This update for php7 fixes the following issues :

  - CVE-2020-7062: Fixed a NULL pointer dereference when     using file upload functionality under specific     circumstances (bsc#1165280).

  - CVE-2020-7063: Fixed an issue where adding files change     the permissions to default (bsc#1165289).

  - CVE-2020-7059: Fixed an out of bounds read in     php_strip_tags_ex which may have led to denial of     service (bsc#1162629).

  - CVE-2020-7060: Fixed a global buffer overflow in     mbfl_filt_conv_big5_wchar which may have led to memory     corruption (bsc#1162632). 

This update was imported from the SUSE:SLE-15:Update update project.

According to the versions of the php packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - In PHP versions 7.2.x below 7.2.28, 7.3.x below 7.3.15     and 7.4.x below 7.4.3, when creating PHAR archive using     PharData::buildFromIterator() function, the files are     added with default permissions (0666, or all access)     even if the original files on the filesystem were with     more restrictive permissions. This may result in files     having more lax permissions than intended when such     archive is extracted.(CVE-2020-7063)

  - In PHP versions 7.2.x below 7.2.31, 7.3.x below 7.3.18     and 7.4.x below 7.4.6, when HTTP file uploads are     allowed, supplying overly long filenames or field names     could lead PHP engine to try to allocate oversized     memory storage, hit the memory limit and stop     processing the request, without cleaning up temporary     files created by upload request. This potentially could     lead to accumulation of uncleaned temporary files     exhausting the disk space on the target     server.(CVE-2019-11048)

  - University of Washington IMAP Toolkit 2007f on UNIX, as     used in imap_open() in PHP and other products, launches     an rsh command (by means of the imap_rimap function in     c-client/imap4r1.c and the tcp_aopen function in     osdep/unix/tcp_unix.c) without preventing argument     injection, which might allow remote attackers to     execute arbitrary OS commands if the IMAP server name     is untrusted input (e.g., entered by a user of a web     application) and if rsh has been replaced by a program     with different argument semantics. For example, if rsh     is a link to ssh (as seen on Debian and Ubuntu     systems), then the attack can use an IMAP server name     containing a '-oProxyCommand' argument.(CVE-2018-19518)

  - ext/standard/var_unserializer.c in PHP 5.x through     7.1.24 allows attackers to cause a denial of service     (application crash) via an unserialize call for the     com, dotnet, or variant class.(CVE-2018-19396)

  - When using certain mbstring functions to convert     multibyte encodings, in PHP versions 7.2.x below     7.2.27, 7.3.x below 7.3.14 and 7.4.x below 7.4.2 it is     possible to supply data that will cause function     mbfl_filt_conv_big5_wchar to read past the allocated     buffer. This may lead to information disclosure or     crash.(CVE-2020-7060)

  - When using fgetss() function to read data with     stripping tags, in PHP versions 7.2.x below 7.2.27,     7.3.x below 7.3.14 and 7.4.x below 7.4.2 it is possible     to supply data that will cause this function to read     past the allocated buffer. This may lead to information     disclosure or crash.(CVE-2020-7059)

  - In PHP versions 7.2.x below 7.2.28, 7.3.x below 7.3.15     and 7.4.x below 7.4.3, when using file upload     functionality, if upload progress tracking is enabled,     but session.upload_progress.cleanup is set to 0     (disabled), and the file upload fails, the upload     procedure would try to clean up data that does not     exist and encounter null pointer dereference, which     would likely lead to a crash.(CVE-2020-7062)

  - In PHP versions 7.2.x below 7.2.30, 7.3.x below 7.3.17     and 7.4.x below 7.4.5, if PHP is compiled with EBCDIC     support (uncommon), urldecode() function can be made to     access locations past the allocated memory, due to     erroneously using signed numbers as array     indexes.(CVE-2020-7067)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:4067-1 advisory.

    - Version update to 7.2.34 [jsc#SLE-23639]

    - CVE-2022-37454: Fixed SHA-3 buffer overflow (bsc#1204577).
    - Fix integer overflow in PHP_SHA3##bits (bsc#1204577#c26).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
134618	openSUSE Security Update : php7 (openSUSE-2020-341)	Nessus	SuSE Local Security Checks	2020/3/16	2024/3/21	critical
139151	EulerOS 2.0 SP8 : php (EulerOS-SA-2020-1821)	Nessus	Huawei Local Security Checks	2020/7/30	2024/10/4	critical
167950	SUSE SLES15: apache2-mod_php7 / php7 / php7-bcmath / php7-bz2 / php7-calendar / etc (SUSE-SU-2022:4067-1)	Nessus	SuSE Local Security Checks	2022/11/19	2026/6/25	critical

检测

插件搜索

critical

critical

critical