Due to an incomplete fix to CVE-2022-31629 https://github.com/advisories/GHSA-c43m-486j-j32p , network and same-site attackers can set a standard insecure cookie in the victim's browser which is treated as a __Host- or __Secure- cookie by PHP applications.

The remote host is affected by the vulnerability described in GLSA-202408-32 (PHP: Multiple Vulnerabilities)

    Multiple vulnerabilities have been discovered in PHP. Please review the CVE identifiers referenced below     for details.

Tenable has extracted the preceding description block directly from the Gentoo Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of php installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-2756 advisory.

  - Due to an incomplete fix to CVE-2022-31629 https://github.com/advisories/GHSA-c43m-486j-j32p , network and     same-site attackers can set a standard insecure cookie in the victim's browser which is treated as a
    __Host- or __Secure- cookie by PHP applications. (CVE-2024-2756)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of php installed on the remote host is prior to 8.1.29-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2PHP8.1-2024-005 advisory.

    The openssl_private_decrypt function in PHP, when using PKCS1 padding (OPENSSL_PKCS1_PADDING, which is the     default), is vulnerable to the Marvin Attack unless it is used with an OpenSSL version that includes the     changes from this pull request:  https://github.com/openssl/openssl/pull/13817     (rsa_pkcs1_implicit_rejection). These changes are part of OpenSSL 3.2 and have also been backported to     stable versions of various Linux distributions, as well as to the PHP builds provided for Windows since     the previous release. All distributors and builders should ensure that this version is used to prevent PHP     from being vulnerable.

    PHP Windows builds for the versions 8.1.29, 8.2.20 and 8.3.8 and above include OpenSSL patches that fix     the vulnerability. (CVE-2024-2408)

    The vulnerability allows a remote attacker to bypass implemented security restrictions.

    The vulnerability exists due to the way PHP handles HTTP variable names. A remote attacker can set a     standard insecure cookie in the victim's browser which is treated as a `__Host-` or `__Secure-` cookie by     PHP applications.

    Note, the vulnerability exists due to incomplete fix for #VU67756 (CVE-2022-31629). (CVE-2024-2756)

    The vulnerability allows a remote attacker to bypass authentication process.

    The vulnerability exists due to an error in within the password_verify() function, which can erroneously     return true. A remote attacker can bypass implemented authentication based on the vulnerable function and     gain unauthorized access to the web application. (CVE-2024-3096)

    In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, due to a code logic error,     filtering functions such as filter_var when validating URLs (FILTER_VALIDATE_URL) for certain types of     URLs the function will result in invalid user information (username + password part of URLs) being treated     as valid user information. This may lead to the downstream code accepting invalid URLs as valid and     parsing them incorrectly. (CVE-2024-5458)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:2037-1 advisory.

    - CVE-2024-2756: Fixed bypass of security fix applied for CVE-2022-31629 that lead PHP to consider not     secure cookies as secure (bsc#1222857)
    - CVE-2024-3096: Fixed bypass on null byte leading passwords checked via password_verify (bsc#1222858)
    - CVE-2024-5458: Fixed an issue that allows to bypass filters in filter_var FILTER_VALIDATE_URL.
    (bsc#1226073)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of php installed on the remote host is prior to 8.2.19-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2PHP8.2-2024-004 advisory.

    The vulnerability allows a remote attacker to bypass implemented security restrictions.

    The vulnerability exists due to the way PHP handles HTTP variable names. A remote attacker can set a     standard insecure cookie in the victim's browser which is treated as a `__Host-` or `__Secure-` cookie by     PHP applications.

    Note, the vulnerability exists due to incomplete fix for #VU67756 (CVE-2022-31629). (CVE-2024-2756)

    The vulnerability allows a remote attacker to bypass authentication process.

    The vulnerability exists due to an error in within the password_verify() function, which can erroneously     return true. A remote attacker can bypass implemented authentication based on the vulnerable function and     gain unauthorized access to the web application. (CVE-2024-3096)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-624 advisory.

    The vulnerability allows a remote attacker to bypass implemented security restrictions.

    The vulnerability exists due to the way PHP handles HTTP variable names. A remote attacker can set a     standard insecure cookie in the victim's browser which is treated as a `__Host-` or `__Secure-` cookie by     PHP applications.

    Note, the vulnerability exists due to incomplete fix for #VU67756 (CVE-2022-31629). (CVE-2024-2756)

    The vulnerability allows a remote attacker to bypass authentication process.

    The vulnerability exists due to an error in within the password_verify() function, which can erroneously     return true. A remote attacker can bypass implemented authentication based on the vulnerable function and     gain unauthorized access to the web application. (CVE-2024-3096)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-612 advisory.

  - Due to an incomplete fix to CVE-2022-31629 https://github.com/advisories/GHSA-c43m-486j-j32p , network and     same-site attackers can set a standard insecure cookie in the victim's browser which is treated as a
    __Host- or __Secure- cookie by PHP applications. (CVE-2024-2756)

  - In PHP version 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, if a password stored with     password_hash() starts with a null byte (\x00), testing a blank string as the password via     password_verify() will incorrectly return true. (CVE-2024-3096)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3810 advisory.

  - In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the vulnerability enables network and same-site     attackers to set a standard insecure cookie in the victim's browser which is treated as a `__Host-` or     `__Secure-` cookie by PHP applications. (CVE-2022-31629)

  - Due to an incomplete fix to CVE-2022-31629 https://github.com/advisories/GHSA-c43m-486j-j32p , network and     same-site attackers can set a standard insecure cookie in the victim's browser which is treated as a
    __Host- or __Secure- cookie by PHP applications. (CVE-2024-2756)

  - In PHP version 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, if a password stored with     password_hash() starts with a null byte (\x00), testing a blank string as the password via     password_verify() will incorrectly return true. (CVE-2024-3096)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS / 23.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6757-2 advisory.

    USN-6757-1 fixed vulnerabilities in PHP. Unfortunately these fixes were incomplete for Ubuntu 20.04 LTS,     Ubuntu 22.04 LTS, and Ubuntu 23.10. This update fixes the problem.



Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-5e8ae0def0 advisory.

    **PHP version 8.3.6** (11 Apr 2024)

    **Core:**

    * Fixed [GH-13569](https://github.com/php/php-src/issues/13569) (GC buffer unnecessarily grows up to     GC_MAX_BUF_SIZE when scanning WeakMaps). (Arnaud)
    * Fixed bug [GH-13612](https://github.com/php/php-src/issues/13612) (Corrupted memory in destructor with     weak references). (nielsdos)
    * Fixed bug [GH-13446](https://github.com/php/php-src/issues/13446) (Restore exception handler after it     finishes). (ilutov)
    * Fixed bug [GH-13784](https://github.com/php/php-src/issues/13784) (AX_GCC_FUNC_ATTRIBUTE failure).
    (Remi)
    * Fixed bug [GH-13670](https://github.com/php/php-src/issues/13670) (GC does not scale well with a lot of     objects created in destructor). (Arnaud)

    **DOM:**

    * Add some missing ZPP checks. (nielsdos)
    * Fix potential memory leak in XPath evaluation results. (nielsdos)

    **FPM:**

    * Fixed [GH-11086](https://github.com/php/php-src/issues/11086) (FPM: config test runs twice in daemonised     mode). (Jakub Zelenka)
    * Fix incorrect check in fpm_shm_free(). (nielsdos)

    **GD:**

    * Fixed bug [GH-12019](https://github.com/php/php-src/issues/12019) (add GDLIB_CFLAGS in feature tests).
    (Michael Orlitzky)

    **Gettext:**

    * Fixed sigabrt raised with dcgettext/dcngettext calls with gettext 0.22.5 with category set to LC_ALL.
    (David Carlier)

    **MySQLnd:**

    * Fix [GH-13452](https://github.com/php/php-src/issues/13452) (Fixed handshake response [mysqlnd]). (Saki     Takamachi)
    * Fix incorrect charset length in check_mb_eucjpms(). (nielsdos)

    **Opcache:**

    * Fixed [GH-13508](https://github.com/php/php-src/issues/13508) (JITed QM_ASSIGN may be optimized out when     op1 is null). (Arnaud, Dmitry)
    * Fixed [GH-13712](https://github.com/php/php-src/issues/13712) (Segmentation fault for enabled observers     when calling trait method of internal trait when opcache is loaded). (Bob)

    **Random:**

    * Fixed bug [GH-13544](https://github.com/php/php-src/issues/13544) (Pre-PHP 8.2 compatibility for     mt_srand with unknown modes). (timwolla)
    * Fixed bug [GH-13690](https://github.com/php/php-src/issues/13690) (Global Mt19937 is not properly reset     in-between requests when MT_RAND_PHP is used). (timwolla)

    **Session:**

    * Fixed bug [GH-13680](https://github.com/php/php-src/issues/13680) (Segfault with session_decode and     compilation error). (nielsdos)

    **SPL:**

    * Fixed bug [GH-13685](https://github.com/php/php-src/issues/13685) (Unexpected null pointer in     zend_string.h). (nielsdos)

    **Standard:**

    * Fixed bug [GH-11808](https://github.com/php/php-src/issues/11808) (Live filesystem modified by tests).
    (nielsdos)
    * Fixed [GH-13402](https://github.com/php/php-src/issues/13402) (Added validation of `\n` in     $additional_headers of mail()). (SakiTakamachi)
    * Fixed bug [GH-13203](https://github.com/php/php-src/issues/13203) (file_put_contents fail on strings     over 4GB on Windows). (divinity76)
    * Fixed bug [GHSA-pc52-254m-w9w7](https://github.com/php/php-src/security/advisories/GHSA-pc52-254m-w9w7)     (Command injection via array-ish $command parameter of proc_open). (CVE-2024-1874) (Jakub Zelenka)
    * Fixed bug [GHSA-wpj3-hf5j-x4v4](https://github.com/php/php-src/security/advisories/GHSA-wpj3-hf5j-x4v4)     (__Host-/__Secure- cookie bypass due to partial CVE-2022-31629 fix). (**CVE-2024-2756**) (nielsdos)
    * Fixed bug [GHSA-h746-cjrr-wfmr](https://github.com/php/php-src/security/advisories/GHSA-h746-cjrr-wfmr)     (password_verify can erroneously return true, opening ATO risk). (**CVE-2024-3096**) (Jakub Zelenka) Fixed     bug [GHSA-fjp9-9hwx-59fq](https://github.com/php/php-src/security/advisories/GHSA-fjp9-9hwx-59fq)     (mb_encode_mimeheader runs endlessly for some inputs). (**CVE-2024-2757**) (Alex Dowad)
    * Fix bug [GH-13932](https://github.com/php/php-src/issues/13932) (Attempt to fix mbstring on windows     build) (msvc). (David Carlier)




Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6757-1 advisory.

    It was discovered that PHP incorrectly handled PHP_CLI_SERVER_WORKERS variable. An attacker could possibly     use this issue to cause a crash or execute arbitrary code. This issue only affected Ubuntu 20.04 LTS, and     Ubuntu 22.04 LTS. (CVE-2022-4900)

    It was discovered that PHP incorrectly handled certain cookies. An attacker could possibly use this issue     to cookie by pass. (CVE-2024-2756)

    It was discovered that PHP incorrectly handled some passwords. An attacker could possibly use this issue     to cause an account takeover attack. (CVE-2024-3096)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:1444-1 advisory.

  - Due to an incomplete fix to CVE-2022-31629 https://github.com/advisories/GHSA-c43m-486j-j32p , network and     same-site attackers can set a standard insecure cookie in the victim's browser which is treated as a
    __Host- or __Secure- cookie by PHP applications. (CVE-2024-2756)

  - In PHP version 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, if a password stored with     password_hash() starts with a null byte (\x00), testing a blank string as the password via     password_verify() will incorrectly return true. (CVE-2024-3096)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:1446-1 advisory.

  - Due to an incomplete fix to CVE-2022-31629 https://github.com/advisories/GHSA-c43m-486j-j32p , network and     same-site attackers can set a standard insecure cookie in the victim's browser which is treated as a
    __Host- or __Secure- cookie by PHP applications. (CVE-2024-2756)

  - In PHP version 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, if a password stored with     password_hash() starts with a null byte (\x00), testing a blank string as the password via     password_verify() will incorrectly return true. (CVE-2024-3096)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:1445-1 advisory.

  - Due to an incomplete fix to CVE-2022-31629 https://github.com/advisories/GHSA-c43m-486j-j32p , network and     same-site attackers can set a standard insecure cookie in the victim's browser which is treated as a
    __Host- or __Secure- cookie by PHP applications. (CVE-2024-2756)

  - In PHP version 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, if a password stored with     password_hash() starts with a null byte (\x00), testing a blank string as the password via     password_verify() will incorrectly return true. (CVE-2024-3096)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the version of PHP installed on the remote host is 8.1.x prior to 8.1.28, 8.2.x prior to 8.2.18, or 8.3.x prior to 8.3.6. It is, therefore, affected by multiple vulnerabilities:

 - A command injection via array-ish $command parameter of proc_open. (CVE-2024-1874)

 - __Host-/__Secure- cookie bypass due to partial CVE-2022-31629 fix. (CVE-2024-2756)

 - password_verify can erroneously return true, opening ATO risk. (CVE-2024-3096)

 - mb_encode_mimeheader runs endlessly for some inputs. (CVE-2024-2757)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-39d50cc975 advisory.

    **PHP version 8.2.18** (11 Apr 2024)

    **Core:**

    * Fixed bug [GH-13612](https://github.com/php/php-src/issues/13612) (Corrupted memory in destructor with     weak references). (nielsdos)
    * Fixed bug [GH-13784](https://github.com/php/php-src/issues/13784) (AX_GCC_FUNC_ATTRIBUTE failure).
    (Remi)
    * Fixed bug [GH-13670](https://github.com/php/php-src/issues/13670) (GC does not scale well with a lot of     objects created in destructor). (Arnaud)

    **DOM:**

    * Add some missing ZPP checks. (nielsdos)
    * Fix potential memory leak in XPath evaluation results. (nielsdos)
    * Fix phpdoc for DOMDocument load methods. (VincentLanglet)

    **FPM**

    * Fix incorrect check in fpm_shm_free(). (nielsdos)

    **GD:**

    * Fixed bug [GH-12019](https://github.com/php/php-src/issues/12019) (add GDLIB_CFLAGS in feature tests).
    (Michael Orlitzky)

    **Gettext:**

    * Fixed sigabrt raised with dcgettext/dcngettext calls with gettext 0.22.5 with category set to LC_ALL.
    (David Carlier)

    **MySQLnd:**

    * Fix [GH-13452](https://github.com/php/php-src/issues/13452) (Fixed handshake response [mysqlnd]). (Saki     Takamachi)
    * Fix incorrect charset length in check_mb_eucjpms(). (nielsdos)

    **Opcache:**

    * Fixed [GH-13508](https://github.com/php/php-src/issues/13508) (JITed QM_ASSIGN may be optimized out when     op1 is null). (Arnaud, Dmitry)
    * Fixed [GH-13712](https://github.com/php/php-src/issues/13712) (Segmentation fault for enabled observers     when calling trait method of internal trait when opcache is loaded). (Bob)

    **PDO:**

    * Fix various PDORow bugs. (Girgias)

    **Random:**

    * Fixed bug [GH-13544](https://github.com/php/php-src/issues/13544) (Pre-PHP 8.2 compatibility for     mt_srand with unknown modes). (timwolla)
    * Fixed bug [GH-13690](https://github.com/php/php-src/issues/13690) (Global Mt19937 is not properly reset     in-between requests when MT_RAND_PHP is used). (timwolla)

    **Session:**

    * Fixed bug [GH-13680](https://github.com/php/php-src/issues/13680) (Segfault with session_decode and     compilation error). (nielsdos)

    **Sockets:**

    * Fixed bug [GH-13604](https://github.com/php/php-src/issues/13604) (socket_getsockname returns random     characters in the end of the socket name). (David Carlier)

    **SPL:**

    * Fixed bug [GH-13531](https://github.com/php/php-src/issues/13531) (Unable to resize SplfixedArray after     being unserialized in PHP 8.2.15). (nielsdos)
    * Fixed bug [GH-13685](https://github.com/php/php-src/issues/13685) (Unexpected null pointer in     zend_string.h). (nielsdos)

    **Standard:**

    * Fixed bug [GH-11808](https://github.com/php/php-src/issues/11808) (Live filesystem modified by tests).
    (nielsdos)
    * Fixed [GH-13402](https://github.com/php/php-src/issues/13402) (Added validation of `\n` in     $additional_headers of mail()). (SakiTakamachi)
    * Fixed bug [GH-13203](https://github.com/php/php-src/issues/13203) (file_put_contents fail on strings     over 4GB on Windows). (divinity76)
    * Fixed bug [GHSA-pc52-254m-w9w7](https://github.com/php/php-src/security/advisories/GHSA-pc52-254m-w9w7)     (Command injection via array-ish $command parameter of proc_open). (CVE-2024-1874) (Jakub Zelenka)
    * Fixed bug [GHSA-wpj3-hf5j-x4v4](https://github.com/php/php-src/security/advisories/GHSA-wpj3-hf5j-x4v4)     (__Host-/__Secure- cookie bypass due to partial CVE-2022-31629 fix). (**CVE-2024-2756**) (nielsdos)
    * Fixed bug [GHSA-h746-cjrr-wfmr](https://github.com/php/php-src/security/advisories/GHSA-h746-cjrr-wfmr)     (password_verify can erroneously return true, opening ATO risk). (**CVE-2024-3096**) (Jakub Zelenka)

    **XML:**

    * Fixed bug [GH-13517](https://github.com/php/php-src/issues/13517) (Multiple test failures when building     with --with-expat). (nielsdos)


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-b46619f761 advisory.

    **PHP version 8.2.18** (11 Apr 2024)

    **Core:**

    * Fixed bug [GH-13612](https://github.com/php/php-src/issues/13612) (Corrupted memory in destructor with     weak references). (nielsdos)
    * Fixed bug [GH-13784](https://github.com/php/php-src/issues/13784) (AX_GCC_FUNC_ATTRIBUTE failure).
    (Remi)
    * Fixed bug [GH-13670](https://github.com/php/php-src/issues/13670) (GC does not scale well with a lot of     objects created in destructor). (Arnaud)

    **DOM:**

    * Add some missing ZPP checks. (nielsdos)
    * Fix potential memory leak in XPath evaluation results. (nielsdos)
    * Fix phpdoc for DOMDocument load methods. (VincentLanglet)

    **FPM**

    * Fix incorrect check in fpm_shm_free(). (nielsdos)

    **GD:**

    * Fixed bug [GH-12019](https://github.com/php/php-src/issues/12019) (add GDLIB_CFLAGS in feature tests).
    (Michael Orlitzky)

    **Gettext:**

    * Fixed sigabrt raised with dcgettext/dcngettext calls with gettext 0.22.5 with category set to LC_ALL.
    (David Carlier)

    **MySQLnd:**

    * Fix [GH-13452](https://github.com/php/php-src/issues/13452) (Fixed handshake response [mysqlnd]). (Saki     Takamachi)
    * Fix incorrect charset length in check_mb_eucjpms(). (nielsdos)

    **Opcache:**

    * Fixed [GH-13508](https://github.com/php/php-src/issues/13508) (JITed QM_ASSIGN may be optimized out when     op1 is null). (Arnaud, Dmitry)
    * Fixed [GH-13712](https://github.com/php/php-src/issues/13712) (Segmentation fault for enabled observers     when calling trait method of internal trait when opcache is loaded). (Bob)

    **PDO:**

    * Fix various PDORow bugs. (Girgias)

    **Random:**

    * Fixed bug [GH-13544](https://github.com/php/php-src/issues/13544) (Pre-PHP 8.2 compatibility for     mt_srand with unknown modes). (timwolla)
    * Fixed bug [GH-13690](https://github.com/php/php-src/issues/13690) (Global Mt19937 is not properly reset     in-between requests when MT_RAND_PHP is used). (timwolla)

    **Session:**

    * Fixed bug [GH-13680](https://github.com/php/php-src/issues/13680) (Segfault with session_decode and     compilation error). (nielsdos)

    **Sockets:**

    * Fixed bug [GH-13604](https://github.com/php/php-src/issues/13604) (socket_getsockname returns random     characters in the end of the socket name). (David Carlier)

    **SPL:**

    * Fixed bug [GH-13531](https://github.com/php/php-src/issues/13531) (Unable to resize SplfixedArray after     being unserialized in PHP 8.2.15). (nielsdos)
    * Fixed bug [GH-13685](https://github.com/php/php-src/issues/13685) (Unexpected null pointer in     zend_string.h). (nielsdos)

    **Standard:**

    * Fixed bug [GH-11808](https://github.com/php/php-src/issues/11808) (Live filesystem modified by tests).
    (nielsdos)
    * Fixed [GH-13402](https://github.com/php/php-src/issues/13402) (Added validation of `\n` in     $additional_headers of mail()). (SakiTakamachi)
    * Fixed bug [GH-13203](https://github.com/php/php-src/issues/13203) (file_put_contents fail on strings     over 4GB on Windows). (divinity76)
    * Fixed bug [GHSA-pc52-254m-w9w7](https://github.com/php/php-src/security/advisories/GHSA-pc52-254m-w9w7)     (Command injection via array-ish $command parameter of proc_open). (CVE-2024-1874) (Jakub Zelenka)
    * Fixed bug [GHSA-wpj3-hf5j-x4v4](https://github.com/php/php-src/security/advisories/GHSA-wpj3-hf5j-x4v4)     (__Host-/__Secure- cookie bypass due to partial CVE-2022-31629 fix). (**CVE-2024-2756**) (nielsdos)
    * Fixed bug [GHSA-h746-cjrr-wfmr](https://github.com/php/php-src/security/advisories/GHSA-h746-cjrr-wfmr)     (password_verify can erroneously return true, opening ATO risk). (**CVE-2024-3096**) (Jakub Zelenka)

    **XML:**

    * Fixed bug [GH-13517](https://github.com/php/php-src/issues/13517) (Multiple test failures when building     with --with-expat). (nielsdos)


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 6d82c5e9-fc24-11ee-a689-04421a1baf97 advisory.

  - This update includes 3 security fixes: (CVE-2024-1874, CVE-2024-2756, CVE-2024-2757, CVE-2024-3096)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5660 advisory.

  - In PHP versions 8.0.* before 8.0.30, 8.1.* before 8.1.22, and 8.2.* before 8.2.8 various XML functions     rely on libxml global state to track configuration variables, like whether external entities are loaded.
    This state is assumed to be unchanged unless the user explicitly changes it by calling appropriate     function. However, since the state is process-global, other modules - such as ImageMagick - may also use     this library within the same process, and change that global state for their internal purposes, and leave     it in a state where external entities loading is enabled. This can lead to the situation where external     XML is parsed with external entities loaded, which can lead to disclosure of any local files accessible to     PHP. This vulnerable state may persist in the same process across many requests, until the process is shut     down. (CVE-2023-3823)

  - In PHP version 8.0.* before 8.0.30, 8.1.* before 8.1.22, and 8.2.* before 8.2.8, when loading phar file,     while reading PHAR directory entries, insufficient length checking may lead to a stack buffer overflow,     leading potentially to memory corruption or RCE. (CVE-2023-3824)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5661 advisory.

  - In PHP versions 8.0.* before 8.0.30, 8.1.* before 8.1.22, and 8.2.* before 8.2.8 various XML functions     rely on libxml global state to track configuration variables, like whether external entities are loaded.
    This state is assumed to be unchanged unless the user explicitly changes it by calling appropriate     function. However, since the state is process-global, other modules - such as ImageMagick - may also use     this library within the same process, and change that global state for their internal purposes, and leave     it in a state where external entities loading is enabled. This can lead to the situation where external     XML is parsed with external entities loaded, which can lead to disclosure of any local files accessible to     PHP. This vulnerable state may persist in the same process across many requests, until the process is shut     down. (CVE-2023-3823)

  - In PHP version 8.0.* before 8.0.30, 8.1.* before 8.1.22, and 8.2.* before 8.2.8, when loading phar file,     while reading PHAR directory entries, insufficient length checking may lead to a stack buffer overflow,     leading potentially to memory corruption or RCE. (CVE-2023-3824)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of php81 installed on the remote host is prior to 8.1.28 / 8.3.6. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2024-103-01 advisory.

  - In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the vulnerability enables network and same-site     attackers to set a standard insecure cookie in the victim's browser which is treated as a `__Host-` or     `__Secure-` cookie by PHP applications. (CVE-2022-31629)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of PHP installed on the remote host is prior to 8.1.28. It is, therefore, affected by multiple vulnerabilities as referenced in the Version 8.1.28 advisory.

  - In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the vulnerability enables network and same-site     attackers to set a standard insecure cookie in the victim's browser which is treated as a `__Host-` or     `__Secure-` cookie by PHP applications. (CVE-2022-31629)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of PHP installed on the remote host is prior to 8.3.6. It is, therefore, affected by multiple vulnerabilities as referenced in the Version 8.3.6 advisory.

  - In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the vulnerability enables network and same-site     attackers to set a standard insecure cookie in the victim's browser which is treated as a `__Host-` or     `__Secure-` cookie by PHP applications. (CVE-2022-31629)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of PHP installed on the remote host is prior to 8.2.18. It is, therefore, affected by multiple vulnerabilities as referenced in the Version 8.2.18 advisory.

  - In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the vulnerability enables network and same-site     attackers to set a standard insecure cookie in the victim's browser which is treated as a `__Host-` or     `__Secure-` cookie by PHP applications. (CVE-2022-31629)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
205520	GLSA-202408-32 : PHP: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	critical
201697	CBL Mariner 2.0 Security Update: php (CVE-2024-2756)	Nessus	MarinerOS Local Security Checks	medium
200910	Amazon Linux 2 : php (ALASPHP8.1-2024-005)	Nessus	Amazon Linux Local Security Checks	medium
200688	SUSE SLES15 Security Update : php7 (SUSE-SU-2024:2037-1)	Nessus	SuSE Local Security Checks	medium
198260	Amazon Linux 2 : php (ALASPHP8.2-2024-004)	Nessus	Amazon Linux Local Security Checks	medium
197966	Amazon Linux 2023 : php8.2, php8.2-bcmath, php8.2-cli (ALAS2023-2024-624)	Nessus	Amazon Linux Local Security Checks	medium
196930	Amazon Linux 2023 : php8.1, php8.1-bcmath, php8.1-cli (ALAS2023-2024-612)	Nessus	Amazon Linux Local Security Checks	medium
195146	Debian dla-3810 : libapache2-mod-php7.3 - security update	Nessus	Debian Local Security Checks	medium
194949	Ubuntu 20.04 LTS / 22.04 LTS / 23.10 : PHP vulnerabilities (USN-6757-2)	Nessus	Ubuntu Local Security Checks	medium
194645	Fedora 40 : php (2024-5e8ae0def0)	Nessus	Fedora Local Security Checks	medium
194504	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS : PHP vulnerabilities (USN-6757-1)	Nessus	Ubuntu Local Security Checks	medium
194464	SUSE SLES15 / openSUSE 15 Security Update : php7 (SUSE-SU-2024:1444-1)	Nessus	SuSE Local Security Checks	medium
194459	SUSE SLES15 / openSUSE 15 Security Update : php8 (SUSE-SU-2024:1446-1)	Nessus	SuSE Local Security Checks	medium
194457	SUSE SLES12 Security Update : php74 (SUSE-SU-2024:1445-1)	Nessus	SuSE Local Security Checks	medium
114272	PHP 8.1.x < 8.1.28 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
114271	PHP 8.2.x < 8.2.18 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
114270	PHP 8.3.x < 8.3.6 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
193553	Fedora 38 : php (2024-39d50cc975)	Nessus	Fedora Local Security Checks	medium
193549	Fedora 39 : php (2024-b46619f761)	Nessus	Fedora Local Security Checks	medium
193406	FreeBSD : php -- Multiple vulnerabilities (6d82c5e9-fc24-11ee-a689-04421a1baf97)	Nessus	FreeBSD Local Security Checks	critical
193347	Debian dsa-5660 : libapache2-mod-php7.4 - security update	Nessus	Debian Local Security Checks	critical
193346	Debian dsa-5661 : libapache2-mod-php8.2 - security update	Nessus	Debian Local Security Checks	critical
193284	Slackware Linux 15.0 / current php81 Multiple Vulnerabilities (SSA:2024-103-01)	Nessus	Slackware Local Security Checks	medium
193283	PHP 8.1.x < 8.1.28 Multiple Vulnerabilities	Nessus	CGI abuses	medium
193201	PHP 8.3.x < 8.3.6 Multiple Vulnerabilities	Nessus	CGI abuses	medium
193191	PHP 8.2.x < 8.2.18 Multiple Vulnerabilities	Nessus	CGI abuses	medium

Detections

Analytics

CVE-2024-2756

medium

Tenable Plugins

critical

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

critical

critical

critical

medium

medium

critical

critical

critical

medium

medium

medium

medium