解析 HTTP 响应时，ext/standard/http_fopen_wrapper.c:php_stream_url_wrap_http_ex 函数中的基于堆栈的缓冲区读取不足可导致拒绝服务。在 PHP 5.6.33 及之前版本、7.0.28 之前的 7.0.x 版本、7.1.14 及之前的 7.1.x 版本和 7.2.2 及之前的 7.2.x 版本中，在 ext/standard/http_fopen_wrapper.c 的 php_stream_url_wrap_http_ex 函数中解析 HTTP 响应时，存在基于堆栈的缓冲区读取不足。这进而导致复制一个大型字符串。(CVE-2018-7584)

在广泛使用的开源通用脚本语言 PHP 中发现数个漏洞。CVE-2018-7584 解析 HTTP 响应时存在堆栈缓冲区溢出，可能会造成复制大型字符串，并可能造成内存损坏和/或拒绝服务 CVE-2018-10545 可转储的 FPM 子进程允许绕过 opcache 访问权限控制，可能会造成信息泄露，即一个用户可以获取其他用户运行的 PHP 应用程序的相关信息 CVE-2018-10546 某种无效的字节序列可能会触发流筛选器 convert.iconv 中的无限循环 CVE-2018-10547 CVE-2018-5712 之前的一个补丁不完整，造成 PHAR 403 和 404 错误页面中存在反射型 XSS 形式的其他漏洞 CVE-2018-10548 恶意远程 LDAP 服务器发送的特制响应可能会造成拒绝服务（空指针取消引用导致应用程序崩溃） CVE-2018-10549 特制的 JPEG 文件可能会造成越界读取和堆缓冲区溢出 对于 Debian 8“Jessie”，这些问题已在 5.6.36+dfsg-0+deb8u1 版本中修复。我们建议您升级 php5 程序包。注意：Tenable Network Security 已直接从 DLA 安全公告中提取上述描述块。Tenable 已尝试在不引入其他问题的情况下，尽可能进行自动整理和排版。

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-1112 advisory.

    - fix underflow in env_path_info in fpm_main.c CVE-2019-11043
    - fix stack-buffer-overflow while parsing HTTP response CVE-2018-7584
    - fix out-of-bounds read in base64_decode_xmlrpc CVE-2019-9024
    - fix reflected XSS in phar 404 page CVE-2018-5712

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the php packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - In PHP through 5.6.33, 7.0.x before 7.0.28, 7.1.x     through 7.1.14, and 7.2.x through 7.2.2, there is a     stack-based buffer under-read while parsing an HTTP     response in the php_stream_url_wrap_http_ex function in     ext/standard/http_fopen_wrapper.c. This subsequently     results in copying a large string.(CVE-2018-7584)

  - In PHP before 5.5.32, 5.6.x before 5.6.18, and 7.x     before 7.0.3, all of the return values of     stream_get_meta_data can be controlled if the input can     be controlled (e.g., during file uploads). For example,     a '$uri = stream_get_meta_data(fopen($file,     'r'))['uri']' call mishandles the case where $file is     data:text/plainuri=eviluri, -- in other words, metadata     can be set by an attacker.(CVE-2016-10712)

  - The GIF decoding function gdImageCreateFromGifCtx in     gd_gif_in.c in the GD Graphics Library (aka libgd), as     used in PHP before 5.6.31 and 7.x before 7.1.7, does     not zero colorMap arrays before use. A specially     crafted GIF image could use the uninitialized tables to     read ~700 bytes from the top of the stack, potentially     disclosing sensitive information.(CVE-2017-7890)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for php7 provides the following fix: Security issues fixed :

  - CVE-2018-7584: Fixed stack-based buffer under-read while     parsing an HTTPresponse in the     php_stream_url_wrap_http_ex (bsc#1083639). Bug fixes :

  - Fix a memory leak in the pg_escape_bytea function of the     pgsql extension. (bsc#1076970)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has php packages installed that are affected by multiple vulnerabilities:

  - In PHP through 5.6.33, 7.0.x before 7.0.28, 7.1.x through 7.1.14, and 7.2.x through 7.2.2, there is a     stack-based buffer under-read while parsing an HTTP response in the php_stream_url_wrap_http_ex function     in ext/standard/http_fopen_wrapper.c. This subsequently results in copying a large string. (CVE-2018-7584)

  - An issue was discovered in ext/phar/phar_object.c in PHP before 5.6.36, 7.0.x before 7.0.30, 7.1.x before     7.1.17, and 7.2.x before 7.2.5. There is Reflected XSS on the PHAR 403 and 404 error pages via request     data of a request for a .phar file. NOTE: this vulnerability exists because of an incomplete fix for     CVE-2018-5712. (CVE-2018-10547)

  - An issue was discovered in PHP before 5.6.33, 7.0.x before 7.0.27, 7.1.x before 7.1.13, and 7.2.x before     7.2.1. There is Reflected XSS on the PHAR 404 error page via the URI of a request for a .phar file.
    (CVE-2018-5712)

  - An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before     7.3.1. xmlrpc_decode() can allow a hostile XMLRPC server to cause PHP to read memory outside of allocated     areas in base64_decode_xmlrpc in ext/xmlrpc/libxmlrpc/base64.c. (CVE-2019-9024)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has php packages installed that are affected by multiple vulnerabilities:

  - In PHP through 5.6.33, 7.0.x before 7.0.28, 7.1.x through 7.1.14, and 7.2.x through 7.2.2, there is a     stack-based buffer under-read while parsing an HTTP response in the php_stream_url_wrap_http_ex function     in ext/standard/http_fopen_wrapper.c. This subsequently results in copying a large string. (CVE-2018-7584)

  - An issue was discovered in ext/phar/phar_object.c in PHP before 5.6.36, 7.0.x before 7.0.30, 7.1.x before     7.1.17, and 7.2.x before 7.2.5. There is Reflected XSS on the PHAR 403 and 404 error pages via request     data of a request for a .phar file. NOTE: this vulnerability exists because of an incomplete fix for     CVE-2018-5712. (CVE-2018-10547)

  - An issue was discovered in PHP before 5.6.33, 7.0.x before 7.0.27, 7.1.x before 7.1.13, and 7.2.x before     7.2.1. There is Reflected XSS on the PHAR 404 error page via the URI of a request for a .phar file.
    (CVE-2018-5712)

  - An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before     7.3.1. xmlrpc_decode() can allow a hostile XMLRPC server to cause PHP to read memory outside of allocated     areas in base64_decode_xmlrpc in ext/xmlrpc/libxmlrpc/base64.c. (CVE-2019-9024)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

根據其自我報告的版本，遠端主機上安裝的 Tenable SecurityCenter 應用程式版本比 5.7.1 版舊。因此，會受到多個弱點影響。請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼。

根據其標題，遠端網頁伺服器上安裝的 PHP 版本為 7.0.28 之前的 7.0.x 版。因此，會受到一個堆疊緩衝區溢位弱點影響。

根據其標題，遠端網頁伺服器上安裝的 PHP 版本為 7.1.15 之前的 7.1.x 版。因此，會受到一個堆疊緩衝區溢位弱點影響。

根據其標題，遠端網頁伺服器上安裝的 PHP 版本為 7.2.3 之前的 7.2.x 版。因此，會受到一個堆疊緩衝區溢位弱點影響。

剖析 HTTP 回應時，ext/standard/http_fopen_wrapper.c:php_stream_url_wrap_http_ex 函式中的堆疊型緩衝區讀取不足可導致拒絕服務：在 PHP 5.6.33 及之前版本、7.0.28 之前的 7.0.x 版本、7.1.14 及之前的 7.1.x 版本和 7.2.2 及之前的 7.2.x 版本中，在 ext/standard/http_fopen_wrapper.c 的 php_stream_url_wrap_http_ex 函式中剖析 HTTP 回應時，有一個堆疊型緩衝區讀取不足。這進而導致複製一個大型字串。(CVE-2018-7584)

剖析 HTTP 回應時，ext/standard/http_fopen_wrapper.c:php_stream_url_wrap_http_ex 函式中的堆疊型緩衝區讀取不足可導致拒絕服務。在 PHP 5.6.33 及之前版本、7.0.28 之前的 7.0.x 版本、7.1.14 及之前的 7.1.x 版本和 7.2.2 及之前的 7.2.x 版本中，在 ext/standard/http_fopen_wrapper.c 的 php_stream_url_wrap_http_ex 函式中剖析 HTTP 回應時，有一個堆疊型緩衝區讀取不足。這進而導致複製一個大型字串。(CVE-2018-7584)

在廣為使用的開放來源一般用途指令碼語言 PHP 中發現數個弱點：CVE-2018-7584 剖析 HTTP 回應時發生堆疊緩衝區溢位，造成複製大型字和可能的記憶體損毀及/或拒絕服務。CVE-2018-10545 可傾印 FPM 子處理程序允許繞過 opcache 存取控制權限，造成可能的資訊洩漏，其中某位使用者可取得另一位執行 PHP 應用程式的使用者資訊。CVE-2018-10546 無效的位元組序列可在串流篩選器 convert.iconv 中觸發無限迴圈。CVE-2018-10547 CVE-2018-5712 的上一個修正不完整，造成在 PHAR 403 和 404 錯誤頁面中，發生反映式 XSS 形式的其他弱點。CVE-2018-10548 惡意的遠端 LDAP 伺服器可傳送特製的回應，進而造成拒絕服務 (導致應用程式損毀的 NULL 指標解除參照)。CVE-2018-10549 特製的 JPEG 檔案可造成一個超出邊界讀取和堆積緩衝區溢位。針對 Debian 8「Jessie」，這些問題已在 5.6.36+dfsg-0+deb8u1 版本中修正。我們建議您升級 php5 套件。注意：Tenable Network Security 已直接從 DLA 安全性公告擷取前置描述區塊。Tenable 已盡量在不造成其他問題的前提下，嘗試自動清理並將其格式化。

遠端 Redhat Enterprise Linux 7 主機上安裝的套件受到 RHSA-2020: 1112 公告中提及的多個弱點影響。

  - php：PHAR 403 和 404 錯誤頁面上存在反映式 XSS 弱點 (CVE-2018-10547)

  - php：PHAR 404 頁面上存在反映式 XSS (CVE-2018-5712)

  - php：剖析 HTTP 回應時，http_fopen_wrapper.c 的 php_stream_url_wrap_http_ex() 中存在堆疊型緩衝區讀取不足 (CVE-2018-7584)

  - php：ext/xmlrpc/libxmlrpc/base64.c 的 base64_decode_xmlrpc 中存在越界讀取 (CVE-2019-9024)

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

The remote host is running a version of macOS / Mac OS X that is 10.13.x prior to 10.13.5. It is, therefore, affected by multiple vulnerabilities.

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
108849	Amazon Linux AMI : php70 / php56 (ALAS-2018-988)	Nessus	Amazon Linux Local Security Checks	2018/4/6	2024/11/20	critical
110697	Debian DLA-1397-1：php5 安全更新	Nessus	Debian Local Security Checks	2018/6/27	2024/9/16	critical
180748	Oracle Linux 7 : php (ELSA-2020-1112)	Nessus	Oracle Linux Local Security Checks	2023/9/7	2024/10/23	critical
109495	EulerOS 2.0 SP2 : php (EulerOS-SA-2018-1097)	Nessus	Huawei Local Security Checks	2018/5/2	2024/10/15	critical
120017	SUSE SLES12 Security Update : php7 (SUSE-SU-2018:0646-1)	Nessus	SuSE Local Security Checks	2019/1/2	2024/7/11	critical
143917	NewStart CGSL CORE 5.04 / MAIN 5.04 : php Multiple Vulnerabilities (NS-SA-2020-0059)	Nessus	NewStart CGSL Local Security Checks	2020/12/9	2020/12/10	critical
143988	NewStart CGSL CORE 5.05 / MAIN 5.05 : php Multiple Vulnerabilities (NS-SA-2020-0090)	Nessus	NewStart CGSL Local Security Checks	2020/12/9	2020/12/10	critical
117672	Tenable SecurityCenter < 5.7.1 Multiple Vulnerabilities (TNS-2018-12)	Nessus	Misc.	2018/9/24	2020/10/9	critical
107217	PHP 7.0.x < 7.0.28 堆疊緩衝區溢位	Nessus	CGI abuses	2018/3/8	2025/5/26	critical
107218	PHP 7.1.x < 7.1.15 堆疊緩衝區溢位	Nessus	CGI abuses	2018/3/8	2025/5/26	critical
107219	PHP 7.2.x < 7.2.3 堆疊緩衝區溢位	Nessus	CGI abuses	2018/3/8	2025/5/26	critical
108691	Amazon Linux AMI : php71 (ALAS-2018-982)	Nessus	Amazon Linux Local Security Checks	2018/3/29	2024/12/3	critical
108849	Amazon Linux AMI : php70 / php56 (ALAS-2018-988)	Nessus	Amazon Linux Local Security Checks	2018/4/6	2024/11/20	critical
110697	Debian DLA-1397-1：php5 安全性更新	Nessus	Debian Local Security Checks	2018/6/27	2024/9/16	critical
135040	RHEL 7：php (RHSA-2020: 1112)	Nessus	Red Hat Local Security Checks	2020/3/31	2024/11/8	critical
700516	macOS 10.13.x < 10.13.5 Multiple Vulnerabilities	Nessus Network Monitor	Operating System Detection	2019/4/10	2019/4/10	critical

检测

插件搜索

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical