The remote Fedora 37 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-2b7eeaaee5 advisory.

    **PHP version 8.1.20** (08 Jun 2023)

    **Core:**

    * Fixed bug [GH-9068](https://github.com/php/php-src/issues/9068) (Conditional jump or move depends on     uninitialised value(s)). (nielsdos)
    * Fixed bug [GH-11189](https://github.com/php/php-src/issues/11189) (Exceeding memory limit in     zend_hash_do_resize leaves the array in an invalid state). (Bob)
    * Fixed bug [GH-11222](https://github.com/php/php-src/issues/11222) (foreach by-ref may jump over keys     during a rehash). (Bob)

    **Date:**

    * Fixed bug [GH-11281](https://github.com/php/php-src/issues/11281) (DateTimeZone::getName() does not     include seconds in offset). (nielsdos)

    **Exif:**

    * Fixed bug [GH-10834](https://github.com/php/php-src/issues/10834) (exif_read_data() cannot read smaller     stream wrapper chunk sizes). (nielsdos)

    **FPM:**

    * Fixed bug [GH-10461](https://github.com/php/php-src/issues/10461) (PHP-FPM segfault due to after free     usage of child->ev_std(out|err)). (Jakub Zelenka)
    * Fixed bug php#64539 (FPM status page: query_string not properly JSON encoded). (Jakub Zelenka)
    * Fixed memory leak for invalid primary script file handle. (Jakub Zelenka)

    **Hash:**

    * Fixed bug [GH-11180](https://github.com/php/php-src/issues/11180) (hash_file() appears to be restricted     to 3 arguments). (nielsdos)

    **LibXML:**

    * Fixed bug [GH-11160](https://github.com/php/php-src/issues/11160) (Few tests failed building with new     libxml 2.11.0). (nielsdos)

    **Opcache:**

    * Fixed bug [GH-11134](https://github.com/php/php-src/issues/11134) (Incorrect match default branch     optimization). (ilutov)
    * Fixed too wide OR and AND range inference. (nielsdos)
    * Fixed bug [GH-11245](https://github.com/php/php-src/issues/11245) (In some specific cases SWITCH with     one default statement will cause segfault). (nielsdos)

    **PGSQL:**

    * Fixed parameter parsing of pg_lo_export(). (kocsismate)

    **Phar:**

    * Fixed bug [GH-11099](https://github.com/php/php-src/issues/11099) (Generating phar.php during cross-     compile can't be done). (peter279k)

    **Soap:**

    * Fixed bug [GHSA-76gg-c692-v2mw](https://github.com/php/php-src/security/advisories/GHSA-76gg-c692-v2mw)     (Missing error check and insufficient random bytes in HTTP Digest authentication for SOAP). (nielsdos,     timwolla)
    * Fixed bug [GH-8426](https://github.com/php/php-src/issues/8426) (make test fail while soap extension     build). (nielsdos)

    **SPL:**

    * Fixed bug [GH-11178](https://github.com/php/php-src/issues/11178) (Segmentation fault in     spl_array_it_get_current_data (PHP 8.1.18)). (nielsdos)

    **Standard:**

    * Fixed bug [GH-11138](https://github.com/php/php-src/issues/11138) (move_uploaded_file() emits     open_basedir warning for source file). (ilutov)
    * Fixed bug [GH-11274](https://github.com/php/php-src/issues/11274) (POST/PATCH request switches to GET     after a HTTP 308 redirect). (nielsdos)

    **Streams:**

    * Fixed bug [GH-10031](https://github.com/php/php-src/issues/10031) ([Stream] STREAM_NOTIFY_PROGRESS over     HTTP emitted irregularly for last chunk of data). (nielsdos)
    * Fixed bug [GH-11175](https://github.com/php/php-src/issues/11175) (Stream Socket Timeout). (nielsdos)
    * Fixed bug [GH-11177](https://github.com/php/php-src/issues/11177) (ASAN UndefinedBehaviorSanitizer when     timeout = -1 passed to stream_socket_accept/stream_socket_client). (nielsdos)


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Detections

Analytics

Fedora 37 : php (2023-2b7eeaaee5)

high Nessus Plugin ID 177358

Version 1.1

Version 1.0

Version 1.1 Nov 15, 2024, 4:11 AM CVSS metrics ("CVSSv2 score" set to 0.0) CVSS metrics ("CVSSv3 score" set to 0.0) CVSS metrics ("Cvssv4 score" set to 0.0) CVSSv2 severity (based on None, severity decreased from "High" to "Low") CVSSv3 severity (based on None, severity decreased from "High" to "Low") Plugin metadata Plugin Feed: 202411150411
Version 1.0 Jun 16, 2023, 10:05 AM New Plugin Feed: 202306161005