PHP 7.3.x < 7.3.10 Heap-Based Buffer Overflow Vulnerability.

high Nessus Plugin ID 129557

Language:

Synopsis

An application installed on the remote host is affected by a head-based buffer overflow vulnerability.

Description

According to its banner, the version of PHP running on the remote web server is 7.3.x prior to 7.3.10. It is, therefore, affected by a heap-based buffer overflow vulnerability in its mb_eregi component due to insufficient validation of user input. An unauthenticated, remote attacker can exploit this, by sending a specially crafted request, to cause a denial of service condition or the execution of arbitrary code

Solution

Upgrade to PHP version 7.3.10 or later.

Plugin Details

Severity: High

ID: 129557

File Name: php_7_3_10.nasl

Version: 1.4

Type: remote

Family: CGI abuses

Published: 10/4/2019

Updated: 5/28/2024

Configuration: Enable thorough checks

Supported Sensors: Nessus

Risk Information

CVSS Score Rationale: Score based on analysis of the vendor advisory.

CVSS v2

Risk Factor: High

Base Score: 9.3

Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C

CVSS Score Source: manual

CVSS v3

Risk Factor: High

Base Score: 8.1

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Vulnerability Information

CPE: cpe:/a:php:php

Required KB Items: www/PHP, installed_sw/PHP

Excluded KB Items: Settings/disable_cgi_scanning

Patch Publication Date: 9/26/2019

Vulnerability Publication Date: 9/26/2019

Detections

Analytics