The remote Ubuntu 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5006-1 advisory.

    It was discovered that PHP incorrectly handled certain PHAR files. A remote attacker could possibly use     this issue to cause PHP to crash, resulting in a denial of service, or possibly obtain sensitive     information. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-7068)

    It was discovered that PHP incorrectly handled parsing URLs with passwords. A remote attacker could     possibly use this issue to cause PHP to mis-parse the URL and produce wrong data. This issue only affected     Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 20.10. (CVE-2020-7071)

    It was discovered that PHP incorrectly handled certain malformed XML data when being parsed by the SOAP     extension. A remote attacker could possibly use this issue to cause PHP to crash, resulting in a denial of     service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 20.10. (CVE-2021-21702)

    It was discovered that PHP incorrectly handled the pdo_firebase module. A remote attacker could possibly     use this issue to cause PHP to crash, resulting in a denial of service. (CVE-2021-21704)

    It was discovered that PHP incorrectly handled the FILTER_VALIDATE_URL check. A remote attacker could     possibly use this issue to perform a server- side request forgery attack. (CVE-2021-21705)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Ubuntu 18.04 LTS / 20.04 LTS : PHP vulnerabilities (USN-5006-1)

medium Nessus Plugin ID 151444

Version 1.6