The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:2417 advisory.

    PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

    The following packages have been upgraded to a later upstream version: php (8.1.14).

    Security Fix(es):

    * XKCP: buffer overflow in the SHA-3 reference implementation (CVE-2022-37454)

    * php: standard insecure cookie could be treated as a '__Host-' or '__Secure-' cookie by PHP applications     (CVE-2022-31629)

    * php: OOB read due to insufficient input validation in imageloadfont() (CVE-2022-31630)

    * php: PDO::quote() may return unquoted string due to an integer overflow (CVE-2022-31631)

    * php: phar: infinite loop when decompressing quine gzip file (CVE-2022-31628)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.2 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-2903 advisory.

    - CVE-2015-2331: integer overflow when processing ZIP archives (#1204676,#1204677)
    - fixes for CVE-2012-1162 and CVE-2012-1163
    - fix: due to an integer overflow PDO::quote() may return unquoted string       CVE-2022-31631
    - fix password of excessive length triggers buffer overflow leading to RCE       CVE-2022-31626
    - fix SSRF bypass in FILTER_VALIDATE_URL       CVE-2021-21705
    - fix Local privilege escalation via PHP-FPM       CVE-2021-21703
    - fix underflow in env_path_info in fpm_main.c CVE-2019-11043
    - php-fpm: change default unix socket permission CVE-2014-0185
    - update to 5.5.7, fix for CVE-2013-6420
    - update to 5.5.2, fixes for CVE-2011-4718 + CVE-2013-4248
    - add security fix for CVE-2013-4113
    - security fix for CVE-2013-1643
    - security fix for CVE-2013-1635
    - update to 5.4.4 (CVE-2012-2143, CVE-2012-2386)
    - update to 5.4.3 (CVE-2012-2311, CVE-2012-2329)
    - update to 5.4.2 (CVE-2012-1823)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3997-1 advisory.

  - In PHP versions 7.3.x below 7.3.33, 7.4.x below 7.4.26 and 8.0.x below 8.0.13, certain XML parsing     functions, like simplexml_load_file(), URL-decode the filename passed to them. If that filename contains     URL-encoded NUL character, this may cause the function to interpret this as the end of the filename, thus     interpreting the filename differently from what the user intended, which may lead it to reading a     different file than intended. (CVE-2021-21707)

  - In PHP versions 7.4.x below 7.4.28, 8.0.x below 8.0.16, and 8.1.x below 8.1.3, when using filter functions     with FILTER_VALIDATE_FLOAT filter and min/max limits, if the filter fails, there is a possibility to     trigger use of allocated memory after free, which can result it crashes, and potentially in overwrite of     other memory chunks and RCE. This issue affects: code that uses FILTER_VALIDATE_FLOAT with min/max limits.
    (CVE-2021-21708)

  - In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when using Postgres     database extension, supplying invalid parameters to the parametrized query may lead to PHP attempting to     free memory using uninitialized data as pointers. This could lead to RCE vulnerability or denial of     service. (CVE-2022-31625)

  - In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when pdo_mysql extension     with mysqlnd driver, if the third party is allowed to supply host to connect to and the password for the     connection, password of excessive length can trigger a buffer overflow in PHP, which can lead to a remote     code execution vulnerability. (CVE-2022-31626)

  - In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the phar uncompressor code would recursively uncompress     quines gzip files, resulting in an infinite loop. (CVE-2022-31628)

  - In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the vulnerability enables network and same-site     attackers to set a standard insecure cookie in the victim's browser which is treated as a `__Host-` or     `__Secure-` cookie by PHP applications. (CVE-2022-31629)

  - In PHP versions prior to 7.4.33, 8.0.25 and 8.2.12, when using imageloadfont() function in gd extension,     it is possible to supply a specially crafted font file, such as if the loaded font is used with     imagechar() function, the read outside allocated buffer will be used. This can lead to crashes or     disclosure of confidential information. (CVE-2022-31630)

  - The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer     overflow that allows attackers to execute arbitrary code or eliminate expected cryptographic properties.
    This occurs in the sponge function interface. (CVE-2022-37454)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
175435	RHEL 9 : php:8.1 (RHSA-2023:2417)	Nessus	Red Hat Local Security Checks	5/12/2023	11/7/2024	critical
176318	Oracle Linux 8 : php:7.4 (ELSA-2023-2903)	Nessus	Oracle Linux Local Security Checks	5/24/2023	11/2/2024	critical
196189	RHEL 7 : php (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	5/11/2024	5/31/2024	critical
167650	SUSE SLED15 / SLES15 Security Update : php7 (SUSE-SU-2022:3997-1)	Nessus	SuSE Local Security Checks	11/16/2022	10/18/2023	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical