According to the versions of the php packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - When PHP EXIF extension is parsing EXIF information     from an image, e.g. via exif_read_data() function, in     PHP versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and     7.3.x below 7.3.6 it is possible to supply it with data     what will cause it to read past the allocated buffer.
    This may lead to information disclosure or     crash.(CVE-2019-11040)

  - When PHP EXIF extension is parsing EXIF information     from an image, e.g. via exif_read_data() function, in     PHP versions 7.1.x below 7.1.31, 7.2.x below 7.2.21 and     7.3.x below 7.3.8 it is possible to supply it with data     what will cause it to read past the allocated buffer.
    This may lead to information disclosure or     crash.(CVE-2019-11042)

  - When PHP EXIF extension is parsing EXIF information     from an image, e.g. via exif_read_data() function, in     PHP versions 7.1.x below 7.1.31, 7.2.x below 7.2.21 and     7.3.x below 7.3.8 it is possible to supply it with data     what will cause it to read past the allocated buffer.
    This may lead to information disclosure or     crash.(CVE-2019-11041)

  - The openssl_random_pseudo_bytes function in     ext/openssl/openssl.c in PHP before 5.4.44, 5.5.x     before 5.5.28, and 5.6.x before 5.6.12 incorrectly     relies on the deprecated RAND_pseudo_bytes function,     which makes it easier for remote attackers to defeat     cryptographic protection mechanisms via unspecified     vectors.(CVE-2015-8867)

  - A flaw was found in the way the way PHP's Phar     extension parsed Phar archives. A specially crafted     archive could cause PHP to crash or, possibly, execute     arbitrary code when opened.(CVE-2015-5590)

  - Use-after-free vulnerability in the wddx_stack_destroy     function in ext/wddx/wddx.c in PHP before 5.6.26 and     7.x before 7.0.11 allows remote attackers to cause a     denial of service or possibly have unspecified other     impact via a wddxPacket XML document that lacks an     end-tag for a recordset field element, leading to     mishandling in a wddx_deserialize call.(CVE-2016-7413)

  - The file_check_mem function in funcs.c in file before     5.23, as used in the Fileinfo component in PHP before     5.5.34, 5.6.x before 5.6.20, and 7.x before 7.0.5,     mishandles continuation-level jumps, which allows     context-dependent attackers to cause a denial of     service (buffer overflow and application crash) or     possibly execute arbitrary code via a crafted magic     file.(CVE-2015-8865)

  - The bcpowmod function in ext/bcmath/bcmath.c in PHP     before 5.5.35, 5.6.x before 5.6.21, and 7.x before     7.0.6 accepts a negative integer for the scale     argument, which allows remote attackers to cause a     denial of service or possibly have unspecified other     impact via a crafted call.(CVE-2016-4537)

  - The bcpowmod function in ext/bcmath/bcmath.c in PHP     before 5.5.35, 5.6.x before 5.6.21, and 7.x before     7.0.6 modifies certain data structures without     considering whether they are copies of the _zero_,
    _one_, or _two_ global variable, which allows remote     attackers to cause a denial of service or possibly have     unspecified other impact via a crafted     call.(CVE-2016-4538)

  - Integer overflow in the fread function in     ext/standard/file.c in PHP before 5.5.36 and 5.6.x     before 5.6.22 allows remote attackers to cause a denial     of service or possibly have unspecified other impact     via a large integer in the second     argument.(CVE-2016-5096)

  - An out-of-bounds write flaw was found in the     fpm_log_write() logging function of PHP's FastCGI     Process Manager service. A remote attacker could     repeatedly send maliciously crafted requests to force     FPM to exhaust file system space, creating a denial of     service and preventing further logging.(CVE-2016-5114)

  - spl_array.c in the SPL extension in PHP before 5.5.37     and 5.6.x before 5.6.23 improperly interacts with the     unserialize implementation and garbage collection,     which allows remote attackers to execute arbitrary code     or cause a denial of service (use-after-free and     application crash) via crafted serialized     data.(CVE-2016-5771)

  - php_zip.c in the zip extension in PHP before 5.5.37,     5.6.x before 5.6.23, and 7.x before 7.0.8 improperly     interacts with the unserialize implementation and     garbage collection, which allows remote attackers to     execute arbitrary code or cause a denial of service     (use-after-free and application crash) via crafted     serialized data containing a ZipArchive     object.(CVE-2016-5773)

  - Integer overflow in the virtual_file_ex function in     TSRM/tsrm_virtual_cwd.c in PHP before 5.5.38, 5.6.x     before 5.6.24, and 7.x before 7.0.9 allows remote     attackers to cause a denial of service (stack-based     buffer overflow) or possibly have unspecified other     impact via a crafted extract operation on a ZIP     archive.(CVE-2016-6289)

  - When processing certain files, PHP EXIF extension in     versions 7.1.x below 7.1.28, 7.2.x below 7.2.17 and     7.3.x below 7.3.4 can be caused to read past allocated     buffer in exif_process_IFD_TAG function. This may lead     to information disclosure or crash.(CVE-2019-11034)

  - When processing certain files, PHP EXIF extension in     versions 7.1.x below 7.1.28, 7.2.x below 7.2.17 and     7.3.x below 7.3.4 can be caused to read past allocated     buffer in exif_iif_add_value function. This may lead to     information disclosure or crash.(CVE-2019-11035)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Detections

Analytics

EulerOS 2.0 SP3 : php (EulerOS-SA-2019-2043)

critical Nessus Plugin ID 129236

Version 1.23