The remote Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7157-1 advisory.

    It was discovered that PHP incorrectly handled certain inputs when processed with convert.quoted-printable     decode filters. An attacker could possibly use this issue to expose sensitive information or cause a     crash. (CVE-2024-11233)

    It was discovered that PHP incorrectly handled certain HTTP requests. An attacker could possibly use this     issue to performing arbitrary HTTP requests originating from the server, thus potentially gaining access     to resources not normally available to the external user. (CVE-2024-11234)

    It was discovered that PHP incorrectly handled certain inputs. An attacker could possibly use this issue     to cause a crash or execute arbitrary code. (CVE-2024-11236, CVE-2024-8932)

    It was discovered that PHP incorrectly handled certain MySQL requests. An attacker could possibly use this     issue to cause the client to disclose the content of its heap containing data from other SQL requests and     possible other data belonging to different users of the same server. (CVE-2024-8929)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 : PHP vulnerabilities (USN-7157-1)

critical Nessus Plugin ID 212725

Version 1.2

Version 1.1

Version 1.2 Dec 14, 2024, 3:07 AM CVSS metrics ("Cvssv4 score" set to 0.0) CVSSv2 severity (based on None, severity decreased from "High" to "Low") Detection (updated detection logic) Plugin Feed: 202412140307
Version 1.1 Dec 13, 2024, 9:53 AM New Plugin Feed: 202412130953