In PHP versions 7.3.x below 7.3.15 and 7.4.x below 7.4.3, while extracting PHAR files on Windows using phar extension, certain content inside PHAR file could lead to one-byte read past the allocated buffer. This could potentially lead to information disclosure or crash.

According to its self-reported version, the Tenable SecurityCenter application installed on the remote host is less than 5.19.0 and is therefore affected by multiple vulnerabilities in the following components: 
  - Apache FOP
  - Underscore
  - Handlebars
  - PHP
  - sqlite

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

The remote host is affected by the vulnerability described in GLSA-202003-57 (PHP: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in PHP. Please review the       CVE identifiers referenced below for details.
  Impact :

    An attacker could possibly execute arbitrary shell commands, cause a       Denial of Service condition or obtain sensitive information.
  Workaround :

    There is no known workaround at this time.

The version of php73 installed on the remote host is prior to 7.3.15-1.24. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1351 advisory.

    In PHP versions 7.3.x below 7.3.15 and 7.4.x below 7.4.3, while extracting PHAR files on Windows using     phar extension, certain content inside PHAR file could lead to one-byte read past the allocated buffer.
    This could potentially lead to information disclosure or crash. (CVE-2020-7061)

    In PHP versions 7.2.x below 7.2.28, 7.3.x below 7.3.15 and 7.4.x below 7.4.3, when using file upload     functionality, if upload progress tracking is enabled, but session.upload_progress.cleanup is set to 0     (disabled), and the file upload fails, the upload procedure would try to clean up data that does not exist     and encounter null pointer dereference, which would likely lead to a crash. (CVE-2020-7062)

    In PHP versions 7.2.x below 7.2.28, 7.3.x below 7.3.15 and 7.4.x below 7.4.3, when creating PHAR archive     using PharData::buildFromIterator() function, the files are added with default permissions (0666, or all     access) even if the original files on the filesystem were with more restrictive permissions. This may     result in files having more lax permissions than intended when such archive is extracted. (CVE-2020-7063)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of php72 installed on the remote host is prior to 7.2.28-1.21. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1350 advisory.

    In PHP versions 7.3.x below 7.3.15 and 7.4.x below 7.4.3, while extracting PHAR files on Windows using     phar extension, certain content inside PHAR file could lead to one-byte read past the allocated buffer.
    This could potentially lead to information disclosure or crash. (CVE-2020-7061)

    In PHP versions 7.2.x below 7.2.28, 7.3.x below 7.3.15 and 7.4.x below 7.4.3, when using file upload     functionality, if upload progress tracking is enabled, but session.upload_progress.cleanup is set to 0     (disabled), and the file upload fails, the upload procedure would try to clean up data that does not exist     and encounter null pointer dereference, which would likely lead to a crash. (CVE-2020-7062)

    In PHP versions 7.2.x below 7.2.28, 7.3.x below 7.3.15 and 7.4.x below 7.4.3, when creating PHAR archive     using PharData::buildFromIterator() function, the files are added with default permissions (0666, or all     access) even if the original files on the filesystem were with more restrictive permissions. This may     result in files having more lax permissions than intended when such archive is extracted. (CVE-2020-7063)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its banner, the version of PHP running on the remote web server is prior to 7.2.28, 7.3.x prior to 7.3.15, or 7.4.x prior to 7.4.3. It is, therefore, affected by multiple vulnerabilities:

 - A heap buffer overflow exists in phar_extract_file. (CVE-2020-7061)

 - A null pointer dereference exists in PHP session upload progress. (CVE-2020-7062)

 - A file permissions bypass exists when files are added to tar with Phar::buildFromIterator. (CVE-2020-7063)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its banner, the version of PHP running on the remote web server is either 7.2.x prior to 7.2.28, 7.3.x prior to 7.3.15, or 7.4.x prior to 7.4.3. It is, therefore, affected by multiple vulnerabilities:

  - A heap-based buffer overflow condition exists in phar_extract_file()     function due to incorrect loop termination. An unauthenticated, remote     attacker can exploit this to cause a denial of service condition or the     execution of arbitrary code. (CVE-2020-7061)

  - A denial of service (DoS) vulnerability exists in PHP SessionUpload     Progress functions due to Null Pointer Dereference. An unauthenticated,     remote attacker can exploit this issue to cause the php service to stop     responding. (CVE-2020-7062)     
 - An Insecure File Permissions on the buildFromIterator function gives all     access permission to Tar files. (CVE-2020-7063)

**PHP version 7.3.15** (20 Feb 2020)

**Core:**

  - Fixed bug php#71876 (Memory corruption     htmlspecialchars(): charset `*' not supported). (Nikita)

  - Fixed bug #php#79146 (cscript can fail to run on some     systems). (clarodeus)

  - Fixed bug php#78323 (Code 0 is returned on invalid     options). (Ivan Mikheykin)

  - Fixed bug php#76047 (Use-after-free when accessing     already destructed backtrace arguments). (Nikita)

**CURL:**

  - Fixed bug php#79078 (Hypothetical use-after-free in     curl_multi_add_handle()). (cmb)

**Intl:**

  - Fixed bug php#79212 (NumberFormatter::format() may     detect wrong type). (cmb)

**Libxml:**

  - Fixed bug php#79191 (Error in SoapClient ctor disables     DOMDocument::save()). (Nikita, cmb)

**MBString:**

  - Fixed bug php#79154 (mb_convert_encoding() can modify     $from_encoding). (cmb)

**MySQLnd:**

  - Fixed bug php#79084 (mysqlnd may fetch wrong column     indexes with MYSQLI_BOTH). (cmb)

**OpenSSL:**

  - Fixed bug php#79145 (openssl memory leak). (cmb, Nikita)

**Phar:**

  - Fixed bug php#79082 (Files added to tar with     Phar::buildFromIterator have all-access permissions).
    (**CVE-2020-7063**) (stas)

  - Fixed bug php#79171 (heap-buffer-overflow in     phar_extract_file). (**CVE-2020-7061**) (cmb)

  - Fixed bug php#76584 (PharFileInfo::decompress not     working). (cmb)

**Reflection:**

  - Fixed bug php#79115 (ReflectionClass::isCloneable call     reflected class __destruct). (Nikita)

**Session:**

  - Fixed bug php#79221 (NULL pointer Dereference in PHP     Session Upload Progress). (**CVE-2020-7062**) (stas)

**SPL:**

  - Fixed bug php#79151 (heap use after free caused by     spl_dllist_it_helper_move_forward). (Nikita)

**Standard:**

  - Fixed bug php#78902 (Memory leak when using     stream_filter_append). (liudaixiao)

**Testing:**

  - Fixed bug php#78090 (bug45161.phpt takes forever to     finish). (cmb)

**XSL:**

  - Fixed bug php#70078 (XSL callbacks with nodes as     parameter leak memory). (cmb)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
152986	Tenable SecurityCenter < 5.19.0 Multiple Vulnerabilities (TNS-2021-14)	Nessus	Misc.	critical
134965	GLSA-202003-57 : PHP: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
134573	Amazon Linux AMI : php73 (ALAS-2020-1351)	Nessus	Amazon Linux Local Security Checks	critical
134572	Amazon Linux AMI : php72 (ALAS-2020-1350)	Nessus	Amazon Linux Local Security Checks	critical
98975	PHP 7.2.x < 7.2.28 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
98974	PHP 7.3.x < 7.3.15 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
98973	PHP 7.4.x < 7.4.3 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
134162	PHP 7.2.x < 7.2.28 / PHP 7.3.x < 7.3.15 / 7.4.x < 7.4.3 Multiple Vulnerabilities	Nessus	CGI abuses	critical
134133	Fedora 30 : php (2020-4ea970ebc6)	Nessus	Fedora Local Security Checks	critical
134132	Fedora 31 : php (2020-32f9a2b308)	Nessus	Fedora Local Security Checks	critical

Detections

Analytics

CVE-2020-7061

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical