This update for php7 fixes the following issues :

  - CVE-2020-7068: Use of freed hash key in the     phar_parse_zipfile function (bsc#1175223).

This update was imported from the SUSE:SLE-15-SP2:Update update project.

Multiple security issues were found in PHP, a widely-used open source general purpose scripting language which could result in denial of service, information disclosure, cookie forgery or incorrect encryption.

The version of php72 installed on the remote host is prior to 7.2.33-1.25. The version of php73 installed on the remote host is prior to 7.3.21-1.28. It is, therefore, affected by a vulnerability as referenced in the ALAS-2020-1425 advisory.

    The flaw is in phar_parse_zipfile() of ext/phar/zip.c. When processing a PHP archive file (phar), if a     persistent entry is used as defined in php.ini, then memory pointed to by the actual_alias pointer is     freed. Directly after the free, the actual_alias pointer is passed to zend_hash_str_add_ptr, where it is     dereferenced. Prior to the function call, a copy of the memory pointed to by actual_alias is duplicated     and assigned to the mydata->alias pointer. The patch simply uses the unfreed mydata->alias pointer as an     argument to the zend_hash_add_str() call rather than the freed memory pointed to by actual_alias.

    To trigger this flaw, an attacker needs to place a specially crafted file on the server's filesystem and     then load it with PHP. The attacker also needs a setting to be present in PHP's configuration file. Due to     this, the attack complexity is high as an attacker would need to find other flaws or already have admin     access to the server machine to do this. (CVE-2020-7068)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5006-2 advisory.

    USN-5006-1 fixed several vulnerabilities in PHP. This update provides the corresponding update for Ubuntu     14.04 ESM and Ubuntu 16.04 ESM.



Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:4213 advisory.

    PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

    The following packages have been upgraded to a later upstream version: php (7.4.19). (BZ#1944110)

    Security Fix(es):

    * php: Wrong ciphertext/tag in AES-CCM encryption for a 12 bytes IV (CVE-2020-7069)

    * php: FILTER_VALIDATE_URL accepts URLs with invalid userinfo (CVE-2020-7071)

    * php: Use of freed hash key in the phar_parse_zipfile function (CVE-2020-7068)

    * php: URL decoding of cookie names can lead to different interpretation of cookies between browser and     server (CVE-2020-7070)

    * php: NULL pointer dereference in SoapClient (CVE-2021-21702)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.5 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2022-2972:01 advisory.

    * php: Wrong ciphertext/tag in AES-CCM encryption for a 12 bytes IV (CVE-2020-7069)
      * php: FILTER_VALIDATE_URL accepts URLs with invalid userinfo (CVE-2020-7071)
      * php: Use of freed hash key in the phar_parse_zipfile function (CVE-2020-7068)
      * php: URL decoding of cookie names can lead to different interpretation of cookies between browser and     server (CVE-2020-7070)
      * php: NULL pointer dereference in SoapClient (CVE-2021-21702)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for php7 fixes the following issues :

fix CVE-2020-7068 [bsc#1175223]: Use of freed hash key in the phar_parse_zipfile function

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for php7 fixes the following issues :

CVE-2020-7068: Use of freed hash key in the phar_parse_zipfile function (bsc#1175223).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:4069-1 advisory.

    - Version update to 7.4.33:
    - CVE-2022-31630: Fixed out-of-bounds read due to insufficient input validation in imageloadfont()     (bsc#1204979).
    - CVE-2022-37454: Fixed buffer overflow in hash_update() on long parameter (bsc#1204577).

    - Version update to 7.4.32 (jsc#SLE-23639)
    - CVE-2022-31628: Fixed an uncontrolled recursion in the phar uncompressor while decompressing 'quines'     gzip files. (bsc#1203867)
    - CVE-2022-31629: Fixed a bug which could lead an attacker to set an insecure cookie that will treated as     secure in the victim's browser. (bsc#1203870)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:4068-1 advisory.

    - Version update to 7.4.33:
    - CVE-2022-31630: Fixed out-of-bounds read due to insufficient input validation in imageloadfont()     (bsc#1204979).
    - CVE-2022-37454: Fixed buffer overflow in hash_update() on long parameter (bsc#1204577).

    - Version update to 7.4.32 (jsc#SLE-23639)
    - CVE-2022-31628: Fixed an uncontrolled recursion in the phar uncompressor while decompressing 'quines'     gzip files. (bsc#1203867)
    - CVE-2022-31629: Fixed a bug which could lead an attacker to set an insecure cookie that will treated as     secure in the victim's browser. (bsc#1203870)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2021:4213 advisory.

  - In PHP versions 7.2.x below 7.2.33, 7.3.x below 7.3.21 and 7.4.x below 7.4.9, while processing PHAR files     using phar extension, phar_parse_zipfile could be tricked into accessing freed memory, which could lead to     a crash or information disclosure. (CVE-2020-7068)

  - In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when AES-CCM mode is used     with openssl_encrypt() function with 12 bytes IV, only first 7 bytes of the IV is actually used. This can     lead to both decreased security and incorrect encryption data. (CVE-2020-7069)

  - In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when PHP is processing     incoming HTTP cookie values, the cookie names are url-decoded. This may lead to cookies with prefixes like
    __Host confused with cookies that decode to such prefix, thus leading to an attacker being able to forge     cookie which is supposed to be secure. See also CVE-2020-8184 for more information. (CVE-2020-7070)

  - In PHP versions 7.3.x below 7.3.26, 7.4.x below 7.4.14 and 8.0.0, when validating URL with functions like     filter_var($url, FILTER_VALIDATE_URL), PHP will accept an URL with invalid password as valid URL. This may     lead to functions that rely on URL being valid to mis-parse the URL and produce wrong data as components     of the URL. (CVE-2020-7071)

  - In PHP versions 7.3.x below 7.3.27, 7.4.x below 7.4.15 and 8.0.x below 8.0.2, when using SOAP extension to     connect to a SOAP server, a malicious SOAP server could return malformed XML data as a response that would     cause PHP to access a null pointer and thus cause a crash. (CVE-2021-21702)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:4213 advisory.

  - php: Use of freed hash key in the phar_parse_zipfile function (CVE-2020-7068)

  - php: Wrong ciphertext/tag in AES-CCM encryption for a 12 bytes IV (CVE-2020-7069)

  - php: URL decoding of cookie names can lead to different interpretation of cookies between browser and     server (CVE-2020-7070)

  - php: FILTER_VALIDATE_URL accepts URLs with invalid userinfo (CVE-2020-7071)

  - php: NULL pointer dereference in SoapClient (CVE-2021-21702)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its self-reported version, the Tenable SecurityCenter application installed on the remote host is less than 5.19.0 and is therefore affected by multiple vulnerabilities in the following components: 
  - Apache FOP
  - Underscore
  - Handlebars
  - PHP
  - sqlite

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
140371	openSUSE Security Update : php7 (openSUSE-2020-1356)	Nessus	SuSE Local Security Checks	2020/9/8	2024/2/21	low
146613	Debian DSA-4856-1 : php7.3 - security update	Nessus	Debian Local Security Checks	2021/2/19	2024/1/22	medium
148126	Amazon Linux AMI : php72, php73 (ALAS-2020-1425)	Nessus	Amazon Linux Local Security Checks	2021/3/25	2024/12/11	low
151583	Ubuntu 16.04 ESM : PHP vulnerabilities (USN-5006-2)	Nessus	Ubuntu Local Security Checks	2021/7/13	2024/10/29	medium
155091	RHEL 8 : php:7.4 (RHSA-2021:4213)	Nessus	Red Hat Local Security Checks	2021/11/11	2025/3/13	medium
291664	MiracleLinux 8 : php:7.4 (AXSA:2022-2972:01)	Nessus	Miracle Linux Local Security Checks	2026/1/19	2026/1/19	medium
140244	SUSE SLES12 Security Update : php7 (SUSE-SU-2020:2403-1)	Nessus	SuSE Local Security Checks	2020/9/4	2024/2/22	low
140256	SUSE SLED15 / SLES15 Security Update : php7 (SUSE-SU-2020:2456-1)	Nessus	SuSE Local Security Checks	2020/9/4	2024/2/22	low
167937	SUSE SLED15: apache2-mod_php7 / php7 / php7-bcmath / php7-bz2 / php7-calendar / etc (SUSE-SU-2022:4069-1)	Nessus	SuSE Local Security Checks	2022/11/19	2026/6/25	critical
167963	SUSE SLES12: apache2-mod_php74 / php74 / php74-bcmath / php74-bz2 / etc (SUSE-SU-2022:4068-1)	Nessus	SuSE Local Security Checks	2022/11/19	2026/6/25	critical
185043	Rocky Linux 8 : php:7.4 (RLSA-2021:4213)	Nessus	Rocky Linux Local Security Checks	2023/11/7	2023/11/7	medium
155095	CentOS 8 : php:7.4 (CESA-2021:4213)	Nessus	CentOS Local Security Checks	2021/11/11	2023/11/24	medium
152986	Tenable SecurityCenter < 5.19.0 Multiple Vulnerabilities (TNS-2021-14)	Nessus	Misc.	2021/9/3	2024/5/10	critical

检测

插件搜索

low

medium

low

medium

medium

medium

low

low

critical

critical

medium

medium

critical