The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:1296 advisory.

    PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

    The following packages have been upgraded to a later upstream version: rh-php70-php (7.0.27). (BZ#1518843)

    Security Fix(es):

    * php: Heap overflow in mysqlnd when not receiving UNSIGNED_FLAG in BIT field (CVE-2016-7412)

    * php: Use after free in wddx_deserialize (CVE-2016-7413)

    * php: Out of bounds heap read when verifying signature of zip phar in phar_parse_zipfile (CVE-2016-7414)

    * php: Stack based buffer overflow in msgfmt_format_message (CVE-2016-7416)

    * php: Missing type check when unserializing SplArray (CVE-2016-7417)

    * php: Null pointer dereference in php_wddx_push_element (CVE-2016-7418)

    * php: Use-after-free vulnerability when resizing the 'properties' hash table of a serialized object     (CVE-2016-7479)

    * php: Invalid read when wddx decodes empty boolean element (CVE-2016-9935)

    * php: Use After Free in unserialize() (CVE-2016-9936)

    * php: Wrong calculation in exif_convert_any_to_int function (CVE-2016-10158)

    * php: Integer overflow in phar_parse_pharfile (CVE-2016-10159)

    * php: Off-by-one error in phar_parse_pharfile when loading crafted phar archive (CVE-2016-10160)

    * php: Out-of-bounds heap read on unserialize in finish_nested_data() (CVE-2016-10161)

    * php: Null pointer dereference when unserializing PHP object (CVE-2016-10162)

    * gd: DoS vulnerability in gdImageCreateFromGd2Ctx() (CVE-2016-10167)

    * gd: Integer overflow in gd_io.c (CVE-2016-10168)

    * php: Use of uninitialized memory in unserialize() (CVE-2017-5340)

    * php: Buffer over-read from unitialized data in gdImageCreateFromGifCtx function (CVE-2017-7890)

    * oniguruma: Out-of-bounds stack read in match_at() during regular expression searching (CVE-2017-9224)

    * oniguruma: Heap buffer overflow in next_state_val() during regular expression compilation     (CVE-2017-9226)

    * oniguruma: Out-of-bounds stack read in mbc_enc_len() during regular expression searching (CVE-2017-9227)

    * oniguruma: Out-of-bounds heap write in bitset_set_range() (CVE-2017-9228)

    * oniguruma: Invalid pointer dereference in left_adjust_char_head() (CVE-2017-9229)

    * php: Incorrect WDDX deserialization of boolean parameters leads to DoS (CVE-2017-11143)

    * php: Incorrect return value check of OpenSSL sealing function leads to crash (CVE-2017-11144)

    * php: Out-of-bounds read in phar_parse_pharfile (CVE-2017-11147)

    * php: Stack-based buffer over-read in msgfmt_parse_message function (CVE-2017-11362)

    * php: Stack based 1-byte buffer over-write in zend_ini_do_op() function Zend/zend_ini_parser.c     (CVE-2017-11628)

    * php: heap use after free in ext/standard/var_unserializer.re (CVE-2017-12932)

    * php: heap use after free in ext/standard/var_unserializer.re (CVE-2017-12934)

    * php: reflected XSS in .phar 404 page (CVE-2018-5712)

    * php, gd: Stack overflow in gdImageFillToBorder on truecolor images (CVE-2016-9933)

    * php: NULL Pointer Dereference in WDDX Packet Deserialization with PDORow (CVE-2016-9934)

    * php: wddx_deserialize() heap out-of-bound read via php_parse_date() (CVE-2017-11145)

    * php: buffer over-read in finish_nested_data function (CVE-2017-12933)

    * php: Out-of-bound read in timelib_meridian() (CVE-2017-16642)

    * php: Denial of Service (DoS) via infinite loop in libgd gdImageCreateFromGifCtx function in     ext/gd/libgd/gd_gif_in.c (CVE-2018-5711)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For details, see the Red Hat Software Collections 3.1 Release Notes linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

バナーによると、リモートのWebサーバーで実行されているPHPのバージョンは、5.6.32より前の5.6.xです。したがって、複数の脆弱性による影響を受けます。

このphp7の更新では、以下の問題を修正します：

キャッシュサイドチャネル攻撃の軽減：

  - CVE-2017-16642：インタープリターからの情報を漏洩するのに使用される可能性があるtimelib_meridianエラーを修正します（bsc#1067441）。

  - CVE-2017-9229：（bsc#1069631）left_adjust_char_head()での無効なポインターデリファレンスを修正します。

  - CVE-2017-9228：正規表現のコンパイル中にbitset_set_range()で発生するヒープ領域外書き込みを修正します（bsc#1069606）。

修正されたバグ：

  - オブジェクトをシリアル化/逆シリアル化する際の、間違ったリファレンスを修正します（bsc#1063815）。

この更新はSUSEからインポートされました：SLE-12：更新プロジェクトを更新します。

このphp7用更新プログラムでは、以下の問題が修正されています：修正されたセキュリティ問題：

  - CVE-2017-16642：インタープリターからの情報を漏洩するのに使用される可能性があるtimelib_meridianエラーラーを修正します（bsc#1067441）。

  - CVE-2017-9229：（bsc#1069631）left_adjust_char_head()での無効なポインターデリファレンスを修正します。 

  - CVE-2017-9228：正規表現のコンパイル中にbitset_set_range（）で発生するヒープ領域外書き込みが修正されています（bsc#1069606）。修正されたバグ：

  - オブジェクトをシリアル化/逆シリアル化する際の、間違ったリファレンスが修正されています（bsc#1063815）。

注意：Tenable Network Securityは、前述の記述ブロックをSUSEセキュリティアドバイザリから直接抽出しています。Tenableでは、新たな問題を持ち込まずに、できる限り自動的に整理して書式設定するようにしています。

このphp5用の更新プログラムでは、次の問題が修正されています：修正されたセキュリティ問題：

  - CVE-2017-16642：インタープリターからの情報を漏洩するのに使用される可能性があるtimelib_meridianエラーラーを修正します（bsc#1067441）。

  - CVE-2017-4025：set_include_path、tempnam、rmdir、readlinkのパス名切り捨てが修正されています（bsc#1067090）。

  - CVE-2017-9228：正規表現のコンパイル中にbitset_set_range（）で発生するヒープ領域外書き込みを修正します（bsc#1069606）。

  - CVE-2017-9229：（bsc#1069631）left_adjust_char_head()での無効なポインターデリファレンスを修正します。

注意：Tenable Network Securityは、前述の記述ブロックをSUSEセキュリティアドバイザリから直接抽出しています。Tenableでは、新たな問題を持ち込まずに、できる限り自動的に整理して書式設定するようにしています。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - より前の 5.6.32、 7.x より前の 7.0.25、 7.1.x より前の 7.1.11のPHP で、「front of」および「back of」ディレクティブを処理する日付拡張の timelib_meridian のエラーが、は、インタープリターから情報を漏えいしました。これは、php_parse_date関数に影響を与えるext/date/lib/parse_date.cの領域外読み取りに関連しています。注：これはとは別の問題です CVE-2017-11145。
    (CVE-2017-16642)

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

PHPがPHAR 404エラーページを不適切に処理することがわかりました。リモートの攻撃者がこの問題を悪用して、クロスサイトスクリプティング (XSS) 攻撃を行う可能性があります。(CVE-2018-5712) 

特定のデータをシリアル化解除するとき、PHPがメモリを不適切に処理することがわかりました。リモートの攻撃者が、この問題を利用して、PHP をクラッシュさせてサービス拒否を引き起こしたり、任意のコードを実行したりする可能性があります。(CVE-2017-12933)

PHPが「front of」および「back of」日付ディレクティブを不適切に処理することがわかりました。リモートの攻撃者がこの問題を悪用して、秘密情報を取得する可能性があります。(CVE-2017-16642)。

注意: Tenable Network Security は、前述の説明ブロックを Ubuntu セキュリティアドバイザリからすでに直接抽出しています。Tenable では、新たな問題を持ち込まずに、できる限り自動的に整理して書式設定するようにしています。

According to its banner, the version of PHP running on the remote web server is 5.6.x prior to 5.6.32. It is, therefore, affected by multiple vulnerabilities.

This update for php7 fixes the following issues :

Security issues fixed :

  - CVE-2017-16642: Fix timelib_meridian error that could be     used to leak information from the interpreter     (bsc#1067441).

  - CVE-2017-9229: Fix invalid pointer dereference in     left_adjust_char_head() (bsc#1069631).

  - CVE-2017-9228: Fix heap out-of-bounds write that occurs     in bitset_set_range() during regex compilation     (bsc#1069606).

Bugs fixed :

  - Fix wrong reference when serialize/unserialize an object     (bsc#1063815).

This update was imported from the SUSE:SLE-12:Update update project.

This update for php7 fixes the following issues: Security issues fixed :

  - CVE-2017-16642: Fix timelib_meridian error that could be     used to leak information from the interpreter     (bsc#1067441).

  - CVE-2017-9229: Fix invalid pointer dereference in     left_adjust_char_head() (bsc#1069631).

  - CVE-2017-9228: Fix heap out-of-bounds write that occurs     in bitset_set_range() during regex compilation     (bsc#1069606). Bugs fixed :

  - Fix wrong reference when serialize/unserialize an object     (bsc#1063815).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for php5 fixes the following issues: Security issues fixed :

  - CVE-2017-16642: Fix timelib_meridian error that could be     used to leak information from the interpreter     (bsc#1067441).

  - CVE-2017-4025: Fix pathname truncation in     set_include_path, tempnam, rmdir, and readlink     (bsc#1067090).

  - CVE-2017-9228: Fix heap out-of-bounds write that occurs     in bitset_set_range() during regex compilation     (bsc#1069606).

  - CVE-2017-9229: Fix invalid pointer dereference in     left_adjust_char_head() (bsc#1069631).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the php packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - PHP is an HTML-embedded scripting language. PHP     attempts to make it easy for developers to write     dynamically generated web pages. PHP also offers     built-in database integration for several commercial     and non-commercial database management systems, so     writing a database-enabled webpage with PHP is fairly     simple. The most common use of PHP coding is probably     as a replacement for CGI scripts. The php package     contains the module (often referred to as mod_php)     which adds support for the PHP language to Apache HTTP     Server. Security Fix(es):A flaw was found in HAProxy     before 2.0.6. In legacy mode, messages featuring a     transfer-encoding header missing the 'chunked' value     were not being correctly rejected. The impact was     limited but if combined with the 'http-reuse always'     setting, it could be used to help construct an HTTP     request smuggling attack against a vulnerable component     employing a lenient parser that would ignore the     content-length header as soon as it saw a     transfer-encoding one (even if not entirely valid     according to the specification).(CVE-2017-16642)In PHP     before 5.6.32, 7.x before 7.0.25, and 7.1.x before     7.1.11, an error in the date extension's     timelib_meridian handling of 'front of' and 'back of'     directives could be used by attackers able to supply     date strings to leak information from the interpreter,     related to ext/date/lib/parse_date.c out-of-bounds     reads affecting the php_parse_date function. NOTE: this     is a different issue than     CVE-2017-11145.(CVE-2017-11145)ext/standard/var_unseria     lizer.re in PHP before 5.6.26 mishandles     object-deserialization failures, which allows remote     attackers to cause a denial of service (memory     corruption) or possibly have unspecified other impact     via an unserialize call that references a partially     constructed object.(CVE-2016-10397)Double free     vulnerability in the zend_ts_hash_graceful_destroy     function in zend_ts_hash.c in the Zend Engine in PHP     through 5.5.20 and 5.6.x through 5.6.4 allows remote     attackers to cause a denial of service or possibly have     unspecified other impact via unknown     vectors.(CVE-2016-7412)Oniguruma through 6.9.3, as used     in PHP 7.3.x and other products, has a heap-based     buffer over-read in str_lower_case_match in     regexec.c.(CVE-2019-19246)When PHP EXIF extension is     parsing EXIF information from an image, e.g. via     exif_read_data() function, in PHP versions 7.2.x below     7.2.26, 7.3.x below 7.3.13 and 7.4.0 it is possible to     supply it with data what will cause it to read past the     allocated buffer. This may lead to information     disclosure or     crash.(CVE-2019-11047)main/php_open_temporary_file.c in     PHP before 5.5.28 and 5.6.x before 5.6.12 does not     ensure thread safety, which allows remote attackers to     cause a denial of service (race condition and heap     memory corruption) by leveraging an application that     performs many temporary-file     accesses.(CVE-2017-7272)When PHP EXIF extension is     parsing EXIF information from an image, e.g. via     exif_read_data() function, in PHP versions 7.2.x below     7.2.26, 7.3.x below 7.3.13 and 7.4.0 it is possible to     supply it with data what will cause it to read past the     allocated buffer. This may lead to information     disclosure or crash.(CVE-2019-11050)An issue was     discovered in Oniguruma 6.x before 6.9.4_rc2. In the     function fetch_interval_quantifier (formerly known as     fetch_range_quantifier) in regparse.c, PFETCH is called     without checking PEND. This leads to a heap-based     buffer     over-read.(CVE-2019-19204)main/streams/xp_socket.c in     PHP 7.x before 2017-03-07 misparses fsockopen calls,     such as by interpreting fsockopen('127.0.0.1:80', 443)     as if the address/port were 127.0.0.1:80:443, which is     later truncated to 127.0.0.1:80. This behavior has a     security risk if the explicitly provided port number     (i.e., 443 in this example) is hardcoded into an     application as a security policy, but the hostname     argument (i.e., 127.0.0.1:80 in this example) is     obtained from untrusted input.(CVE-2017-7189)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In PHP before 5.6.32, 7.x before 7.0.25, and 7.1.x before 7.1.11, an error in the date extension's     timelib_meridian handling of 'front of' and 'back of' directives could be used by attackers able to supply     date strings to leak information from the interpreter, related to ext/date/lib/parse_date.c out-of-bounds     reads affecting the php_parse_date function. NOTE: this is a different issue than CVE-2017-11145.
    (CVE-2017-16642)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3566-1 advisory.

    It was discovered that PHP incorrectly handled the PHAR 404 error page. A remote attacker could possibly     use this issue to conduct cross-site scripting (XSS) attacks. (CVE-2018-5712)

    It was discovered that PHP incorrectly handled memory when unserializing certain data. A remote attacker     could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute     arbitrary code. (CVE-2017-12933)

    It was discovered that PHP incorrectly handled 'front of' and 'back of' date directives. A remote attacker     could possibly use this issue to obtain sensitive information. (CVE-2017-16642)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
194027	RHEL 6 / 7 : rh-php70-php (RHSA-2018:1296)	Nessus	Red Hat Local Security Checks	2024/4/27	2025/4/15	critical
104631	PHP 5.6.x < 5.6.32の複数の脆弱性	Nessus	CGI abuses	2017/11/16	2025/5/26	critical
105238	openSUSEセキュリティ更新プログラム：php7（openSUSE-2017-1353）	Nessus	SuSE Local Security Checks	2017/12/14	2021/1/19	critical
120009	SUSE SLES12セキュリティ更新プログラム：php7 (SUSE-SU-2017:3237-1)	Nessus	SuSE Local Security Checks	2019/1/2	2024/7/11	critical
120010	SUSE SLES12セキュリティ更新プログラム：php5 (SUSE-SU-2017:3277-1)	Nessus	SuSE Local Security Checks	2019/1/2	2024/7/11	critical
221214	Linux Distros のパッチ未適用の脆弱性: CVE-2017-16642	Nessus	Misc.	2025/3/4	2025/8/21	high
106792	Ubuntu 14.04 LTS : PHP 脆弱性 (USN-3566-1)	Nessus	Ubuntu Local Security Checks	2018/2/13	2024/8/27	critical
131592	EulerOS 2.0 SP2：php（EulerOS-SA-2019-2438）	Nessus	Huawei Local Security Checks	2019/12/4	2023/4/25	critical
104631	PHP 5.6.x < 5.6.32 Multiple Vulnerabilities	Nessus	CGI abuses	2017/11/16	2025/5/26	critical
105238	openSUSE Security Update : php7 (openSUSE-2017-1353)	Nessus	SuSE Local Security Checks	2017/12/14	2021/1/19	critical
120009	SUSE SLES12 Security Update : php7 (SUSE-SU-2017:3237-1)	Nessus	SuSE Local Security Checks	2019/1/2	2024/7/11	critical
120010	SUSE SLES12 Security Update : php5 (SUSE-SU-2017:3277-1)	Nessus	SuSE Local Security Checks	2019/1/2	2024/7/11	critical
136245	EulerOS Virtualization for ARM 64 3.0.2.0 : php (EulerOS-SA-2020-1542)	Nessus	Huawei Local Security Checks	2020/5/1	2025/2/21	high
221214	Linux Distros Unpatched Vulnerability : CVE-2017-16642	Nessus	Misc.	2025/3/4	2025/8/21	high
106792	Ubuntu 14.04 LTS : PHP vulnerabilities (USN-3566-1)	Nessus	Ubuntu Local Security Checks	2018/2/13	2024/8/27	critical
131592	EulerOS 2.0 SP2 : php (EulerOS-SA-2019-2438)	Nessus	Huawei Local Security Checks	2019/12/4	2023/4/25	critical

检测

插件搜索

critical

critical

critical

critical

critical

high

critical

critical

critical

critical

critical

critical

high

high

critical

critical