In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, HTTP_REDIRECT_STATUS variable is used to check whether or not CGI binary is being run by the HTTP server. However, in certain scenarios, the content of this variable can be controlled by the request submitter via HTTP headers, which can lead to cgi.force_redirect option not being correctly applied. In certain configurations this may lead to arbitrary file inclusion in PHP.

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-a03b06dbd0 advisory.

    **PHP version 8.3.12** (26 Sep 2024)

    **CGI:**

    * Fixed bug [GHSA-p99j-rfp4-xqvq](https://github.com/php/php-src/security/advisories/GHSA-p99j-rfp4-xqvq)     (Bypass of CVE-2024-4577, Parameter Injection Vulnerability). (**CVE-2024-8926**) (nielsdos)
    * Fixed bug [GHSA-94p6-54jq-9mwp](https://github.com/php/php-src/security/advisories/GHSA-94p6-54jq-9mwp)     (cgi.force_redirect configuration is bypassable due to the environment variable collision).
    (**CVE-2024-8927**) (nielsdos)

    **Core:**

    * Fixed bug [GH-15408](https://github.com/php/php-src/issues/15408) (MSan false-positve on     zend_max_execution_timer). (zeriyoshi)
    * Fixed bug [GH-15515](https://github.com/php/php-src/issues/15515) (Configure error grep illegal option     q). (Peter Kokot)
    * Fixed bug [GH-15514](https://github.com/php/php-src/issues/15514) (Configure error: genif.sh: syntax     error). (Peter Kokot)
    * Fixed bug [GH-15565](https://github.com/php/php-src/issues/15565) (--disable-ipv6 during compilation     produces error EAI_SYSTEM not found). (nielsdos)
    * Fixed bug [GH-15587](https://github.com/php/php-src/issues/15587) (CRC32 API build error on arm 32-bit).
    (Bernd Kuhls, Thomas Petazzoni)
    * Fixed bug [GH-15330](https://github.com/php/php-src/issues/15330) (Do not scan generator frames more     than once). (Arnaud)
    * Fixed uninitialized lineno in constant AST of internal enums. (ilutov)

    **Curl:**

    * FIxed bug [GH-15547](https://github.com/php/php-src/issues/15547) (curl_multi_select overflow on timeout     argument). (David Carlier)

    **DOM:**

    * Fixed bug [GH-15551](https://github.com/php/php-src/issues/15551) (Segmentation fault (access null     pointer) in ext/dom/xml_common.h). (nielsdos)
    * Fixed bug [GH-15654](https://github.com/php/php-src/issues/15654) (Signed integer overflow in     ext/dom/nodelist.c). (nielsdos)

    **Fileinfo:**

    * Fixed bug [GH-15752](https://github.com/php/php-src/issues/15752) (Incorrect error message for     finfo_file with an empty filename argument). (DanielEScherzer)

    **FPM:**

    * Fixed bug [GHSA-865w-9rf3-2wh5](https://github.com/php/php-src/security/advisories/GHSA-865w-9rf3-2wh5)     (Logs from childrens may be altered). (**CVE-2024-9026**) (Jakub Zelenka)

    **MySQLnd:**

    * Fixed bug [GH-15432](https://github.com/php/php-src/issues/15432) (Heap corruption when querying a     vector). (cmb, Kamil Tekiela)

    **Opcache:**

    * Fixed bug [GH-15661](https://github.com/php/php-src/issues/15661) (Access null pointer in     Zend/Optimizer/zend_inference.c). (nielsdos)
    * Fixed bug [GH-15658](https://github.com/php/php-src/issues/15658) (Segmentation fault in     Zend/zend_vm_execute.h). (nielsdos)

    **SAPI:**

    * Fixed bug [GHSA-9pqp-7h25-4f32](https://github.com/php/php-src/security/advisories/GHSA-9pqp-7h25-4f32)     (Erroneous parsing of multipart form data). (**CVE-2024-8925**) (Arnaud)

    **Standard:**

    * Fixed bug [GH-15552](https://github.com/php/php-src/issues/15552) (Signed integer overflow in     ext/standard/scanf.c). (cmb)

    **Streams:**

    * Fixed bug [GH-15628](https://github.com/php/php-src/issues/15628) (php_stream_memory_get_buffer() not     zero-terminated). (cmb)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7049-2 advisory.

    USN-7049-1 fixed vulnerabilities in PHP. This update provides the corresponding updates for Ubuntu 16.04     LTS and Ubuntu 18.04 LTS.



Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of php installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-8927 advisory.

  - In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, HTTP_REDIRECT_STATUS     variable is used to check whether or not CGI binary is being run by the HTTP server. However, in certain     scenarios, the content of this variable can be controlled by the request submitter via HTTP headers, which     can lead to cgi.force_redirect option not being correctly applied. In certain configurations this May lead     to arbitrary file inclusion in PHP. (CVE-2024-8927)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of php81 installed on the remote host is prior to 8.1.30. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2024-297-01 advisory.

    New php81 packages are available for Slackware 15.0 to fix security issues.

Tenable has extracted the preceding description block directly from the php81 security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3729-1 advisory.

    Update to php 8.2.24:

    - CVE-2024-8925: Fixed erroneous parsing of multipart form data in HTTP POST requests leads to legitimate     data not being processed (bsc#1231360)
    - CVE-2024-8927: Fixed cgi.force_redirect configuration is bypassable due to an environment variable     collision (bsc#1231358)
    - CVE-2024-9026: Fixed pollution of worker output logs in PHP-FPM (bsc#1231382)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3732-1 advisory.

    - CVE-2024-8925: Fixed erroneous parsing of multipart form data in HTTP POST requests leads to legitimate     data not being processed (bsc#1231360)
    - CVE-2024-8927: Fixed cgi.force_redirect configuration is bypassable due to an environment variable     collision (bsc#1231358)
    - CVE-2024-9026: Fixed pollution of worker output logs in PHP-FPM (bsc#1231382)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3733-1 advisory.

    - CVE-2024-8925: Fixed erroneous parsing of multipart form data in HTTP POST requests leads to legitimate     data not being processed (bsc#1231360)
    - CVE-2024-8927: Fixed cgi.force_redirect configuration is bypassable due to an environment variable     collision (bsc#1231358)
    - CVE-2024-9026: Fixed pollution of worker output logs in PHP-FPM (bsc#1231382)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3664-1 advisory.

    - CVE-2024-8925: Fixed erroneous parsing of multipart form data in HTTP POST requests leads to legitimate     data not being processed (bsc#1231360)
    - CVE-2024-8927: Fixed cgi.force_redirect configuration is bypassable due to an environment variable     collision (bsc#1231358)
    - CVE-2024-9026: Fixed pollution of worker output logs in PHP-FPM (bsc#1231382)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3920 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3920-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                       Guilhem Moulin     October 14, 2024                              https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : php7.4     Version        : 7.4.33-1+deb11u6     CVE ID         : CVE-2022-4900 CVE-2024-5458 CVE-2024-8925 CVE-2024-8927                      CVE-2024-9026     Debian Bug     : 1072885

    Multiple security issues were found in PHP, a widely-used open source     general purpose scripting language, which could result in execution of     arbitrary code, erroneous parsing of invalid URLs or multipart form     data, configuration setting bypass, or log pollution.

    CVE-2022-4900

        It was discovered that setting the environment variable         PHP_CLI_SERVER_WORKERS to a large value leads to a heap buffer         overflow.

    CVE-2024-5458

        Due to a code logic error, filtering functions such as filter_var         when validating URLs (FILTER_VALIDATE_URL) for certain types of URLs         the function results in invalid user information (username +         password part of URLs) being treated as valid user information.
        This may lead to the downstream code accepting invalid URLs as valid         and parsing them incorrectly.

        This causes the same problems as CVE-2020-7071, but with IPv6 host         parts.

    CVE-2024-8925

        Mihail Kirov discovered an erroneous parsing of multipart form data         contained in an HTTP POST request, which could lead to legitimate         data not being processed thereby violating data integrity.

    CVE-2024-8927

        It was discovered that the `cgi.force_redirect` configuration         setting is bypassable due to environment variable collision.

    CVE-2024-9026

        In PHP-FPM, when configured to catch workers output through         catch_workers_output = yes configuration, it may be possible to         pollute the final log with up to 4 characters from the         FPM_STDIO_CMD_FLUSH macro, or remove up to 4 characters from the         logs.

    For Debian 11 bullseye, these problems have been fixed in version     7.4.33-1+deb11u6.

    We recommend that you upgrade your php7.4 packages.

    For the detailed security status of php7.4 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/php7.4

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the fe5c1e7a-7eed-11ef-9533-f875a43e1796 advisory.

    php.net reports:

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-7c800c4df7 advisory.

    **PHP version 8.2.24** (26 Sep 2024)

    **CGI:**

    * Fixed bug [GHSA-p99j-rfp4-xqvq](https://github.com/php/php-src/security/advisories/GHSA-p99j-rfp4-xqvq)     (Bypass of CVE-2024-4577, Parameter Injection Vulnerability). (**CVE-2024-8926**) (nielsdos)
    * Fixed bug [GHSA-94p6-54jq-9mwp](https://github.com/php/php-src/security/advisories/GHSA-94p6-54jq-9mwp)     (cgi.force_redirect configuration is bypassable due to the environment variable collision).
    (**CVE-2024-8927**) (nielsdos)

    **Core:**

    * Fixed bug [GH-15408](https://github.com/php/php-src/issues/15408) (MSan false-positve on     zend_max_execution_timer). (zeriyoshi)
    * Fixed bug [GH-15515](https://github.com/php/php-src/issues/15515) (Configure error grep illegal option     q). (Peter Kokot)
    * Fixed bug [GH-15514](https://github.com/php/php-src/issues/15514) (Configure error: genif.sh: syntax     error). (Peter Kokot)
    * Fixed bug [GH-15565](https://github.com/php/php-src/issues/15565) (--disable-ipv6 during compilation     produces error EAI_SYSTEM not found). (nielsdos)
    * Fixed bug [GH-15587](https://github.com/php/php-src/issues/15587) (CRC32 API build error on arm 32-bit).
    (Bernd Kuhls, Thomas Petazzoni)
    * Fixed bug [GH-15330](https://github.com/php/php-src/issues/15330) (Do not scan generator frames more     than once). (Arnaud)
    * Fixed uninitialized lineno in constant AST of internal enums. (ilutov)

    **Curl:**

    * FIxed bug [GH-15547](https://github.com/php/php-src/issues/15547) (curl_multi_select overflow on timeout     argument). (David Carlier)

    **DOM:**

    * Fixed bug [GH-15551](https://github.com/php/php-src/issues/15551) (Segmentation fault (access null     pointer) in ext/dom/xml_common.h). (nielsdos)

    **Fileinfo:**

    * Fixed bug [GH-15752](https://github.com/php/php-src/issues/15752) (Incorrect error message for     finfo_file with an empty filename argument). (DanielEScherzer)

    **FPM:**

    * Fixed bug [GHSA-865w-9rf3-2wh5](https://github.com/php/php-src/security/advisories/GHSA-865w-9rf3-2wh5)     (Logs from childrens may be altered). (**CVE-2024-9026**) (Jakub Zelenka)

    **MySQLnd:**

    * Fixed bug [GH-15432](https://github.com/php/php-src/issues/15432) (Heap corruption when querying a     vector). (cmb, Kamil Tekiela)

    **Opcache:**

    * Fixed bug [GH-15661](https://github.com/php/php-src/issues/15661) (Access null pointer in     Zend/Optimizer/zend_inference.c). (nielsdos)
    * Fixed bug [GH-15658](https://github.com/php/php-src/issues/15658) (Segmentation fault in     Zend/zend_vm_execute.h). (nielsdos)

    **SAPI:**

    * Fixed bug [GHSA-9pqp-7h25-4f32](https://github.com/php/php-src/security/advisories/GHSA-9pqp-7h25-4f32)     (Erroneous parsing of multipart form data). (**CVE-2024-8925**) (Arnaud)

    **SOAP:**

    * Fixed bug php#73182 (PHP SOAPClient does not support stream context HTTP headers in array form).
    (nielsdos)

    **Standard:**

    * Fixed bug [GH-15552](https://github.com/php/php-src/issues/15552) (Signed integer overflow in     ext/standard/scanf.c). (cmb)

    **Streams:**

    * Fixed bug [GH-15628](https://github.com/php/php-src/issues/15628) (php_stream_memory_get_buffer() not     zero-terminated). (cmb)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the version of PHP installed on the remote host is 8.1.x prior to 8.1.30, 8.2.x prior to 8.2.24, or 8.3.x prior to 8.3.12. It is, therefore, affected by multiple vulnerabilities:

 - Parameter injection vulnerability with a bypass of CVE-2024-4577. (CVE-2024-8926)

 - cgi.force_redirect configuration is bypassable due to the environment variable collision. (CVE-2024-8927)

 - Logs from childrens may be altered. (CVE-2024-9026)

 - Erroneous parsing of multipart form data. (CVE-2024-8925)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5780 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-5780-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     October 02, 2024                      https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : php8.2     CVE ID         : CVE-2024-8925 CVE-2024-8926 CVE-2024-8927

    Multiple security issues were found in PHP, a widely-used open source     general purpose scripting language which could result in incorrect     parsing of multipart/form-data, bypass of the cgi.force_direct directive     or incorrect logging.

    For the stable distribution (bookworm), these problems have been fixed in     version 8.2.24-1~deb12u1.

    We recommend that you upgrade your php8.2 packages.

    For the detailed security status of php8.2 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/php8.2

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-2b429e720e advisory.

    **PHP version 8.3.12** (26 Sep 2024)

    **CGI:**

    * Fixed bug [GHSA-p99j-rfp4-xqvq](https://github.com/php/php-src/security/advisories/GHSA-p99j-rfp4-xqvq)     (Bypass of CVE-2024-4577, Parameter Injection Vulnerability). (**CVE-2024-8926**) (nielsdos)
    * Fixed bug [GHSA-94p6-54jq-9mwp](https://github.com/php/php-src/security/advisories/GHSA-94p6-54jq-9mwp)     (cgi.force_redirect configuration is bypassable due to the environment variable collision).
    (**CVE-2024-8927**) (nielsdos)

    **Core:**

    * Fixed bug [GH-15408](https://github.com/php/php-src/issues/15408) (MSan false-positve on     zend_max_execution_timer). (zeriyoshi)
    * Fixed bug [GH-15515](https://github.com/php/php-src/issues/15515) (Configure error grep illegal option     q). (Peter Kokot)
    * Fixed bug [GH-15514](https://github.com/php/php-src/issues/15514) (Configure error: genif.sh: syntax     error). (Peter Kokot)
    * Fixed bug [GH-15565](https://github.com/php/php-src/issues/15565) (--disable-ipv6 during compilation     produces error EAI_SYSTEM not found). (nielsdos)
    * Fixed bug [GH-15587](https://github.com/php/php-src/issues/15587) (CRC32 API build error on arm 32-bit).
    (Bernd Kuhls, Thomas Petazzoni)
    * Fixed bug [GH-15330](https://github.com/php/php-src/issues/15330) (Do not scan generator frames more     than once). (Arnaud)
    * Fixed uninitialized lineno in constant AST of internal enums. (ilutov)

    **Curl:**

    * FIxed bug [GH-15547](https://github.com/php/php-src/issues/15547) (curl_multi_select overflow on timeout     argument). (David Carlier)

    **DOM:**

    * Fixed bug [GH-15551](https://github.com/php/php-src/issues/15551) (Segmentation fault (access null     pointer) in ext/dom/xml_common.h). (nielsdos)
    * Fixed bug [GH-15654](https://github.com/php/php-src/issues/15654) (Signed integer overflow in     ext/dom/nodelist.c). (nielsdos)

    **Fileinfo:**

    * Fixed bug [GH-15752](https://github.com/php/php-src/issues/15752) (Incorrect error message for     finfo_file with an empty filename argument). (DanielEScherzer)

    **FPM:**

    * Fixed bug [GHSA-865w-9rf3-2wh5](https://github.com/php/php-src/security/advisories/GHSA-865w-9rf3-2wh5)     (Logs from childrens may be altered). (**CVE-2024-9026**) (Jakub Zelenka)

    **MySQLnd:**

    * Fixed bug [GH-15432](https://github.com/php/php-src/issues/15432) (Heap corruption when querying a     vector). (cmb, Kamil Tekiela)

    **Opcache:**

    * Fixed bug [GH-15661](https://github.com/php/php-src/issues/15661) (Access null pointer in     Zend/Optimizer/zend_inference.c). (nielsdos)
    * Fixed bug [GH-15658](https://github.com/php/php-src/issues/15658) (Segmentation fault in     Zend/zend_vm_execute.h). (nielsdos)

    **SAPI:**

    * Fixed bug [GHSA-9pqp-7h25-4f32](https://github.com/php/php-src/security/advisories/GHSA-9pqp-7h25-4f32)     (Erroneous parsing of multipart form data). (**CVE-2024-8925**) (Arnaud)

    **Standard:**

    * Fixed bug [GH-15552](https://github.com/php/php-src/issues/15552) (Signed integer overflow in     ext/standard/scanf.c). (cmb)

    **Streams:**

    * Fixed bug [GH-15628](https://github.com/php/php-src/issues/15628) (php_stream_memory_get_buffer() not     zero-terminated). (cmb)


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7049-1 advisory.

    It was discovered that PHP incorrectly handled parsing multipart form data. A remote attacker could     possibly use this issue to inject payloads and cause PHP to ignore legitimate data. (CVE-2024-8925)

    It was discovered that PHP incorrectly handled the cgi.force_redirect configuration option due to     environment variable collisions. In certain configurations, an attacker could possibly use this issue     bypass force_redirect restrictions. (CVE-2024-8927)

    It was discovered that PHP-FPM incorrectly handled logging. A remote attacker could possibly use this     issue to alter and inject arbitrary contents into log files. This issue only affected Ubuntu 22.04 LTS,     and Ubuntu 24.04 LTS. (CVE-2024-9026)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of PHP installed on the remote host is prior to 8.1.30. It is, therefore, affected by multiple vulnerabilities as referenced in the Version 8.1.30 advisory.

  - In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-     CGI on Windows, if the system is set up to use certain code pages, Windows may use Best-Fit behavior to     replace characters in command line given to Win32 API functions. PHP CGI module may misinterpret those     characters as PHP options, which may allow a malicious user to pass options to PHP binary being run, and     thus reveal the source code of scripts, run arbitrary PHP code on the server, etc. (CVE-2024-4577)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of PHP installed on the remote host is prior to 8.2.24. It is, therefore, affected by multiple vulnerabilities as referenced in the Version 8.2.24 advisory.

  - In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-     CGI on Windows, if the system is set up to use certain code pages, Windows may use Best-Fit behavior to     replace characters in command line given to Win32 API functions. PHP CGI module may misinterpret those     characters as PHP options, which may allow a malicious user to pass options to PHP binary being run, and     thus reveal the source code of scripts, run arbitrary PHP code on the server, etc. (CVE-2024-4577)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of PHP installed on the remote host is prior to 8.3.12. It is, therefore, affected by multiple vulnerabilities as referenced in the Version 8.3.12 advisory.

  - In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-     CGI on Windows, if the system is set up to use certain code pages, Windows may use Best-Fit behavior to     replace characters in command line given to Win32 API functions. PHP CGI module may misinterpret those     characters as PHP options, which may allow a malicious user to pass options to PHP binary being run, and     thus reveal the source code of scripts, run arbitrary PHP code on the server, etc. (CVE-2024-4577)

  - **PHP version 8.3.12** (26 Sep 2024)  **CGI:**  * Fixed bug     [GHSA-p99j-rfp4-xqvq](https://github.com/php/php-src/security/advisories/GHSA-p99j-rfp4-xqvq) (Bypass of     CVE-2024-4577, Parameter Injection Vulnerability). (**CVE-2024-8926**) (nielsdos) * Fixed bug     [GHSA-94p6-54jq-9mwp](https://github.com/php/php-src/security/advisories/GHSA-94p6-54jq-9mwp)     (cgi.force_redirect configuration is bypassable due to the environment variable collision).
    (**CVE-2024-8927**) (nielsdos)  **Core:**  * Fixed bug [GH-15408](https://github.com/php/php-     src/issues/15408) (MSan false-positve on zend_max_execution_timer). (zeriyoshi) * Fixed bug     [GH-15515](https://github.com/php/php-src/issues/15515) (Configure error grep illegal option q). (Peter     Kokot) * Fixed bug [GH-15514](https://github.com/php/php-src/issues/15514) (Configure error: genif.sh:
    syntax error). (Peter Kokot) * Fixed bug [GH-15565](https://github.com/php/php-src/issues/15565)     (--disable-ipv6 during compilation produces error EAI_SYSTEM not found). (nielsdos) * Fixed bug     [GH-15587](https://github.com/php/php-src/issues/15587) (CRC32 API build error on arm 32-bit). (Bernd     Kuhls, Thomas Petazzoni) * Fixed bug [GH-15330](https://github.com/php/php-src/issues/15330) (Do not scan     generator frames more than once). (Arnaud) * Fixed uninitialized lineno in constant AST of internal enums.
    (ilutov)  **Curl:**  * FIxed bug [GH-15547](https://github.com/php/php-src/issues/15547)     (curl_multi_select overflow on timeout argument). (David Carlier)  **DOM:**  * Fixed bug     [GH-15551](https://github.com/php/php-src/issues/15551) (Segmentation fault (access null pointer) in     ext/dom/xml_common.h). (nielsdos) * Fixed bug [GH-15654](https://github.com/php/php-src/issues/15654)     (Signed integer overflow in ext/dom/nodelist.c). (nielsdos)  **Fileinfo:**  * Fixed bug     [GH-15752](https://github.com/php/php-src/issues/15752) (Incorrect error message for finfo_file with an     empty filename argument). (DanielEScherzer)  **FPM:**  * Fixed bug     [GHSA-865w-9rf3-2wh5](https://github.com/php/php-src/security/advisories/GHSA-865w-9rf3-2wh5) (Logs from     childrens may be altered). (**CVE-2024-9026**) (Jakub Zelenka)  **MySQLnd:**  * Fixed bug     [GH-15432](https://github.com/php/php-src/issues/15432) (Heap corruption when querying a vector). (cmb,     Kamil Tekiela)  **Opcache:**  * Fixed bug [GH-15661](https://github.com/php/php-src/issues/15661) (Access     null pointer in Zend/Optimizer/zend_inference.c). (nielsdos) * Fixed bug     [GH-15658](https://github.com/php/php-src/issues/15658) (Segmentation fault in Zend/zend_vm_execute.h).
    (nielsdos)  **SAPI:**  * Fixed bug [GHSA-9pqp-7h25-4f32](https://github.com/php/php-     src/security/advisories/GHSA-9pqp-7h25-4f32) (Erroneous parsing of multipart form data).
    (**CVE-2024-8925**) (Arnaud)  **Standard:**  * Fixed bug [GH-15552](https://github.com/php/php-     src/issues/15552) (Signed integer overflow in ext/standard/scanf.c). (cmb)  **Streams:**  * Fixed bug     [GH-15628](https://github.com/php/php-src/issues/15628) (php_stream_memory_get_buffer() not zero-     terminated). (cmb) (CVE-2024-8925, CVE-2024-8926, CVE-2024-8927, CVE-2024-9026)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
211244	Fedora 41 : php (2024-a03b06dbd0)	Nessus	Fedora Local Security Checks	critical
210951	Ubuntu 16.04 LTS / 18.04 LTS : PHP vulnerabilities (USN-7049-2)	Nessus	Ubuntu Local Security Checks	high
210129	CBL Mariner 2.0 Security Update: php (CVE-2024-8927)	Nessus	MarinerOS Local Security Checks	high
209567	Slackware Linux 15.0 php81 Multiple Vulnerabilities (SSA:2024-297-01)	Nessus	Slackware Local Security Checks	critical
209330	SUSE SLES15 / openSUSE 15 Security Update : php8 (SUSE-SU-2024:3729-1)	Nessus	SuSE Local Security Checks	high
209329	SUSE SLES12 Security Update : php74 (SUSE-SU-2024:3732-1)	Nessus	SuSE Local Security Checks	high
209317	SUSE SLES15 / openSUSE 15 Security Update : php7 (SUSE-SU-2024:3733-1)	Nessus	SuSE Local Security Checks	high
209215	SUSE SLES15 / openSUSE 15 Security Update : php8 (SUSE-SU-2024:3664-1)	Nessus	SuSE Local Security Checks	high
208984	Debian dla-3920 : libapache2-mod-php7.4 - security update	Nessus	Debian Local Security Checks	high
208145	FreeBSD : php -- Multiple vulnerabilities (fe5c1e7a-7eed-11ef-9533-f875a43e1796)	Nessus	FreeBSD Local Security Checks	high
208123	Fedora 39 : php (2024-7c800c4df7)	Nessus	Fedora Local Security Checks	critical
114447	PHP 8.1.x < 8.1.30 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
114446	PHP 8.2.x < 8.2.24 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
114445	PHP 8.3.x < 8.3.12 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
208048	Debian dsa-5780 : libapache2-mod-php8.2 - security update	Nessus	Debian Local Security Checks	high
208018	Fedora 40 : php (2024-2b429e720e)	Nessus	Fedora Local Security Checks	critical
207997	Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS : PHP vulnerabilities (USN-7049-1)	Nessus	Ubuntu Local Security Checks	high
207855	PHP 8.1.x < 8.1.30 Multiple Vulnerabilities	Nessus	CGI abuses	critical
207822	PHP 8.2.x < 8.2.24 Multiple Vulnerabilities	Nessus	CGI abuses	critical
207821	PHP 8.3.x < 8.3.12 Multiple Vulnerabilities	Nessus	CGI abuses	critical

Detections

Analytics

CVE-2024-8927

high

Tenable Plugins

critical

high

high

critical

high

high

high

high

high

high

critical

critical

critical

critical

high

critical

high

critical

critical

critical