The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:3299 advisory.

    PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

    The following packages have been upgraded to a later upstream version: rh-php72-php (7.2.24). (BZ#1766603)

    Security Fix(es):

    * php: underflow in env_path_info in fpm_main.c (CVE-2019-11043)

    * gd: Unsigned integer underflow _gdContributionsAlloc() (CVE-2016-10166)

    * gd: Heap based buffer overflow in gdImageColorMatch() in gd_color_match.c (CVE-2019-6977)

    * php: Invalid memory access in function xmlrpc_decode() (CVE-2019-9020)

    * php: File rename across filesystems may allow unwanted access during processing (CVE-2019-9637)

    * php: Uninitialized read in exif_process_IFD_in_MAKERNOTE (CVE-2019-9638)

    * php: Uninitialized read in exif_process_IFD_in_MAKERNOTE (CVE-2019-9639)

    * php: Invalid read in exif_process_SOFn() (CVE-2019-9640)

    * php: Out-of-bounds read due to integer overflow in iconv_mime_decode_headers() (CVE-2019-11039)

    * php: Buffer over-read in exif_read_data() (CVE-2019-11040)

    * php: Buffer over-read in PHAR reading functions (CVE-2018-20783)

    * php: Heap-based buffer over-read in PHAR reading functions (CVE-2019-9021)

    * php: memcpy with negative length via crafted DNS response (CVE-2019-9022)

    * php: Heap-based buffer over-read in mbstring regular expression functions (CVE-2019-9023)

    * php: Out-of-bounds read in base64_decode_xmlrpc in ext/xmlrpc/libxmlrpc/base64.c (CVE-2019-9024)

    * php: Heap buffer overflow in function exif_process_IFD_TAG() (CVE-2019-11034)

    * php: Heap buffer overflow in function exif_iif_add_value() (CVE-2019-11035)

    * php: Buffer over-read in exif_process_IFD_TAG() leading to information disclosure (CVE-2019-11036)

    * gd: Information disclosure in gdImageCreateFromXbm() (CVE-2019-11038)

    * php: heap buffer over-read in exif_scan_thumbnail() (CVE-2019-11041)

    * php: heap buffer over-read in exif_process_user_comment() (CVE-2019-11042)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:3724 advisory.

    PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

    Security Fix(es):

    * php: underflow in env_path_info in fpm_main.c (CVE-2019-11043)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2019-3287 advisory.

    [5.3.3-50]
    - fix underflow in env_path_info in fpm_main.c CVE-2019-11043

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for php72 fixes the following issues :

Security issue fixed :

CVE-2019-11043: Fixed possible remote code execution via env_path_info underflow in fpm_main.c (bsc#1154999).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2019:3736 advisory.

  - In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of     FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for     FCGI protocol data, thus opening the possibility of remote code execution. (CVE-2019-11043)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2019:3735 advisory.

  - php: underflow in env_path_info in fpm_main.c (CVE-2019-11043)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2019:3736 advisory.

  - php: underflow in env_path_info in fpm_main.c (CVE-2019-11043)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for FCGI protocol data, thus opening the possibility of remote code execution.(CVE-2019-11043)

According to its banner, the version of PHP running on the remote web server is prior to 7.1.33, 7.2.x prior to 7.2.24, or 7.3.x prior to 7.3.11. It is, therefore, affected by a remote code execution vulnerability due to insufficient validation of user input. An unauthenticated, remote attacker can exploit this, by sending a specially crafted request, to cause the execution of arbitrary code by breaking the fastcgi_split_path_info directive.

ID	Name	Product	Family	Published	Updated	Severity
193829	RHEL 7 : rh-php72-php (RHSA-2019:3299)	Nessus	Red Hat Local Security Checks	4/24/2024	11/6/2024	critical
194173	RHEL 6 / 7 : rh-php70-php (RHSA-2019:3724)	Nessus	Red Hat Local Security Checks	4/28/2024	11/7/2024	critical
130497	Oracle Linux 6 : php (ELSA-2019-3287)	Nessus	Oracle Linux Local Security Checks	11/4/2019	10/22/2024	critical
130621	SUSE SLES12 Security Update : php72 (SUSE-SU-2019:2909-1)	Nessus	SuSE Local Security Checks	11/7/2019	4/25/2023	critical
184733	Rocky Linux 8 : php:7.3 (RLSA-2019:3736)	Nessus	Rocky Linux Local Security Checks	11/6/2023	11/7/2023	critical
145659	CentOS 8 : php:7.2 (CESA-2019:3735)	Nessus	CentOS Local Security Checks	1/29/2021	4/25/2023	critical
145689	CentOS 8 : php:7.3 (CESA-2019:3736)	Nessus	CentOS Local Security Checks	1/29/2021	4/25/2023	critical
130471	Amazon Linux AMI : php71 / php72, php73, php56 (ALAS-2019-1315)	Nessus	Amazon Linux Local Security Checks	11/4/2019	12/6/2022	critical
701235	PHP < 7.1.33 / 7.2.x < 7.2.24 / 7.3.x < 7.3.11 Remote Code Execution	Nessus Network Monitor	Web Servers	11/12/2019	11/12/2019	high

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical

critical

critical

critical

high