This update for php7 fixes the following issues :

  - CVE-2021-21702 [bsc#1182049]: NULL pointer dereference     in SoapClient

This update was imported from the SUSE:SLE-15-SP2:Update update project.

This update for php7 fixes the following issues :

CVE-2021-21702 [bsc#1182049]: NULL pointer dereference in SoapClient

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-2708 advisory.

    Several vulnerabilities were discovered in php5, a server-side, HTML-embedded scripting language. An     attacker could cause denial of service (DoS), memory corruption and potentially execution of arbitrary     code, and server-side request forgery (SSRF) bypass. CVE-2019-18218 fileinfo: cdf_read_property_info in     cdf.c does not restrict the number of CDF_VECTOR elements, which allows a heap-based buffer overflow     (4-byte out-of-bounds write). CVE-2020-7071 When validating URL with functions like filter_var($url,     FILTER_VALIDATE_URL), PHP will accept an URL with invalid password as valid URL. This may lead to     functions that rely on URL being valid to mis-parse the URL and produce wrong data as components of the     URL. CVE-2021-21702 When using SOAP extension to connect to a SOAP server, a malicious SOAP server could     return malformed XML data as a response that would cause PHP to access a null pointer and thus cause a     crash. CVE-2021-21704 Multiple firebird issues. CVE-2021-21705 SSRF bypass in FILTER_VALIDATE_URL. For     Debian 9 stretch, these problems have been fixed in version 7.0.33-0+deb9u11. We recommend that you     upgrade your php7.0 packages. For the detailed security status of php7.0 please refer to its security     tracker page at: https://security-tracker.debian.org/tracker/php7.0 Further information about Debian LTS     security advisories, how to apply these updates to your system and frequently asked questions can be found     at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:4213 advisory.

  - php: Use of freed hash key in the phar_parse_zipfile function (CVE-2020-7068)

  - php: Wrong ciphertext/tag in AES-CCM encryption for a 12 bytes IV (CVE-2020-7069)

  - php: URL decoding of cookie names can lead to different interpretation of cookies between browser and     server (CVE-2020-7070)

  - php: FILTER_VALIDATE_URL accepts URLs with invalid userinfo (CVE-2020-7071)

  - php: NULL pointer dereference in SoapClient (CVE-2021-21702)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its self-reported version, the Tenable SecurityCenter application installed on the remote host is less than 5.19.0 and is therefore affected by multiple vulnerabilities in the following components: 
  - Apache FOP
  - Underscore
  - Handlebars
  - PHP
  - sqlite

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
146688	openSUSE Security Update : php7 (openSUSE-2021-305)	Nessus	SuSE Local Security Checks	2021/2/22	2024/1/19	high
146849	SUSE SLES15 Security Update : php7 (SUSE-SU-2021:0584-1)	Nessus	SuSE Local Security Checks	2021/2/25	2024/1/19	high
151676	Debian DLA-2708-1 : php7.0 - LTS security update	Nessus	Debian Local Security Checks	2021/7/15	2025/1/24	high
155095	CentOS 8 : php:7.4 (CESA-2021:4213)	Nessus	CentOS Local Security Checks	2021/11/11	2023/11/24	medium
152986	Tenable SecurityCenter < 5.19.0 Multiple Vulnerabilities (TNS-2021-14)	Nessus	Misc.	2021/9/3	2024/5/10	critical

检测

插件搜索

high

high

high

medium

critical