根据其自我报告的版本，远程主机上安装的 Tenable SecurityCenter 应用程序版本低于 5.7.1。因而会受到多个漏洞的影响。请注意，Nessus 并未测试这些问题，而是只依赖于应用程序自我报告的版本号。

根据其标题，远程 web 服务器上运行的 PHP 7.0.x 版本低于 7.0.28。因而会受到堆栈缓冲区溢出漏洞的影响。

根据其标题，远程 web 服务器上运行的 PHP 7.1.x 版本低于 7.1.15。因而会受到堆栈缓冲区溢出漏洞的影响。

根据其标题，远程 web 服务器上运行的 PHP 7.2.x 版本低于 7.2.3。因而会受到堆栈缓冲区溢出漏洞的影响。

解析 HTTP 回应时，ext/standard/http_fopen_wrapper.c:php_stream_url_wrap_http_ex 函数中基于堆栈的缓冲区读取不足可导致拒绝服务：在 PHP 5.6.33 及之前版本、7.0.28 之前的 7.0.x 版本、7.1.14 及之前的 7.1.x 版本和 7.2.2 及之前的 7.2.x 版本中，在 ext/standard/http_fopen_wrapper.c 的 php_stream_url_wrap_http_ex 函数中解析 HTTP 响应时，存在基于堆栈的缓冲区读取不足。这进而导致复制一个大型字符串。(CVE-2018-7584)

解析 HTTP 响应时，ext/standard/http_fopen_wrapper.c:php_stream_url_wrap_http_ex 函数中的基于堆栈的缓冲区读取不足可导致拒绝服务。在 PHP 5.6.33 及之前版本、7.0.28 之前的 7.0.x 版本、7.1.14 及之前的 7.1.x 版本和 7.2.2 及之前的 7.2.x 版本中，在 ext/standard/http_fopen_wrapper.c 的 php_stream_url_wrap_http_ex 函数中解析 HTTP 响应时，存在基于堆栈的缓冲区读取不足。这进而导致复制一个大型字符串。(CVE-2018-7584)

在广泛使用的开源通用脚本语言 PHP 中发现数个漏洞。CVE-2018-7584 解析 HTTP 响应时存在堆栈缓冲区溢出，可能会造成复制大型字符串，并可能造成内存损坏和/或拒绝服务 CVE-2018-10545 可转储的 FPM 子进程允许绕过 opcache 访问权限控制，可能会造成信息泄露，即一个用户可以获取其他用户运行的 PHP 应用程序的相关信息 CVE-2018-10546 某种无效的字节序列可能会触发流筛选器 convert.iconv 中的无限循环 CVE-2018-10547 CVE-2018-5712 之前的一个补丁不完整，造成 PHAR 403 和 404 错误页面中存在反射型 XSS 形式的其他漏洞 CVE-2018-10548 恶意远程 LDAP 服务器发送的特制响应可能会造成拒绝服务（空指针取消引用导致应用程序崩溃） CVE-2018-10549 特制的 JPEG 文件可能会造成越界读取和堆缓冲区溢出 对于 Debian 8“Jessie”，这些问题已在 5.6.36+dfsg-0+deb8u1 版本中修复。我们建议您升级 php5 程序包。注意：Tenable Network Security 已直接从 DLA 安全公告中提取上述描述块。Tenable 已尝试在不引入其他问题的情况下，尽可能进行自动整理和排版。

远程 Redhat Enterprise Linux 7 主机上安装的程序包受到 RHSA-2020: 1112 公告中提及的多个漏洞的影响。

  - php：PHAR 403 和 404 错误页面中存在反射型 XSS 漏洞 (CVE-2018-10547)

  - php：PHAR 404 页面中存在反射型 XSS (CVE-2018-5712)

  - php：解析 HTTP 响应时，http_fopen_wrapper.c 的 php_stream_url_wrap_http_ex() 中存在基于堆栈的缓冲区读取不足。(CVE-2018-7584)

  - php：ext/xmlrpc/libxmlrpc/base64.c 的 base64_decode_xmlrpc 中存在越界读取 (CVE-2019-9024)

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1112 advisory.

  - An issue was discovered in ext/phar/phar_object.c in PHP before 5.6.36, 7.0.x before 7.0.30, 7.1.x before     7.1.17, and 7.2.x before 7.2.5. There is Reflected XSS on the PHAR 403 and 404 error pages via request     data of a request for a .phar file. NOTE: this vulnerability exists because of an incomplete fix for     CVE-2018-5712. (CVE-2018-10547)

  - An issue was discovered in PHP before 5.6.33, 7.0.x before 7.0.27, 7.1.x before 7.1.13, and 7.2.x before     7.2.1. There is Reflected XSS on the PHAR 404 error page via the URI of a request for a .phar file.
    (CVE-2018-5712)

  - In PHP through 5.6.33, 7.0.x before 7.0.28, 7.1.x through 7.1.14, and 7.2.x through 7.2.2, there is a     stack-based buffer under-read while parsing an HTTP response in the php_stream_url_wrap_http_ex function     in ext/standard/http_fopen_wrapper.c. This subsequently results in copying a large string. (CVE-2018-7584)

  - An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before     7.3.1. xmlrpc_decode() can allow a hostile XMLRPC server to cause PHP to read memory outside of allocated     areas in base64_decode_xmlrpc in ext/xmlrpc/libxmlrpc/base64.c. (CVE-2019-9024)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

* php: Reflected XSS on PHAR 404 page * php: Stack-based buffer under-read in php_stream_url_wrap_http_ex() in http_fopen_wrapper.c when parsing HTTP response * php: Reflected XSS vulnerability on PHAR 403 and 404 error pages * php: Out-of-bounds read in base64_decode_xmlrpc in ext/xmlrpc/libxmlrpc/base64.c

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:2519 advisory.

    PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

    The following packages have been upgraded to a later upstream version: rh-php71-php (7.1.30). (BZ#1631672)

    Security Fix(es):

    * gd: Unsigned integer underflow _gdContributionsAlloc() (CVE-2016-10166)

    * php: Out of bounds access in php_pcre.c:php_pcre_replace_impl() (CVE-2017-9118)

    * php: Integer overflow in mysqli_api.c:mysqli_real_escape_string() (CVE-2017-9120)

    * php: Heap use after free in ext/standard/var_unserializer.re (CVE-2017-12932)

    * php: Reflected XSS in .phar 404 page (CVE-2018-5712)

    * php: Stack-based buffer under-read in php_stream_url_wrap_http_ex() in http_fopen_wrapper.c when parsing     HTTP response (CVE-2018-7584)

    * php: Infinite loop in ext/iconv/iconv.c when using stream filter with convert.incov on invalid sequence     leads to denial-of-service (CVE-2018-10546)

    * php: Reflected XSS vulnerability on PHAR 403 and 404 error pages (CVE-2018-10547)

    * php: NULL pointer dereference due to mishandling of ldap_get_dn return value allows DoS via malicious     LDAP server reply (CVE-2018-10548)

    * php: Mishandled http_header_value in an atoi() call in http_fopen_wrapper.c (CVE-2018-14884)

    * php: Cross-site scripting (XSS) flaw in Apache2 component via body of 'Transfer-Encoding: chunked'     request (CVE-2018-17082)

    * gd: Heap based buffer overflow in gdImageColorMatch() in gd_color_match.c (CVE-2019-6977)

    * php: Invalid memory access in function xmlrpc_decode() (CVE-2019-9020)

    * php: File rename across filesystems may allow unwanted access during processing (CVE-2019-9637)

    * php: Uninitialized read in exif_process_IFD_in_MAKERNOTE (CVE-2019-9638)

    * php: Uninitialized read in exif_process_IFD_in_MAKERNOTE (CVE-2019-9639)

    * php: Invalid read in exif_process_SOFn() (CVE-2019-9640)

    * php: Out-of-bounds read due to integer overflow in iconv_mime_decode_headers() (CVE-2019-11039)

    * php: Buffer over-read in exif_read_data() (CVE-2019-11040)

    * php: Out-of-bound read in timelib_meridian() (CVE-2017-16642)

    * gd: Infinite loop in gdImageCreateFromGifCtx() in gd_gif_in.c (CVE-2018-5711)

    * php: Dumpable FPM child processes allow bypassing opcache access controls (CVE-2018-10545)

    * php: Out-of-bounds read in ext/exif/exif.c:exif_read_data() when reading crafted JPEG data     (CVE-2018-10549)

    * php: exif: Buffer over-read in exif_process_IFD_in_MAKERNOTE() (CVE-2018-14851)

    * php: Buffer over-read in PHAR reading functions (CVE-2018-20783)

    * php: Heap-based buffer over-read in PHAR reading functions (CVE-2019-9021)

    * php: memcpy with negative length via crafted DNS response (CVE-2019-9022)

    * php: Heap-based buffer over-read in mbstring regular expression functions (CVE-2019-9023)

    * php: Out-of-bounds read in base64_decode_xmlrpc in ext/xmlrpc/libxmlrpc/base64.c (CVE-2019-9024)

    * php: Heap buffer overflow in function exif_process_IFD_TAG() (CVE-2019-11034)

    * php: Heap buffer overflow in function exif_iif_add_value() (CVE-2019-11035)

    * php: Buffer over-read in exif_process_IFD_TAG() leading to information disclosure (CVE-2019-11036)

    * gd: Information disclosure in gdImageCreateFromXbm() (CVE-2019-11038)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

**PHP version 7.1.15** (01 Mar 2018)

**Apache2Handler:**

  - Fixed bug php#75882 (a simple way for segfaults in     threadsafe php just with configuration). (Anatol)

**Date:**

  - Fixed bug php#75857 (Timezone gets truncated when     formatted). (carusogabriel)

  - Fixed bug php#75928 (Argument 2 for     `DateTimeZone::listIdentifiers()` should accept `null`).
    (Pedro Lacerda)

  - Fixed bug php#68406 (calling var_dump on a DateTimeZone     object modifies it). (jhdxr)

**PGSQL:**

  - Fixed php#75838 (Memory leak in pg_escape_bytea()).
    (ard_1 at mail dot ru)

**ODBC:**

  - Fixed bug php#73725 (Unable to retrieve value of     varchar(max) type). (Anatol)

**LDAP:**

  - Fixed bug php#49876 (Fix LDAP path lookup on 64-bit     distros). (dzuelke)

**libxml2:**

  - Fixed bug php#75871 (use pkg-config where available).
    (pmmaga)

**Phar:**

  - Fixed bug php#65414 (deal with leading slash when adding     files correctly). (bishopb)

**SPL:**

  - Fixed bug php#74519 (strange behavior of     AppendIterator). (jhdxr)

**Standard:**

  - Fixed bug php#75916 (DNS_CAA record results contain     garbage). (Mike, Philip Sharp)

  - Fixed bug php#75981 (stack-buffer-overflow while parsing     HTTP response). (Stas)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New php packages are available for Slackware 14.0, 14.1, 14.2, and
-current to fix a security issue.

This update for php5 fixes the following issues: Security issues fixed :

  - CVE-2018-7584: Fixed stack-based buffer under-read while     parsing an HTTPresponse in the     php_stream_url_wrap_http_ex (bsc#1083639).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is running a version of macOS / Mac OS X that is 10.13.x prior to 10.13.5. It is, therefore, affected by multiple vulnerabilities.

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
117672	Tenable SecurityCenter < 5.7.1 Multiple Vulnerabilities (TNS-2018-12)	Nessus	Misc.	2018/9/24	2020/10/9	critical
107217	PHP 7.0.x < 7.0.28 堆栈缓冲区溢出	Nessus	CGI abuses	2018/3/8	2025/5/26	critical
107218	PHP 7.1.x < 7.1.15 堆栈缓冲区溢出	Nessus	CGI abuses	2018/3/8	2025/5/26	critical
107219	PHP 7.2.x < 7.2.3 堆栈缓冲区溢出	Nessus	CGI abuses	2018/3/8	2025/5/26	critical
108691	Amazon Linux AMI : php71 (ALAS-2018-982)	Nessus	Amazon Linux Local Security Checks	2018/3/29	2024/12/3	critical
108849	Amazon Linux AMI : php70 / php56 (ALAS-2018-988)	Nessus	Amazon Linux Local Security Checks	2018/4/6	2024/11/20	critical
110697	Debian DLA-1397-1：php5 安全更新	Nessus	Debian Local Security Checks	2018/6/27	2024/9/16	critical
135040	RHEL 7：php (RHSA-2020: 1112)	Nessus	Red Hat Local Security Checks	2020/3/31	2024/11/8	critical
135338	CentOS 7 : php (RHSA-2020:1112)	Nessus	CentOS Local Security Checks	2020/4/10	2024/10/9	critical
135827	Scientific Linux Security Update : php on SL7.x x86_64 (20200407)	Nessus	Scientific Linux Local Security Checks	2020/4/21	2024/3/15	critical
194152	RHEL 7 : rh-php71-php (RHSA-2019:2519)	Nessus	Red Hat Local Security Checks	2024/4/28	2024/11/6	critical
107172	Fedora 27 : php (2018-a89ccf7133)	Nessus	Fedora Local Security Checks	2018/3/7	2021/1/6	critical
107234	Slackware 14.0 / 14.1 / 14.2 / current : php (SSA:2018-067-02)	Nessus	Slackware Local Security Checks	2018/3/9	2019/4/5	critical
107282	Fedora 26 : php (2018-e8bc8d2784)	Nessus	Fedora Local Security Checks	2018/3/12	2021/1/6	critical
120018	SUSE SLES12 Security Update : php5 (SUSE-SU-2018:0717-1)	Nessus	SuSE Local Security Checks	2019/1/2	2024/7/11	critical
700516	macOS 10.13.x < 10.13.5 Multiple Vulnerabilities	Nessus Network Monitor	Operating System Detection	2019/4/10	2019/4/10	critical

检测

插件搜索

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical