Debian Linux - php7.4 - None

php8.2 - None

php8.4 - None

slackware SSA:2025-073-02: [slackware-security] php (SSA:2025-073-02)

vendor_unpatched cve-2025-1736: Unpatched CVEs for Debian Linux (cve-2025-1736)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 2ac2ddc2-0051-11f0-8673-f02f7432cf97 advisory.

    php.net reports:

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5878 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-5878-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     March 14, 2025                        https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : php8.2     CVE ID         : CVE-2025-1217 CVE-2025-1219 CVE-2025-1734 CVE-2025-1736                      CVE-2025-1861

    Multiple security issues were found in PHP, a widely-used open source     general purpose scripting language which could result in denial of     service or HTTP request smuggling.

    For the stable distribution (bookworm), these problems have been fixed in     version 8.2.28-1~deb12u1.

    We recommend that you upgrade your php8.2 packages.

    For the detailed security status of php8.2 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/php8.2

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of PHP installed on the remote host is prior to 8.2.28. It is, therefore, affected by multiple vulnerabilities as referenced in the Version 8.2.28 advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of PHP installed on the remote host is prior to 8.1.32. It is, therefore, affected by multiple vulnerabilities as referenced in the Version 8.1.32 advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of PHP installed on the remote host is prior to 8.4.5. It is, therefore, affected by multiple vulnerabilities as referenced in the Version 8.4.5 advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of PHP installed on the remote host is prior to 8.3.19. It is, therefore, affected by multiple vulnerabilities as referenced in the Version 8.3.19 advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
232759	FreeBSD : php -- Multiple vulnerabilities (2ac2ddc2-0051-11f0-8673-f02f7432cf97)	Nessus	FreeBSD Local Security Checks	critical
232748	Debian dsa-5878 : libapache2-mod-php8.2 - security update	Nessus	Debian Local Security Checks	critical
232707	PHP 8.2.x < 8.2.28 Multiple Vulnerabilities	Nessus	CGI abuses	high
232706	PHP 8.1.x < 8.1.32 Multiple Vulnerabilities	Nessus	CGI abuses	high
232705	PHP 8.4.x < 8.4.5 Multiple Vulnerabilities	Nessus	CGI abuses	high
232704	PHP 8.3.x < 8.3.19 Multiple Vulnerabilities	Nessus	CGI abuses	high

Detections

Analytics

CVE-2025-1736

critical

Tenable Plugins

Coming Soon

critical

critical

high

high

high

high