In PHP versions 8.1.x below 8.1.8, when fileinfo functions, such as finfo_buffer, due to incorrect patch applied to the third party code from libmagic, incorrect function may be used to free allocated memory, which may lead to heap corruption.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-081 advisory.

  - In PHP versions 8.1.x below 8.1.8, when fileinfo functions, such as finfo_buffer, due to incorrect patch     applied to the third party code from libmagic, incorrect function may be used to free allocated memory,     which may lead to heap corruption. (CVE-2022-31627)

  - In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the phar uncompressor code would recursively uncompress     quines gzip files, resulting in an infinite loop. (CVE-2022-31628)

  - In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the vulnerability enables network and same-site     attackers to set a standard insecure cookie in the victim's browser which is treated as a `__Host-` or     `__Secure-` cookie by PHP applications. (CVE-2022-31629)

  - In PHP versions prior to 7.4.33, 8.0.25 and 8.2.12, when using imageloadfont() function in gd extension,     it is possible to supply a specially crafted font file, such as if the loaded font is used with     imagechar() function, the read outside allocated buffer will be used. This can lead to crashes or     disclosure of confidential information. (CVE-2022-31630)

  - The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer     overflow that allows attackers to execute arbitrary code or eliminate expected cryptographic properties.
    This occurs in the sponge function interface. (CVE-2022-37454)

  - php: PDO::quote() may return unquoted string due to an integer overflow (CVE-2022-31631)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of php8.1 installed on the remote host is prior to 8.1.12-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-243 advisory.

  - In PHP versions 8.1.x below 8.1.8, when fileinfo functions, such as finfo_buffer, due to incorrect patch     applied to the third party code from libmagic, incorrect function may be used to free allocated memory,     which may lead to heap corruption. (CVE-2022-31627)

  - In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the phar uncompressor code would recursively uncompress     quines gzip files, resulting in an infinite loop. (CVE-2022-31628)

  - In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the vulnerability enables network and same-site     attackers to set a standard insecure cookie in the victim's browser which is treated as a `__Host-` or     `__Secure-` cookie by PHP applications. (CVE-2022-31629)

  - In PHP versions prior to 7.4.33, 8.0.25 and 8.2.12, when using imageloadfont() function in gd extension,     it is possible to supply a specially crafted font file, such as if the loaded font is used with     imagechar() function, the read outside allocated buffer will be used. This can lead to crashes or     disclosure of confidential information. (CVE-2022-31630)

  - The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer     overflow that allows attackers to execute arbitrary code or eliminate expected cryptographic properties.
    This occurs in the sponge function interface. (CVE-2022-37454)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202209-20 (PHP: Multiple Vulnerabilities)

  - In PHP versions 7.3.x up to and including 7.3.31, 7.4.x below 7.4.25 and 8.0.x below 8.0.12, when running     PHP FPM SAPI with main FPM daemon process running as root and child worker processes running as lower-     privileged users, it is possible for the child processes to access memory shared with the main process and     write to it, modifying it in a way that would cause the root process to conduct invalid memory reads and     writes, which can be used to escalate privileges from local unprivileged user to the root user.
    (CVE-2021-21703)

  - In PHP versions 7.3.x below 7.3.29, 7.4.x below 7.4.21 and 8.0.x below 8.0.8, when using Firebird PDO     driver extension, a malicious database server could cause crashes in various database functions, such as     getAttribute(), execute(), fetch() and others by returning invalid response data that is not parsed     correctly by the driver. This can result in crashes, denial of service or potentially memory corruption.
    (CVE-2021-21704)

  - In PHP versions 7.3.x below 7.3.29, 7.4.x below 7.4.21 and 8.0.x below 8.0.8, when using URL validation     functionality via filter_var() function with FILTER_VALIDATE_URL parameter, an URL with invalid password     field can be accepted as valid. This can lead to the code incorrectly parsing the URL and potentially     leading to other security implications - like contacting a wrong server or making a wrong access decision.
    (CVE-2021-21705)

  - In PHP versions 7.4.x below 7.4.28, 8.0.x below 8.0.16, and 8.1.x below 8.1.3, when using filter functions     with FILTER_VALIDATE_FLOAT filter and min/max limits, if the filter fails, there is a possibility to     trigger use of allocated memory after free, which can result it crashes, and potentially in overwrite of     other memory chunks and RCE. This issue affects: code that uses FILTER_VALIDATE_FLOAT with min/max limits.
    (CVE-2021-21708)

  - In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when using Postgres     database extension, supplying invalid parameters to the parametrized query may lead to PHP attempting to     free memory using uninitialized data as pointers. This could lead to RCE vulnerability or denial of     service. (CVE-2022-31625)

  - In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when pdo_mysql extension     with mysqlnd driver, if the third party is allowed to supply host to connect to and the password for the     connection, password of excessive length can trigger a buffer overflow in PHP, which can lead to a remote     code execution vulnerability. (CVE-2022-31626)

  - In PHP versions 8.1.x below 8.1.8, when fileinfo functions, such as finfo_buffer, due to incorrect patch     applied to the third party code from libmagic, incorrect function may be used to free allocated memory,     which may lead to heap corruption. (CVE-2022-31627)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-5530-1 advisory.

    It was discovered that PHP incorrectly handled certain memory operations when obtaining file information.
    A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or     possibly execute arbitrary code.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the version of PHP installed on the remote host is 8.1.x prior to 8.1.8. It is, therefore, affected by a heap buffer overflow vulnerability in finfo_buffer.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of PHP installed on the remote host is prior to 8.1.8. It is, therefore, affected by a vulnerability as referenced in the Version 8.1.8 advisory.

  - In PHP versions 8.1.x below 8.1.8, when fileinfo functions, such as finfo_buffer, due to incorrect patch     applied to the third party code from libmagic, incorrect function may be used to free allocated memory,     which may lead to heap corruption. (CVE-2022-31627)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
173063	Amazon Linux 2023 : php8.1, php8.1-bcmath, php8.1-cli (ALAS2023-2023-081)	Nessus	Amazon Linux Local Security Checks	critical
168584	Amazon Linux 2022 : php8.1 (ALAS2022-2022-243)	Nessus	Amazon Linux Local Security Checks	critical
165627	GLSA-202209-20 : PHP: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	critical
163436	Ubuntu 22.04 LTS : PHP vulnerability (USN-5530-1)	Nessus	Ubuntu Local Security Checks	critical
113308	PHP 8.1.x < 8.1.8 Heap Overflow	Web App Scanning	Component Vulnerability	critical
162844	PHP 8.1.x < 8.1.8	Nessus	CGI abuses	critical

Detections

Analytics

CVE-2022-31627

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical