According to the versions of the ruby packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A SMTP command injection flaw was found in the way     Ruby's Net::SMTP module handled CRLF sequences in     certain SMTP commands. An attacker could potentially     use this flaw to inject SMTP commands in a SMTP session     in order to facilitate phishing attacks or spam     campaigns.(CVE-2015-9096)

  - An issue was discovered in Oniguruma 6.2.0, as used in     Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP     through 7.1.5. A stack out-of-bounds read occurs in     match_at() during regular expression searching. A     logical error involving order of validation and access     in match_at() could result in an out-of-bounds read     from a stack buffer.(CVE-2017-9224)

  - An issue was discovered in Oniguruma 6.2.0, as used in     Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP     through 7.1.5. A heap out-of-bounds write occurs in     bitset_set_range() during regular expression     compilation due to an uninitialized variable from an     incorrect state transition. An incorrect state     transition in parse_char_class() could create an     execution path that leaves a critical local variable     uninitialized until it's used as an index, resulting in     an out-of-bounds write memory     corruption.(CVE-2017-9228)

  - An issue was discovered in Oniguruma 6.2.0, as used in     Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP     through 7.1.5. A stack out-of-bounds read occurs in     mbc_enc_len() during regular expression searching.
    Invalid handling of reg-i1/4zdmin in     forward_search_range() could result in an invalid     pointer dereference, as an out-of-bounds read from a     stack buffer.(CVE-2017-9227)

  - An issue was discovered in Oniguruma 6.2.0, as used in     Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP     through 7.1.5. A SIGSEGV occurs in     left_adjust_char_head() during regular expression     compilation. Invalid handling of reg-i1/4zdmax in     forward_search_range() could result in an invalid     pointer dereference, normally as an immediate     denial-of-service condition.(CVE-2017-9229)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the ruby packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in RubyGems 2.6 and later     through 3.0.2. Since Gem::UserInteraction#verbose calls     say without escaping, escape sequence injection is     possible.(CVE-2019-8321)

  - An issue was discovered in Oniguruma 6.2.0, as used in     Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP     through 7.1.5. A SIGSEGV occurs in     left_adjust_char_head() during regular expression     compilation. Invalid handling of reg->dmax in     forward_search_range() could result in an invalid     pointer dereference, normally as an immediate     denial-of-service condition.(CVE-2017-9229)

  - An issue was discovered in Oniguruma 6.2.0, as used in     Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP     through 7.1.5. A stack out-of-bounds read occurs in     mbc_enc_len() during regular expression searching.
    Invalid handling of reg->dmin in forward_search_range()     could result in an invalid pointer dereference, as an     out-of-bounds read from a stack buffer.(CVE-2017-9227)

  - An issue was discovered in Oniguruma 6.2.0, as used in     Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP     through 7.1.5. A heap out-of-bounds write occurs in     bitset_set_range() during regular expression     compilation due to an uninitialized variable from an     incorrect state transition. An incorrect state     transition in parse_char_class() could create an     execution path that leaves a critical local variable     uninitialized until it's used as an index, resulting in     an out-of-bounds write memory     corruption.(CVE-2017-9228)

  - An issue was discovered in Oniguruma 6.2.0, as used in     Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP     through 7.1.5. A stack out-of-bounds read occurs in     match_at() during regular expression searching. A     logical error involving order of validation and access     in match_at() could result in an out-of-bounds read     from a stack buffer.(CVE-2017-9224)

  - A SMTP command injection flaw was found in the way     Ruby's Net::SMTP module handled CRLF sequences in     certain SMTP commands. An attacker could potentially     use this flaw to inject SMTP commands in a SMTP session     in order to facilitate phishing attacks or spam     campaigns.(CVE-2015-9096)

  - Constructed ASN.1 types with a recursive definition     (such as can be found in PKCS7) could eventually exceed     the stack given malicious input with excessive     recursion. This could result in a Denial Of Service     attack. There are no such structures used within     SSL/TLS that come from untrusted sources so this is     considered safe. Fixed in OpenSSL 1.1.0h (Affected     1.1.0-1.1.0g). Fixed in OpenSSL 1.0.2o (Affected     1.0.2b-1.0.2n).(CVE-2016-7798)

  - RubyGems version Ruby 2.2 series: 2.2.9 and earlier,     Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series:
    2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier,     prior to trunk revision 62422 contains a Directory     Traversal vulnerability in gem installation that can     result in the gem could write to arbitrary filesystem     locations during installation. This attack appear to be     exploitable via the victim must install a malicious     gem. This vulnerability appears to have been fixed in     2.7.6.(CVE-2018-1000079)

  - RubyGems version Ruby 2.2 series: 2.2.9 and earlier,     Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series:
    2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier,     prior to trunk revision 62422 contains a Cross Site     Scripting (XSS) vulnerability in gem server display of     homepage attribute that can result in XSS. This attack     appear to be exploitable via the victim must browse to     a malicious gem on a vulnerable gem server. This     vulnerability appears to have been fixed in     2.7.6.(CVE-2018-1000078)

  - RubyGems version Ruby 2.2 series: 2.2.9 and earlier,     Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series:
    2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier,     prior to trunk revision 62422 contains a Improper Input     Validation vulnerability in ruby gems specification     homepage attribute that can result in a malicious gem     could set an invalid homepage URL. This vulnerability     appears to have been fixed in 2.7.6.(CVE-2018-1000077)

  - RubyGems version Ruby 2.2 series: 2.2.9 and earlier,     Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series:
    2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier,     prior to trunk revision 62422 contains a     Deserialization of Untrusted Data vulnerability in     owner command that can result in code execution. This     attack appear to be exploitable via victim must run the     `gem owner` command on a gem with a specially crafted     YAML file. This vulnerability appears to have been     fixed in 2.7.6.(CVE-2018-1000074)

  - RubyGems version Ruby 2.2 series: 2.2.9 and earlier,     Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series:
    2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier,     prior to trunk revision 62422 contains a Directory     Traversal vulnerability in install_location function of     package.rb that can result in path traversal when     writing to a symlinked basedir outside of the root.
    This vulnerability appears to have been fixed in     2.7.6.(CVE-2018-1000073)

  - Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before     2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1 allows an     HTTP Response Splitting attack. An attacker can inject     a crafted key and value into an HTTP response for the     HTTP server of WEBrick.(CVE-2017-17742)

  - Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x     through 2.6.4 allows HTTP Response Splitting. If a     program using WEBrick inserts untrusted input into the     response header, an attacker can exploit it to insert a     newline character to split a header, and inject     malicious content to deceive clients. NOTE: this issue     exists because of an incomplete fix for CVE-2017-17742,     which addressed the CRLF vector, but did not address an     isolated CR or an isolated LF.(CVE-2019-16254)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in     PHP through 7.1.5. A stack out-of-bounds read occurs in mbc_enc_len() during regular expression searching.
    Invalid handling of reg->dmin in forward_search_range() could result in an invalid pointer dereference, as     an out-of-bounds read from a stack buffer. (CVE-2017-9227)

Note that Nessus relies on the presence of the package as reported by the vendor.

According to its banner, the version of PHP running on the remote web server is 7.1.x prior to 7.1.7. It is, therefore, affected by the following vulnerabilities :

  - An out-of-bounds read error exists in the GD Graphics     Library (LibGD) in the gdImageCreateFromGifCtx()     function within file gd_gif_in.c when handling a     specially crafted GIF file. An unauthenticated, remote     attacker can exploit this to disclose sensitive memory     contents or crash a process linked to the library.
    (CVE-2017-7890)

  - An out-of-bounds read error exists in Oniguruma in the     match_at() function within file regexec.c. An     unauthenticated, remote attacker can exploit this to     disclose sensitive memory contents or crash a process     linked to the library. (CVE-2017-9224)

  - An out-of-bounds write error exists in Oniguruma in the     next_state_val() function during regular expression     compilation. An unauthenticated, remote attacker can     exploit this to execute arbitrary code. (CVE-2017-9226)

  - An out-of-bounds read error exists in Oniguruma in the     mbc_enc_len() function within file utf8.c. An     unauthenticated, remote attacker can exploit this to     disclose memory contents or crash a process linked to     the library. (CVE-2017-9227)

  - An out-of-bounds write error exists in Oniguruma in the     bitset_set_range() function during regular expression     compilation. An unauthenticated, remote attacker can     exploit this to execute arbitrary code. (CVE-2017-9228)

  - An invalid pointer deference flaw exists in Oniguruma     in the left_adjust_char_head() function within file     regexec.c during regular expression compilation. An     unauthenticated, remote attacker can exploit this to     crash a process linked to the library, resulting in a     denial of service condition. (CVE-2017-9229)

  - A flaw exists in OpenSSL in the EVP_SealInit() function     within file crypto/evp/p_seal.c due to returning an     undocumented value of '-1'. An unauthenticated, remote     attacker can exploit this to cause an unspecified     impact. (CVE-2017-11144)

  - An out-of-bounds read error exists in PHP in the     php_parse_date() function within file     ext/date/lib/parse_date.c. An unauthenticated, remote     attacker can exploit this to disclose memory contents or     cause a denial of service condition. (CVE-2017-11145)

  - A stack-based buffer overflow condition exists in PHP     in the msgfmt_parse_message() function due to improper     validation of user-supplied input when parsing locale.
    An unauthenticated, remote attacker can exploit this to     cause a denial of service condition or the execution of     arbitrary code. (CVE-2017-11362)

  - An off-by-one overflow condition exists in PHP in the     INI parsing API, specifically in the zend_ini_do_op()     function within file Zend/zend_ini_parser.c, due to     improper validation of user-supplied input. An     unauthenticated, remote attacker can exploit this to     cause a denial of service condition or the execution of     arbitrary code. (CVE-2017-11628)

  - An out-of-bounds read error exists in PHP in the     finish_nested_data() function within file     ext/standard/var_unserializer.re. An unauthenticated,     remote attacker can exploit this to disclose memory     contents or cause a denial of service condition.
    (CVE-2017-12933)

  - A use-after-free error exists in PHP in the     zval_get_type() function within file     ext/standard/var_unserializer.c. An unauthenticated,     remote attacker can exploit this to execute arbitrary     code. (CVE-2017-12934)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2018-3021:01 advisory.

    * php: Heap overflow in mysqlnd when not receiving UNSIGNED_FLAG in BIT field (CVE-2016-7412)
    * php: Use after free in wddx_deserialize (CVE-2016-7413)
    * php: Out of bounds heap read when verifying signature of zip phar in phar_parse_zipfile (CVE-2016-7414)
    * php: Stack based buffer overflow in msgfmt_format_message (CVE-2016-7416)
    * php: Missing type check when unserializing SplArray (CVE-2016-7417)
    * php: Null pointer dereference in php_wddx_push_element (CVE-2016-7418)
    * php: Use-after-free vulnerability when resizing the 'properties' hash table of a serialized object     (CVE-2016-7479)
    * php: Invalid read when wddx decodes empty boolean element (CVE-2016-9935)
    * php: Use After Free in unserialize() (CVE-2016-9936)
    * php: Wrong calculation in exif_convert_any_to_int function (CVE-2016-10158)
    * php: Integer overflow in phar_parse_pharfile (CVE-2016-10159)
    * php: Off-by-one error in phar_parse_pharfile when loading crafted phar archive (CVE-2016-10160)
    * php: Out-of-bounds heap read on unserialize in finish_nested_data() (CVE-2016-10161)
    * php: Null pointer dereference when unserializing PHP object (CVE-2016-10162)
    * gd: DoS vulnerability in gdImageCreateFromGd2Ctx() (CVE-2016-10167)
    * gd: Integer overflow in gd_io.c (CVE-2016-10168)
    * php: Use of uninitialized memory in unserialize() (CVE-2017-5340)
    * php: Buffer over-read from unitialized data in gdImageCreateFromGifCtx function (CVE-2017-7890)
    * oniguruma: Out-of-bounds stack read in match_at() during regular expression searching (CVE-2017-9224)
    * oniguruma: Heap buffer overflow in next_state_val() during regular expression compilation     (CVE-2017-9226)
    * oniguruma: Out-of-bounds stack read in mbc_enc_len() during regular expression searching (CVE-2017-9227)
    * oniguruma: Out-of-bounds heap write in bitset_set_range() (CVE-2017-9228)
    * oniguruma: Invalid pointer dereference in left_adjust_char_head() (CVE-2017-9229)
    * php: Incorrect WDDX deserialization of boolean parameters leads to DoS (CVE-2017-11143)
    * php: Incorrect return value check of OpenSSL sealing function leads to crash (CVE-2017-11144)
    * php: Out-of-bounds read in phar_parse_pharfile (CVE-2017-11147)
    * php: Stack-based buffer over-read in msgfmt_parse_message function (CVE-2017-11362)
    * php: Stack based 1-byte buffer over-write in zend_ini_do_op() function Zend/zend_ini_parser.c     (CVE-2017-11628)
    * php: heap use after free in ext/standard/var_unserializer.re (CVE-2017-12932)
    * php: heap use after free in ext/standard/var_unserializer.re (CVE-2017-12934)
    * php: reflected XSS in .phar 404 page (CVE-2018-5712)
    * php, gd: Stack overflow in gdImageFillToBorder on truecolor images (CVE-2016-9933)
    * php: NULL Pointer Dereference in WDDX Packet Deserialization with PDORow (CVE-2016-9934)
    * php: wddx_deserialize() heap out-of-bound read via php_parse_date() (CVE-2017-11145)
    * php: buffer over-read in finish_nested_data function (CVE-2017-12933)
    * php: Out-of-bound read in timelib_meridian() (CVE-2017-16642)
    * php: Denial of Service (DoS) via infinite loop in libgd gdImageCreateFromGifCtx function in     ext/gd/libgd/gd_gif_in.c (CVE-2018-5711)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Multiple security flaws were found on the previous version of oniguruma. This new version should fix the issue. 

Fixed CVEs: CVE-2017-9226 CVE-2017-9225 CVE-2017-9224 CVE-2017-9227 CVE-2017-9229 CVE-2017-9228

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

**PHP version 7.1.7** (06 Jul 2017)

**Core:**

  - Fixed bug php#74738 (Multiple [PATH=] and [HOST=]     sections not properly parsed). (Manuel Mausz)

  - Fixed bug php#74658 (Undefined constants in array     properties result in broken properties). (Laruence)

  - Fixed misparsing of abstract unix domain socket names.
    (Sara)

  - Fixed bug php#74603 (PHP INI Parsing Stack Buffer     Overflow Vulnerability). (Stas)

  - Fixed bug php#74101, bug php#74614 (Unserialize Heap     Use-After-Free (READ: 1) in zval_get_type). (Nikita)

  - Fixed bug php#74111 (Heap buffer overread (READ: 1)     finish_nested_data from unserialize). (Nikita)

  - Fixed bug php#74819 (wddx_deserialize() heap     out-of-bound read via php_parse_date()). (Derick)

**Date:**

  - Fixed bug php#74639 (implement clone for DatePeriod and     DateInterval). (andrewnester)

**DOM:**

  - Fixed bug php#69373 (References to deleted XPath query     results). (ttoohey)

**Intl:**

  - Fixed bug php#73473 (Stack Buffer Overflow in     msgfmt_parse_message). (libnex)

  - Fixed bug php#74705 (Wrong reflection on     Collator::getSortKey and collator_get_sort_key). (Tyson     Andre, Remi)

**Mbstring:**

  - Add oniguruma upstream fix (CVE-2017-9224,     CVE-2017-9226, CVE-2017-9227, CVE-2017-9228,     CVE-2017-9229) (Remi, Mamoru TASAKA)

**Opcache:**

  - Fixed bug php#74663 (Segfault with     opcache.memory_protect and validate_timestamp).
    (Laruence)

  - Revert opcache.enable_cli to default disabled. (Nikita)

**OpenSSL:**

  - Fixed bug php#74720 (pkcs7_en/decrypt does not work if     \x1a is used in content). (Anatol)

  - Fixed bug php#74651 (negative-size-param (-1) in memcpy     in zif_openssl_seal()). (Stas)

**Reflection:**

  - Fixed bug php#74673 (Segfault when cast Reflection     object to string with undefined constant). (Laruence)

**SPL:**

  - Fixed bug php#74478 (null coalescing operator failing     with SplFixedArray). (jhdxr)

**FTP:**

  - Fixed bug php#74598 (ftp:// wrapper ignores context     arg). (Sara)

**PHAR:**

  - Fixed bug php#74386 (Phar::__construct reflection     incorrect). (villfa)

**SOAP**

  - Fixed bug php#74679 (Incorrect conversion array with     WSDL_CACHE_MEMORY). (Dmitry)

**Streams:**

  - Fixed bug php#74556 (stream_socket_get_name() returns     '\0'). (Sara)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for php7 fixes the following security issues :

  - CVE-2017-9224: stack out-of-bounds read occurs in     match_at() could lead to Denial of service (bsc#1040891)

  - CVE-2017-9226: heap out-of-bounds write orread occurs in     next_state_val() could lead to Denial of     service(bsc#1040889)

  - CVE-2017-9227: stack out-of-bounds read in mbc_enc_len()     could lead to Denial of service (bsc#1040883)

  - CVE-2017-6441: The _zval_get_long_func_ex in     Zend/zend_operators.c in PHP allowed attackers to cause     a denial of service (NULL pointer dereference and     application crash) via crafted use of 'declare(ticks='     in a PHP script (bsc#1032155).

  - CVE-2016-6294: The locale_accept_from_http function in     ext/intl/locale/locale_methods.c did not properly     restrict calls to the ICU uloc_acceptLanguageFromHTTP     function, which allowed remote attackers to cause a     denial of service (out-of-bounds read) or possibly have     unspecified other impact via a call with a long argument     (bsc#1035111).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2025-10916:10 advisory.

    * CVE-2017-9224: fix out-of-bounds read of a stack in match_at function
    * CVE-2017-9226: fix out-of-bounds write or read of a heap in   next_state_val     function
    * CVE-2017-9227: fix out-of-bounds read of a stack in mbc_enc_len function     CVE(s):
    CVE-2017-9224     An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in     PHP through 7.1.5. A stack out-of-bounds read occurs in match_at() during regular expression searching. A     logical error involving order of validation and access in match_at() could result in an out-of-bounds read     from a stack buffer.
    CVE-2017-9226     An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in     PHP through 7.1.5. A heap out-of-bounds write or read occurs in next_state_val() during regular expression     compilation. Octal numbers larger than 0xff are not handled correctly in fetch_token() and     fetch_token_in_cc(). A malformed regular expression containing an octal number in the form of '\700' would     produce an invalid code point value larger than 0xff in next_state_val(), resulting in an out-of-bounds     write memory corruption.
    CVE-2017-9227     An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in     PHP through 7.1.5. A stack out-of-bounds read occurs in mbc_enc_len() during regular expression searching.
    Invalid handling of reg->dmin in forward_search_range() could result in an invalid pointer dereference, as     an out-of-bounds read from a stack buffer.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its banner, the version of PHP running on the remote web server is 5.6.x prior to 5.6.31. It is, therefore, affected by the following vulnerabilities :

  - An out-of-bounds read error exists in the PCRE library     in the compile_bracket_matchingpath() function within     file pcre_jit_compile.c. An unauthenticated, remote     attacker can exploit this, via a specially crafted     regular expression, to crash a process linked to the     library, resulting in a denial of service condition.
    (CVE-2017-6004)

  - An out-of-bounds read error exists in the GD Graphics     Library (LibGD) in the gdImageCreateFromGifCtx()     function within file gd_gif_in.c when handling a     specially crafted GIF file. An unauthenticated, remote     attacker can exploit this to disclose sensitive memory     contents or crash a process linked to the library.
    (CVE-2017-7890)

  - An out-of-bounds read error exists in Oniguruma in the     match_at() function within file regexec.c. An     unauthenticated, remote attacker can exploit this to     disclose sensitive memory contents or crash a process     linked to the library. (CVE-2017-9224)

  - An out-of-bounds write error exists in Oniguruma in the     next_state_val() function during regular expression     compilation. An unauthenticated, remote attacker can     exploit this to execute arbitrary code. (CVE-2017-9226)

  - An out-of-bounds read error exists in Oniguruma in the     mbc_enc_len() function within file utf8.c. An     unauthenticated, remote attacker can exploit this to     disclose memory contents or crash a process linked to     the library. (CVE-2017-9227)

  - An out-of-bounds write error exists in Oniguruma in the     bitset_set_range() function during regular expression     compilation. An unauthenticated, remote attacker can     exploit this to execute arbitrary code. (CVE-2017-9228)

  - An invalid pointer deference flaw exists in Oniguruma     in the left_adjust_char_head() function within file     regexec.c during regular expression compilation. An     unauthenticated, remote attacker can exploit this to     crash a process linked to the library, resulting in a     denial of service condition. (CVE-2017-9229)

  - A denial of service condition exists in PHP when     handling overlarge POST requests. An unauthenticated,     remote attacker can exploit this to exhaust available     CPU resources. (CVE-2017-11142)

  - An extended invalid free error exists in PHP in the     php_wddx_push_element() function within file     ext/wddx/wddx.c when parsing empty boolean tags.
    An unauthenticated, remote attacker can exploit this to     cause a denial of service condition. (CVE-2017-11143)

  - A flaw exists in OpenSSL in the EVP_SealInit() function     within file crypto/evp/p_seal.c due to returning an     undocumented value of '-1'. An unauthenticated, remote     attacker can exploit this to cause an unspecified     impact. (CVE-2017-11144)

  - An out-of-bounds read error exists in PHP in the     php_parse_date() function within file     ext/date/lib/parse_date.c. An unauthenticated, remote     attacker can exploit this to disclose memory contents or     cause a denial of service condition.
    (CVE-2017-11145)

  - An out-of-bounds read error exists in PHP in the     finish_nested_data() function within file     ext/standard/var_unserializer.re. An unauthenticated,     remote attacker can exploit this to disclose memory     contents or cause a denial of service condition.

  - An off-by-one overflow condition exists in PHP in the     INI parsing API, specifically in the zend_ini_do_op()     function within file Zend/zend_ini_parser.y, due to     improper validation of user-supplied input. An     unauthenticated, remote attacker can exploit this to     cause a denial of service condition or the execution of     arbitrary code.

  - A Heap buffer overread flaw in finish_nested_data     while unserializing untrusted data could lead to an     unspecified impact on the integrity of PHP.
    (CVE-2017-12933)

  - A stack-based buffer overflow in the zend_ini_do_op()     function in Zend/zend_ini_parser.c could cause a denial     of service or potentially allow executing code.
    (CVE-2017-11628)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
129184	EulerOS 2.0 SP5 : ruby (EulerOS-SA-2019-1990)	Nessus	Huawei Local Security Checks	2019/9/24	2024/4/23	critical
135605	EulerOS Virtualization 3.0.2.2 : ruby (EulerOS-SA-2020-1443)	Nessus	Huawei Local Security Checks	2020/4/16	2024/3/18	critical
221287	Linux Distros Unpatched Vulnerability : CVE-2017-9227	Nessus	Misc.	2025/3/4	2025/8/20	critical
101527	PHP 7.1.x < 7.1.7 Multiple Vulnerabilities	Nessus	CGI abuses	2017/7/13	2026/1/22	critical
289151	MiracleLinux 7 : rh-php70-php-7.0.27-1.el7 (AXSA:2018-3021:01)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	critical
101745	Fedora 26 : oniguruma (2017-ee01a2ced6)	Nessus	Fedora Local Security Checks	2017/7/17	2025/12/10	critical
101797	Fedora 26 : php (2017-b8bb4b86e2)	Nessus	Fedora Local Security Checks	2017/7/19	2025/12/10	critical
120000	SUSE SLES12 Security Update : php7 (SUSE-SU-2017:1717-1)	Nessus	SuSE Local Security Checks	2019/1/2	2024/7/11	critical
282847	MiracleLinux 7 : php-5.4.16-48.0.11.el7.AXS7 (AXSA:2025-10916:10)	Nessus	Miracle Linux Local Security Checks	2026/1/13	2026/1/13	critical
101525	PHP 5.6.x < 5.6.31 Multiple Vulnerabilities	Nessus	CGI abuses	2017/7/13	2025/12/11	critical

检测

插件搜索

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical