow bypassing opcache access controls resulting in potential information disclosure where one user can obtain information about another user's running PHP applications

CVE-2018-10546

An invalid sequence of bytes can trigger an infinite loop in the stream filter convert.iconv

CVE-2018-10547

A previous fix for CVE-2018-5712 may not be complete, resulting in an additional vulnerability in the form of a reflected XSS in the PHAR 403 and 404 error pages

CVE-2018-10548

A malicious remote LDAP server can send a crafted response that will cause a denial of service (NULL pointer dereference resulting in an application crash)

CVE-2018-10549

A crafted JPEG file can case an out-of-bounds read and heap buffer overflow

For Debian 8 'Jessie', these problems have been fixed in version 5.6.36+dfsg-0+deb8u1.

We recommend that you upgrade your php5 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New php packages are available for Slackware 14.0, 14.1, and 14.2 to fix security issues.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3646-1 advisory.

    It was discovered that PHP incorrectly handled opcache access controls when configured to use PHP-FPM. A     local user could possibly use this issue to obtain sensitive information from another user's PHP     applications. (CVE-2018-10545)

    It was discovered that the PHP iconv stream filter incorrect handled certain invalid multibyte sequences.
    A remote attacker could possibly use this issue to cause PHP to hang, resulting in a denial of service.
    (CVE-2018-10546)

    It was discovered that the PHP PHAR error pages incorrectly filtered certain data. A remote attacker could     possibly use this issue to perform a reflected XSS attack. (CVE-2018-10547)

    It was discovered that PHP incorrectly handled LDAP. A malicious remote LDAP server could possibly use     this issue to cause PHP to crash, resulting in a denial of service. (CVE-2018-10548)

    It was discovered that PHP incorrectly handled certain exif tags in JPEG images. A remote attacker could     possibly use this issue to cause PHP to crash, resulting in a denial of service. This issue only affected     Ubuntu 16.04 LTS, Ubuntu 17.10, and Ubuntu 18.04 LTS. (CVE-2018-10549)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

NULL pointer dereference due to mishandling of ldap_get_dn return value allows denial-of-service by malicious LDAP server or man-in-the-middle attacker

An issue was discovered in PHP before 5.6.36, 7.0.x before 7.0.30, 7.1.x before 7.1.17, and 7.2.x before 7.2.5. ext/ldap/ldap.c allows remote LDAP servers to cause a denial of service (NULL pointer dereference and application crash) because of mishandling of the ldap_get_dn return value.(CVE-2018-10548)

Infinite loop in ext/iconv/iconv.c when using stream filter with convert.incov on invalid sequence leads to denial-of-service

An issue was discovered in PHP before 5.6.36, 7.0.x before 7.0.30, 7.1.x before 7.1.17, and 7.2.x before 7.2.5. An infinite loop exists in ext/iconv/iconv.c because the iconv stream filter does not reject invalid multibyte sequences.(CVE-2018-10546)

Reflected XSS vulnerability on PHAR 403 and 404 error pages

An issue was discovered in ext/phar/phar_object.c in PHP before 5.6.36, 7.0.x before 7.0.30, 7.1.x before 7.1.17, and 7.2.x before 7.2.5. There is Reflected XSS on the PHAR 403 and 404 error pages via request data of a request for a .phar file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2018-5712 .(CVE-2018-10547)

Out-of-bounds read in ext/exif/exif.c:exif_read_data() when reading crafted JPEG data

An issue was discovered in PHP before 5.6.36, 7.0.x before 7.0.30, 7.1.x before 7.1.17, and 7.2.x before 7.2.5. exif_read_data in ext/exif/exif.c has an out-of-bounds read for crafted JPEG data because exif_iif_add_value mishandles the case of a MakerNote that lacks a final '\0' character.(CVE-2018-10549)

According to its banner, the version of PHP running on the remote web server is 7.2.x prior to 7.2.5. It is, therefore, affected by multiple vulnerabilities.

According to its banner, the version of PHP running on the remote web server is 7.1.x prior to 7.1.17. It is, therefore, affected by multiple vulnerabilities.

According to its banner, the version of PHP running on the remote web server is 7.0.x prior to 7.0.30. It is, therefore, affected by multiple vulnerabilities.

According to its banner, the version of PHP running on the remote web server is 5.6.x prior to 5.6.36. It is, therefore, affected by multiple vulnerabilities.

**PHP version 7.1.17** (26 Apr 2018)

**Date:**

  - Fixed bug php#76131 (mismatch arginfo for date_create).
    (carusogabriel)

**Exif:**

  - Fixed bug php#76130 (Heap Buffer Overflow (READ: 1786)     in exif_iif_add_value). (Stas)

**FPM:**

  - Fixed bug php#68440 (ERROR: failed to reload: execvp()     failed: Argument list too long). (Jacob Hipps)

  - Fixed incorrect write to getenv result in FPM reload.
    (Jakub Zelenka)

**GD:**

  - Fixed bug php#52070 (imagedashedline() - dashed line     sometimes is not visible). (cmb)

**iconv:**

  - Fixed bug php#76249 (stream filter convert.iconv leads     to infinite loop on invalid sequence). (Stas)

**intl:**

  - Fixed bug php#76153 (Intl compilation fails with icu4c     61.1). (Anatol)

**ldap:**

  - Fixed bug php#76248 (Malicious LDAP-Server Response     causes Crash). (Stas)

**mbstring:**

  - Fixed bug php#75944 (Wrong cp1251 detection). (dmk001)

  - Fixed bug php#76113 (mbstring does not build with     Oniguruma 6.8.1). (chrullrich, cmb)

**Phar:**

  - Fixed bug php#76129 (fix for CVE-2018-5712 may not be     complete). (Stas)

**phpdbg:**

  - Fixed bug php#76143 (Memory corruption: arbitrary NUL     overwrite). (Laruence)

**SPL:**

  - Fixed bug php#76131 (mismatch arginfo for splarray     constructor). (carusogabriel)

**standard:**

  - Fixed bug php#75996 (incorrect url in header for     mt_rand). (tatarbj)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
194152	RHEL 7 : rh-php71-php (RHSA-2019:2519)	Nessus	Red Hat Local Security Checks	critical
98868	PHP 7.2.x < 7.2.5 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
98860	PHP 7.1.x < 7.1.17 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
98849	PHP 7.0.x < 7.0.30 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
98826	PHP 5.6.x < 5.6.36 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
120886	Fedora 28 : php (2018-ee6707d519)	Nessus	Fedora Local Security Checks	high
119320	GLSA-201812-01 : PHP: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
117672	Tenable SecurityCenter < 5.7.1 Multiple Vulnerabilities (TNS-2018-12)	Nessus	Misc.	critical
110928	Debian DSA-4240-1 : php7.0 - security update	Nessus	Debian Local Security Checks	critical
110697	Debian DLA-1397-1 : php5 security update	Nessus	Debian Local Security Checks	critical
109871	Slackware 14.0 / 14.1 / 14.2 : php (SSA:2018-136-02)	Nessus	Slackware Local Security Checks	high
109812	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : PHP vulnerabilities (USN-3646-1)	Nessus	Ubuntu Local Security Checks	high
109701	Amazon Linux AMI : php56 / php70,php71 (ALAS-2018-1019)	Nessus	Amazon Linux Local Security Checks	high
109579	PHP 7.2.x < 7.2.5 Stack Buffer Overflow	Nessus	CGI abuses	high
109578	PHP 7.1.x < 7.1.17 Multiple Vulnerabilities	Nessus	CGI abuses	high
109577	PHP 7.0.x < 7.0.30 Multiple Vulnerabilities	Nessus	CGI abuses	high
109576	PHP 5.6.x < 5.6.36 Multiple Vulnerabilities	Nessus	CGI abuses	high
109560	Fedora 26 : php (2018-6071a600e8)	Nessus	Fedora Local Security Checks	high
109559	Fedora 27 : php (2018-04f6056c42)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2018-10549

high

Tenable Plugins

critical

high

high

high

high

high

high

critical

critical

critical

high

high

high

high

high

high

high

high

high