This update for php7 fixes the following issues :

Security issues fixed :

CVE-2019-9637: Fixed improper implementation of rename function and multiple invalid memory access in EXIF extension (bsc#1128892).

CVE-2019-9675: Fixed improper implementation of rename function and multiple invalid memory access in EXIF extension (bsc#1128886).

CVE-2019-9638: Fixed improper implementation of rename function and multiple invalid memory access in EXIF extension ((bsc#1128889).

CVE-2019-9639: Fixed improper implementation of rename function and multiple invalid memory access in EXIF extension (bsc#1128887).

CVE-2019-9640: Fixed improper implementation of rename function and multiple invalid memory access in EXIF extension (bsc#1128883).

CVE-2019-9022: Fixed a vulnerability which could allow a hostile DNS server to make PHP misuse memcpy (bsc#1126827).

CVE-2019-9024: Fixed a vulnerability in xmlrpc_decode function which could allow to a hostile XMLRPC server to cause memory read outside the allocated areas (bsc#1126821).

CVE-2019-9020: Fixed a heap out of bounds in xmlrpc_decode function (bsc#1126711).

CVE-2018-20783: Fixed a buffer over-read in PHAR reading functions which could allow an attacker to read allocated and unallocated memory when parsing a phar file (bsc#1127122).

CVE-2019-9021: Fixed a heap buffer-based buffer over-read in PHAR reading functions which could allow an attacker to read allocated and unallocated memory when parsing a phar file (bsc#1126713).

CVE-2019-9023: Fixed multiple heap-based buffer over-read instances in mbstring regular expression functions (bsc#1126823).

CVE-2019-9641: Fixed multiple invalid memory access in EXIF extension and improved insecure implementation of rename function (bsc#1128722).

CVE-2018-19935: Fixed a Denial of Service in php_imap.c which could be triggered via an empty string in the message argument to imap_mail (bsc#1118832).

CVE-2019-11034: Fixed a heap-buffer overflow in php_ifd_get32si() (bsc#1132838).

CVE-2019-11035: Fixed a heap-buffer overflow in exif_iif_add_value() (bsc#1132837).

CVE-2019-11036: Fixed buffer over-read in exif_process_IFD_TAG function leading to information disclosure (bsc#1134322).

Other issue addressed: Deleted README.default_socket_timeout which is not needed anymore (bsc#1129032).

Enabled php7 testsuite (bsc#1119396).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A read past allocated buffer vulnerability and two heap-buffer overflow vulnerabilites were discovered in the PHP5 programming language within the Exif image module.

For Debian 8 'Jessie', these problems have been fixed in version 5.6.40+dfsg-0+deb8u3.

We recommend that you upgrade your php5 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for php7 fixes the following issues :

Security issues fixed :

  - CVE-2019-11034: Fixed a heap-buffer overflow in     php_ifd_get32si() (bsc#1132838).

  - CVE-2019-11035: Fixed a heap-buffer overflow in     exif_iif_add_value() (bsc#1132837).

  - CVE-2019-11036: Fixed buffer over-read in     exif_process_IFD_TAG function leading to information     disclosure (bsc#1134322).

This update was imported from the SUSE:SLE-12:Update update project.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1624 advisory.

    PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

    The following packages have been upgraded to a later upstream version: php (7.2.24). (BZ#1726981)

    Security Fix(es):

    * php: Invalid memory access in function xmlrpc_decode() (CVE-2019-9020)

    * php: File rename across filesystems may allow unwanted access during processing (CVE-2019-9637)

    * php: Uninitialized read in exif_process_IFD_in_MAKERNOTE (CVE-2019-9638)

    * php: Uninitialized read in exif_process_IFD_in_MAKERNOTE (CVE-2019-9639)

    * php: Invalid read in exif_process_SOFn() (CVE-2019-9640)

    * php: Out-of-bounds read due to integer overflow in iconv_mime_decode_headers() (CVE-2019-11039)

    * php: Buffer over-read in exif_read_data() (CVE-2019-11040)

    * php: Buffer over-read in PHAR reading functions (CVE-2018-20783)

    * php: Heap-based buffer over-read in PHAR reading functions (CVE-2019-9021)

    * php: memcpy with negative length via crafted DNS response (CVE-2019-9022)

    * php: Heap-based buffer over-read in mbstring regular expression functions (CVE-2019-9023)

    * php: Out-of-bounds read in base64_decode_xmlrpc in ext/xmlrpc/libxmlrpc/base64.c (CVE-2019-9024)

    * php: Heap buffer overflow in function exif_process_IFD_TAG() (CVE-2019-11034)

    * php: Heap buffer overflow in function exif_iif_add_value() (CVE-2019-11035)

    * php: Buffer over-read in exif_process_IFD_TAG() leading to information disclosure (CVE-2019-11036)

    * php: Heap buffer over-read in exif_scan_thumbnail() (CVE-2019-11041)

    * php: Heap buffer over-read in exif_process_user_comment() (CVE-2019-11042)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.2 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-1624 advisory.

  - An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before     7.3.1. xmlrpc_decode() can allow a hostile XMLRPC server to cause PHP to read memory outside of allocated     areas in base64_decode_xmlrpc in ext/xmlrpc/libxmlrpc/base64.c. (CVE-2019-9024)

  - Function iconv_mime_decode_headers() in PHP versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and 7.3.x     below 7.3.6 may perform out-of-buffer read due to integer overflow when parsing MIME headers. This may     lead to information disclosure or crash. (CVE-2019-11039)

  - When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in     PHP versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and 7.3.x below 7.3.6 it is possible to supply it with     data what will cause it to read past the allocated buffer. This may lead to information disclosure or     crash. (CVE-2019-11040)

  - When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in     PHP versions 7.1.x below 7.1.31, 7.2.x below 7.2.21 and 7.3.x below 7.3.8 it is possible to supply it with     data what will cause it to read past the allocated buffer. This may lead to information disclosure or     crash. (CVE-2019-11041, CVE-2019-11042)

  - In PHP before 5.6.39, 7.x before 7.0.33, 7.1.x before 7.1.25, and 7.2.x before 7.2.13, a buffer over-read     in PHAR reading functions may allow an attacker to read allocated or unallocated memory past the actual     data when trying to parse a .phar file. This is related to phar_parse_pharfile in ext/phar/phar.c.
    (CVE-2018-20783)

  - An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before     7.3.1. Invalid input to the function xmlrpc_decode() can lead to an invalid memory access (heap out of     bounds read or read after free). This is related to xml_elem_parse_buf in     ext/xmlrpc/libxmlrpc/xml_element.c. (CVE-2019-9020)

  - An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before     7.3.1. A heap-based buffer over-read in PHAR reading functions in the PHAR extension may allow an attacker     to read allocated or unallocated memory past the actual data when trying to parse the file name, a     different vulnerability than CVE-2018-20783. This is related to phar_detect_phar_fname_ext in     ext/phar/phar.c. (CVE-2019-9021)

  - An issue was discovered in PHP 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.2.
    dns_get_record misparses a DNS response, which can allow a hostile DNS server to cause PHP to misuse     memcpy, leading to read operations going past the buffer allocated for DNS data. This affects php_parserr     in ext/standard/dns.c for DNS_CAA and DNS_ANY queries. (CVE-2019-9022)

  - An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before     7.3.1. A number of heap-based buffer over-read instances are present in mbstring regular expression     functions when supplied with invalid multibyte data. These occur in ext/mbstring/oniguruma/regcomp.c,     ext/mbstring/oniguruma/regexec.c, ext/mbstring/oniguruma/regparse.c, ext/mbstring/oniguruma/enc/unicode.c,     and ext/mbstring/oniguruma/src/utf32_be.c when a multibyte regular expression pattern contains invalid     multibyte sequences. (CVE-2019-9023)

  - An issue was discovered in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. Due to the way     rename() across filesystems is implemented, it is possible that file being renamed is briefly available     with wrong permissions while the rename is ongoing, thus enabling unauthorized users to access the data.
    (CVE-2019-9637)

  - An issue was discovered in the EXIF component in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before     7.3.3. There is an uninitialized read in exif_process_IFD_in_MAKERNOTE because of mishandling the data_len     variable. (CVE-2019-9639)

  - When processing certain files, PHP EXIF extension in versions 7.1.x below 7.1.28, 7.2.x below 7.2.17 and     7.3.x below 7.3.4 can be caused to read past allocated buffer in exif_process_IFD_TAG function. This may     lead to information disclosure or crash. (CVE-2019-11034)

  - When processing certain files, PHP EXIF extension in versions 7.1.x below 7.1.28, 7.2.x below 7.2.17 and     7.3.x below 7.3.4 can be caused to read past allocated buffer in exif_iif_add_value function. This may     lead to information disclosure or crash. (CVE-2019-11035)

  - An issue was discovered in the EXIF component in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before     7.3.3. There is an uninitialized read in exif_process_IFD_in_MAKERNOTE because of mishandling the     maker_note->offset relationship to value_len. (CVE-2019-9638)

  - An issue was discovered in the EXIF component in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before     7.3.3. There is an Invalid Read in exif_process_SOFn. (CVE-2019-9640)

  - When processing certain files, PHP EXIF extension in versions 7.1.x below 7.1.29, 7.2.x below 7.2.18 and     7.3.x below 7.3.5 can be caused to read past allocated buffer in exif_process_IFD_TAG function. This may     lead to information disclosure or crash. (CVE-2019-11036)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2020-845:01 advisory.

    php: Invalid memory access in function xmlrpc_decode() (CVE-2019-9020)         php: File rename across filesystems may allow unwanted access during     processing (CVE-2019-9637)         php: Uninitialized read in exif_process_IFD_in_MAKERNOTE (CVE-2019-9638)         php: Uninitialized read in exif_process_IFD_in_MAKERNOTE (CVE-2019-9639)         php: Invalid read in exif_process_SOFn() (CVE-2019-9640)         php: Out-of-bounds read due to integer overflow in     iconv_mime_decode_headers() (CVE-2019-11039)         php: Buffer over-read in exif_read_data() (CVE-2019-11040)         php: Buffer over-read in PHAR reading functions (CVE-2018-20783)         php: Heap-based buffer over-read in PHAR reading functions (CVE-2019-9021)         php: memcpy with negative length via crafted DNS response (CVE-2019-9022)         php: Heap-based buffer over-read in mbstring regular expression functions     (CVE-2019-9023)         php: Out-of-bounds read in base64_decode_xmlrpc in     ext/xmlrpc/libxmlrpc/base64.c (CVE-2019-9024)         php: Heap buffer overflow in function exif_process_IFD_TAG()     (CVE-2019-11034)         php: Heap buffer overflow in function exif_iif_add_value() (CVE-2019-11035)         php: Buffer over-read in exif_process_IFD_TAG() leading to information     disclosure (CVE-2019-11036)         php: Heap buffer over-read in exif_scan_thumbnail() (CVE-2019-11041)         php: Heap buffer over-read in exif_process_user_comment() (CVE-2019-11042)     CVE(s):
    CVE-2018-20783     CVE-2019-9020     CVE-2019-9021     CVE-2019-9022     CVE-2019-9023     CVE-2019-9024     CVE-2019-9637     CVE-2019-9638     CVE-2019-9639     CVE-2019-9640     CVE-2019-11034     CVE-2019-11035     CVE-2019-11036     CVE-2019-11039     CVE-2019-11040     CVE-2019-11041     CVE-2019-11042     Additional info:https://access.redhat.com/errata/RHSA-2020:1624https://cve.mitre.org/cgi-     bin/cvename.cgi?name=CVE-2018-20783https://cve.mitre.org/cgi-     bin/cvename.cgi?name=CVE-2019-9020https://cve.mitre.org/cgi-     bin/cvename.cgi?name=CVE-2019-9021https://cve.mitre.org/cgi-     bin/cvename.cgi?name=CVE-2019-9022https://cve.mitre.org/cgi-     bin/cvename.cgi?name=CVE-2019-9023https://cve.mitre.org/cgi-     bin/cvename.cgi?name=CVE-2019-9024https://cve.mitre.org/cgi-     bin/cvename.cgi?name=CVE-2019-9637https://cve.mitre.org/cgi-     bin/cvename.cgi?name=CVE-2019-9638https://cve.mitre.org/cgi-     bin/cvename.cgi?name=CVE-2019-9639https://cve.mitre.org/cgi-     bin/cvename.cgi?name=CVE-2019-9640https://cve.mitre.org/cgi-     bin/cvename.cgi?name=CVE-2019-11034https://cve.mitre.org/cgi-     bin/cvename.cgi?name=CVE-2019-11035https://cve.mitre.org/cgi-     bin/cvename.cgi?name=CVE-2019-11036https://cve.mitre.org/cgi-     bin/cvename.cgi?name=CVE-2019-11039https://cve.mitre.org/cgi-     bin/cvename.cgi?name=CVE-2019-11040https://cve.mitre.org/cgi-     bin/cvename.cgi?name=CVE-2019-11041https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11042     Modularity name: php     Stream name: 7.2

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

**PHP version 7.2.18** (02 May 2019)

**CLI:**

  - Fixed bug php#77794 (Incorrect Date header format in     built-in server). (kelunik)

**EXIF**

  - Fixed bug php#77950 (Heap-buffer-overflow in _estrndup     via exif_process_IFD_TAG). (CVE-2019-11036) (Stas)

**Interbase:**

  - Fixed bug php#72175 (Impossibility of creating multiple     connections to Interbase with php 7.x). (Nikita)

**Intl:**

  - Fixed bug php#77895 (IntlDateFormatter::create fails in     strict mode if $locale = null). (Nikita)

**PCRE:**

  - Fixed bug php#77827 (preg_match does not ignore \r in     regex flags). (requinix, cmb)

**PDO:**

  - Fixed bug php#77849 (Disable cloning of PDO     handle/connection objects). (camporter)

**phpdbg:**

  - Fixed bug php#76801 (too many open files). (alekitto)

  - Fixed bug php#77800 (phpdbg segfaults on listing some     conditional breakpoints). (krakjoe)

  - Fixed bug php#77805 (phpdbg build fails when readline is     shared). (krakjoe) **Reflection:**

  - Fixed bug php#77772 (ReflectionClass::getMethods(null)     doesn't work). (Nikita)

  - Fixed bug php#77882 (Different behavior: always calls     destructor). (Nikita)

**Standard:**

  - Fixed bug php#77680 (recursive mkdir on ftp stream     wrapper is incorrect). (Vlad Temian)

  - Fixed bug php#77844 (Crash due to NULL pointer in     parse_ini_string with INI_SCANNER_TYPED). (Nikita)

  - Fixed bug php#77853 (Inconsistent substr_compare     behaviour with empty haystack). (Nikita)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

USN-3566-1 fixed several vulnerabilities in PHP. This update provides the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM.

It was discovered that PHP incorrectly handled certain files. An attacker could possibly use this issue to access sensitive information. (CVE-2018-20783)

It was discovered that PHP incorrectly handled certain files. An attacker could possibly use this issue to access sensitive information or possibly cause a crash, resulting in a denial of service.
(CVE-2019-11036)

It was discovered that PHP incorrectly handled memory when unserializing certain data. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 12.04 ESM.
(CVE-2017-12933)

It was discovered that PHP incorrectly handled locale length. A remote attacker could possibly use this issue to cause PHP to crash, resulting in a denial of service. This issue only affected Ubuntu 12.04 ESM. (CVE-2017-11362)

It was discovered that PHP incorrectly handled certain stream metadata. A remote attacker could possibly use this issue to set arbitrary metadata. This issue only affected Ubuntu 12.04 ESM.
(CVE-2016-10712).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:4067-1 advisory.

    - Version update to 7.2.34 [jsc#SLE-23639]

    - CVE-2022-37454: Fixed SHA-3 buffer overflow (bsc#1204577).
    - Fix integer overflow in PHP_SHA3##bits (bsc#1204577#c26).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:3299 advisory.

    PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

    The following packages have been upgraded to a later upstream version: rh-php72-php (7.2.24). (BZ#1766603)

    Security Fix(es):

    * php: underflow in env_path_info in fpm_main.c (CVE-2019-11043)

    * gd: Unsigned integer underflow _gdContributionsAlloc() (CVE-2016-10166)

    * gd: Heap based buffer overflow in gdImageColorMatch() in gd_color_match.c (CVE-2019-6977)

    * php: Invalid memory access in function xmlrpc_decode() (CVE-2019-9020)

    * php: File rename across filesystems may allow unwanted access during processing (CVE-2019-9637)

    * php: Uninitialized read in exif_process_IFD_in_MAKERNOTE (CVE-2019-9638)

    * php: Uninitialized read in exif_process_IFD_in_MAKERNOTE (CVE-2019-9639)

    * php: Invalid read in exif_process_SOFn() (CVE-2019-9640)

    * php: Out-of-bounds read due to integer overflow in iconv_mime_decode_headers() (CVE-2019-11039)

    * php: Buffer over-read in exif_read_data() (CVE-2019-11040)

    * php: Buffer over-read in PHAR reading functions (CVE-2018-20783)

    * php: Heap-based buffer over-read in PHAR reading functions (CVE-2019-9021)

    * php: memcpy with negative length via crafted DNS response (CVE-2019-9022)

    * php: Heap-based buffer over-read in mbstring regular expression functions (CVE-2019-9023)

    * php: Out-of-bounds read in base64_decode_xmlrpc in ext/xmlrpc/libxmlrpc/base64.c (CVE-2019-9024)

    * php: Heap buffer overflow in function exif_process_IFD_TAG() (CVE-2019-11034)

    * php: Heap buffer overflow in function exif_iif_add_value() (CVE-2019-11035)

    * php: Buffer over-read in exif_process_IFD_TAG() leading to information disclosure (CVE-2019-11036)

    * gd: Information disclosure in gdImageCreateFromXbm() (CVE-2019-11038)

    * php: heap buffer over-read in exif_scan_thumbnail() (CVE-2019-11041)

    * php: heap buffer over-read in exif_process_user_comment() (CVE-2019-11042)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the version of the php packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - When processing certain files, PHP EXIF extension in     versions 7.1.x below 7.1.29, 7.2.x below 7.2.18 and     7.3.x below 7.3.5 can be caused to read past allocated     buffer in exif_process_IFD_TAG function. This may lead     to information disclosure or crash.(CVE-2019-11036)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its banner, the version of PHP running on the remote web server is 7.2.x prior to 7.2.18. It is, therefore, affected by a heap-based buffer over-read condition within _estrndup of the exif_process_IFD_TAG in the exif.c script.
An unauthenticated, remote attacker can exploit this, to cause a denial of service condition or the execution of arbitrary code.

This update for php7 fixes the following issues :

Security issues fixed :

CVE-2019-11034: Fixed a heap-buffer overflow in php_ifd_get32si() (bsc#1132838).

CVE-2019-11035: Fixed a heap-buffer overflow in exif_iif_add_value() (bsc#1132837).

CVE-2019-11036: Fixed buffer over-read in exif_process_IFD_TAG function leading to information disclosure (bsc#1134322).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for php5 fixes the following issues :

Security issues fixed :

  - CVE-2019-11034: Fixed a heap-buffer overflow in     php_ifd_get32si() (bsc#1132838).

  - CVE-2019-11035: Fixed a heap-buffer overflow in     exif_iif_add_value() (bsc#1132837).

  - CVE-2019-9637: Fixed a potential information disclosure     in rename() (bsc#1128892).

  - CVE-2019-9675: Fixed a potential buffer overflow in     phar_tar_writeheaders_int() (bsc#1128886).

  - CVE-2019-9638: Fixed an uninitialized read in     exif_process_IFD_in_MAKERNOTE() related to value_len     (bsc#1128889).

  - CVE-2019-9639: Fixed an uninitialized read in     exif_process_IFD_in_MAKERNOTE() related to data_len     (bsc#1128887).

  - CVE-2019-9640: Fixed an invalid Read in     exif_process_SOFn() (bsc#1128883).

  - CVE-2019-11036: Fixed buffer over-read in     exif_process_IFD_TAG function leading to information     disclosure (bsc#1134322).

This update was imported from the SUSE:SLE-12:Update update project.

When processing certain files, PHP EXIF extension in versions 7.1.x below 7.1.28, 7.2.x below 7.2.17 and 7.3.x below 7.3.4 can be caused to read past allocated buffer in exif_iif_add_value function. This may lead to information disclosure or crash. (CVE-2019-11035)

When processing certain files, PHP EXIF extension in versions 7.1.x below 7.1.28, 7.2.x below 7.2.17 and 7.3.x below 7.3.4 can be caused to read past allocated buffer in exif_process_IFD_TAG function. This may lead to information disclosure or crash. (CVE-2019-11034)

When processing certain files, PHP EXIF extension in versions 7.1.x below 7.1.29, 7.2.x below 7.2.18 and 7.3.x below 7.3.5 can be caused to read past allocated buffer in exif_process_IFD_TAG function. This may lead to information disclosure or crash. (CVE-2019-11036)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:2519 advisory.

    PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

    The following packages have been upgraded to a later upstream version: rh-php71-php (7.1.30). (BZ#1631672)

    Security Fix(es):

    * gd: Unsigned integer underflow _gdContributionsAlloc() (CVE-2016-10166)

    * php: Out of bounds access in php_pcre.c:php_pcre_replace_impl() (CVE-2017-9118)

    * php: Integer overflow in mysqli_api.c:mysqli_real_escape_string() (CVE-2017-9120)

    * php: Heap use after free in ext/standard/var_unserializer.re (CVE-2017-12932)

    * php: Reflected XSS in .phar 404 page (CVE-2018-5712)

    * php: Stack-based buffer under-read in php_stream_url_wrap_http_ex() in http_fopen_wrapper.c when parsing     HTTP response (CVE-2018-7584)

    * php: Infinite loop in ext/iconv/iconv.c when using stream filter with convert.incov on invalid sequence     leads to denial-of-service (CVE-2018-10546)

    * php: Reflected XSS vulnerability on PHAR 403 and 404 error pages (CVE-2018-10547)

    * php: NULL pointer dereference due to mishandling of ldap_get_dn return value allows DoS via malicious     LDAP server reply (CVE-2018-10548)

    * php: Mishandled http_header_value in an atoi() call in http_fopen_wrapper.c (CVE-2018-14884)

    * php: Cross-site scripting (XSS) flaw in Apache2 component via body of 'Transfer-Encoding: chunked'     request (CVE-2018-17082)

    * gd: Heap based buffer overflow in gdImageColorMatch() in gd_color_match.c (CVE-2019-6977)

    * php: Invalid memory access in function xmlrpc_decode() (CVE-2019-9020)

    * php: File rename across filesystems may allow unwanted access during processing (CVE-2019-9637)

    * php: Uninitialized read in exif_process_IFD_in_MAKERNOTE (CVE-2019-9638)

    * php: Uninitialized read in exif_process_IFD_in_MAKERNOTE (CVE-2019-9639)

    * php: Invalid read in exif_process_SOFn() (CVE-2019-9640)

    * php: Out-of-bounds read due to integer overflow in iconv_mime_decode_headers() (CVE-2019-11039)

    * php: Buffer over-read in exif_read_data() (CVE-2019-11040)

    * php: Out-of-bound read in timelib_meridian() (CVE-2017-16642)

    * gd: Infinite loop in gdImageCreateFromGifCtx() in gd_gif_in.c (CVE-2018-5711)

    * php: Dumpable FPM child processes allow bypassing opcache access controls (CVE-2018-10545)

    * php: Out-of-bounds read in ext/exif/exif.c:exif_read_data() when reading crafted JPEG data     (CVE-2018-10549)

    * php: exif: Buffer over-read in exif_process_IFD_in_MAKERNOTE() (CVE-2018-14851)

    * php: Buffer over-read in PHAR reading functions (CVE-2018-20783)

    * php: Heap-based buffer over-read in PHAR reading functions (CVE-2019-9021)

    * php: memcpy with negative length via crafted DNS response (CVE-2019-9022)

    * php: Heap-based buffer over-read in mbstring regular expression functions (CVE-2019-9023)

    * php: Out-of-bounds read in base64_decode_xmlrpc in ext/xmlrpc/libxmlrpc/base64.c (CVE-2019-9024)

    * php: Heap buffer overflow in function exif_process_IFD_TAG() (CVE-2019-11034)

    * php: Heap buffer overflow in function exif_iif_add_value() (CVE-2019-11035)

    * php: Buffer over-read in exif_process_IFD_TAG() leading to information disclosure (CVE-2019-11036)

    * gd: Information disclosure in gdImageCreateFromXbm() (CVE-2019-11038)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
125850	SUSE SLED15 / SLES15 Security Update : php7 (SUSE-SU-2019:1461-1)	Nessus	SuSE Local Security Checks	2019/6/12	2024/5/16	critical
125409	Debian DLA-1803-1 : php5 security update	Nessus	Debian Local Security Checks	2019/5/28	2024/5/21	critical
125699	openSUSE Security Update : php7 (openSUSE-2019-1501)	Nessus	SuSE Local Security Checks	2019/6/4	2024/5/17	critical
136057	RHEL 8 : php:7.2 (RHSA-2020:1624)	Nessus	Red Hat Local Security Checks	2020/4/28	2025/3/15	critical
180887	Oracle Linux 8 : php:7.2 (ELSA-2020-1624)	Nessus	Oracle Linux Local Security Checks	2023/9/7	2024/11/1	critical
294157	MiracleLinux 8 : php:7.2 (AXSA:2020-845:01)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	critical
124784	Fedora 28 : php (2019-bab3944fee)	Nessus	Fedora Local Security Checks	2019/5/13	2024/5/23	critical
125352	Ubuntu 14.04 LTS : PHP vulnerabilities (USN-3566-2)	Nessus	Ubuntu Local Security Checks	2019/5/23	2024/5/21	critical
167950	SUSE SLES15: apache2-mod_php7 / php7 / php7-bcmath / php7-bz2 / php7-calendar / etc (SUSE-SU-2022:4067-1)	Nessus	SuSE Local Security Checks	2022/11/19	2026/6/25	critical
193829	RHEL 7 : rh-php72-php (RHSA-2019:3299)	Nessus	Red Hat Local Security Checks	2024/4/24	2024/11/6	critical
126282	EulerOS 2.0 SP8 : php (EulerOS-SA-2019-1655)	Nessus	Huawei Local Security Checks	2019/6/27	2024/5/14	critical
124763	PHP 7.2.x < 7.2.18 Heap-based Buffer Overflow Vulnerability.	Nessus	CGI abuses	2019/5/10	2025/5/26	critical
125538	SUSE SLES12 Security Update : php7 (SUSE-SU-2019:1365-1)	Nessus	SuSE Local Security Checks	2019/5/29	2024/5/20	critical
125700	openSUSE Security Update : php5 (openSUSE-2019-1503)	Nessus	SuSE Local Security Checks	2019/6/4	2024/5/17	critical
125904	Amazon Linux AMI : php71 / php72,php73 (ALAS-2019-1225)	Nessus	Amazon Linux Local Security Checks	2019/6/14	2024/5/16	critical
194152	RHEL 7 : rh-php71-php (RHSA-2019:2519)	Nessus	Red Hat Local Security Checks	2024/4/28	2024/11/6	critical

检测

插件搜索

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical