According to the versions of the php packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when using Postgres     database extension, supplying invalid parameters to the parametrized query may lead to PHP attempting to     free memory using uninitialized data as pointers. This could lead to RCE vulnerability or denial of     service. (CVE-2022-31625)

  - In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when pdo_mysql extension     with mysqlnd driver, if the third party is allowed to supply host to connect to and the password for the     connection, password of excessive length can trigger a buffer overflow in PHP, which can lead to a remote     code execution vulnerability. (CVE-2022-31626)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3997-1 advisory.

    - Version update to 7.4.33:
    - CVE-2022-31630: Fixed out-of-bounds read due to insufficient input validation in imageloadfont()     (bsc#1204979).
    - CVE-2022-37454: Fixed buffer overflow in hash_update() on long parameter (bsc#1204577).


    - Version update to 7.4.32 (jsc#SLE-23639)
    - CVE-2022-31628: Fixed an uncontrolled recursion in the phar uncompressor while decompressing 'quines'     gzip files. (bsc#1203867)
    - CVE-2022-31629: Fixed a bug which could lead an attacker to set an insecure cookie that will treated as     secure in the victim's browser. (bsc#1203870)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2022-3754:01 advisory.

    * php: password of excessive length triggers buffer overflow leading to RCE (CVE-2022-31626)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2022:0147 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2021-21703:
    In PHP versions 7.3.x up to and including 7.3.31, 7.4.x below 7.4.25 and 8.0.x below 8.0.12, when running     PHP FPM SAPI with main FPM daemon process running as root and child worker processes running as lower-     privileged users, it is possible for the child processes to access memory shared with the main process and     write to it, modifying it in a way that would cause the root process to conduct invalid memory reads and     writes, which can be used to escalate privileges from local unprivileged user to the root user.

    CVE-2021-21705:
    In PHP versions 7.3.x below 7.3.29, 7.4.x below 7.4.21 and 8.0.x below 8.0.8, when using URL validation     functionality via filter_var() function with FILTER_VALIDATE_URL parameter, an URL with invalid password     field can be accepted as valid. This can lead to the code incorrectly parsing the URL and potentially     leading to other security implications - like contacting a wrong server or making a wrong access decision.

    CVE-2022-31626:
    In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when pdo_mysql extension     with mysqlnd driver, if the third party is allowed to supply host to connect to and the password for the     connection, password of excessive length can trigger a buffer overflow in PHP, which can lead to a remote     code execution vulnerability.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when pdo_mysql extension     with mysqlnd driver, if the third party is allowed to supply host to connect to and the password for the     connection, password of excessive length can trigger a buffer overflow in PHP, which can lead to a remote     code execution vulnerability. (CVE-2022-31626)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2022-3369:01 advisory.

    * php: password of excessive length triggers buffer overflow leading to RCE (CVE-2022-31626)
      * php: Local privilege escalation via PHP-FPM (CVE-2021-21703)
      * php: special character breaks path in xml parsing (CVE-2021-21707)
      * php: uninitialized array in pg_query_params() leading to RCE (CVE-2022-31625)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of PHP installed on the remote host is prior to 7.4.30. It is, therefore, affected by multiple vulnerabilities as referenced in the Version 7.4.30 advisory.

  - In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when using Postgres     database extension, supplying invalid parameters to the parametrized query may lead to PHP attempting to     free memory using uninitialized data as pointers. This could lead to RCE vulnerability or denial of     service. (CVE-2022-31625)

  - In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when pdo_mysql extension     with mysqlnd driver, if the third party is allowed to supply host to connect to and the password for the     connection, password of excessive length can trigger a buffer overflow in PHP, which can lead to a remote     code execution vulnerability. (CVE-2022-31626)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of PHP installed on the remote host is prior to 8.1.7. It is, therefore, affected by multiple vulnerabilities as referenced in the Version 8.1.7 advisory.

  - In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when using Postgres     database extension, supplying invalid parameters to the parametrized query may lead to PHP attempting to     free memory using uninitialized data as pointers. This could lead to RCE vulnerability or denial of     service. (CVE-2022-31625)

  - In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when pdo_mysql extension     with mysqlnd driver, if the third party is allowed to supply host to connect to and the password for the     connection, password of excessive length can trigger a buffer overflow in PHP, which can lead to a remote     code execution vulnerability. (CVE-2022-31626)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of php installed on the remote host is prior to 7.4.30. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2022-164-01 advisory.

  - In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when using Postgres     database extension, supplying invalid parameters to the parametrized query may lead to PHP attempting to     free memory using uninitialized data as pointers. This could lead to RCE vulnerability or denial of     service. (CVE-2022-31625)

  - In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when pdo_mysql extension     with mysqlnd driver, if the third party is allowed to supply host to connect to and the password for the     connection, password of excessive length can trigger a buffer overflow in PHP, which can lead to a remote     code execution vulnerability. (CVE-2022-31626)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:2161-1 advisory.

  - In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when using Postgres     database extension, supplying invalid parameters to the parametrized query may lead to PHP attempting to     free memory using uninitialized data as pointers. This could lead to RCE vulnerability or denial of     service. (CVE-2022-31625)

  - In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when pdo_mysql extension     with mysqlnd driver, if the third party is allowed to supply host to connect to and the password for the     connection, password of excessive length can trigger a buffer overflow in PHP, which can lead to a remote     code execution vulnerability. (CVE-2022-31626)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:2183-1 advisory.

  - In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when using Postgres     database extension, supplying invalid parameters to the parametrized query may lead to PHP attempting to     free memory using uninitialized data as pointers. This could lead to RCE vulnerability or denial of     service. (CVE-2022-31625)

  - In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when pdo_mysql extension     with mysqlnd driver, if the third party is allowed to supply host to connect to and the password for the     connection, password of excessive length can trigger a buffer overflow in PHP, which can lead to a remote     code execution vulnerability. (CVE-2022-31626)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:5467 advisory.

    PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

    Security Fix(es):

    * php: password of excessive length triggers buffer overflow leading to RCE (CVE-2022-31626)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2022-5468 advisory.

    php     [8.0.13-3]
    - fix password of excessive length triggers buffer overflow leading to RCE       CVE-2022-31626

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2022:5468 advisory.

  - php: password of excessive length triggers buffer overflow leading to RCE (CVE-2022-31626)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:5904 advisory.

    PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

    Security Fix(es):

    * php: password of excessive length triggers buffer overflow leading to RCE (CVE-2022-31626)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202209-20 (PHP: Multiple Vulnerabilities)

  - In PHP versions 7.3.x up to and including 7.3.31, 7.4.x below 7.4.25 and 8.0.x below 8.0.12, when running     PHP FPM SAPI with main FPM daemon process running as root and child worker processes running as lower-     privileged users, it is possible for the child processes to access memory shared with the main process and     write to it, modifying it in a way that would cause the root process to conduct invalid memory reads and     writes, which can be used to escalate privileges from local unprivileged user to the root user.
    (CVE-2021-21703)

  - In PHP versions 7.3.x below 7.3.29, 7.4.x below 7.4.21 and 8.0.x below 8.0.8, when using Firebird PDO     driver extension, a malicious database server could cause crashes in various database functions, such as     getAttribute(), execute(), fetch() and others by returning invalid response data that is not parsed     correctly by the driver. This can result in crashes, denial of service or potentially memory corruption.
    (CVE-2021-21704)

  - In PHP versions 7.3.x below 7.3.29, 7.4.x below 7.4.21 and 8.0.x below 8.0.8, when using URL validation     functionality via filter_var() function with FILTER_VALIDATE_URL parameter, an URL with invalid password     field can be accepted as valid. This can lead to the code incorrectly parsing the URL and potentially     leading to other security implications - like contacting a wrong server or making a wrong access decision.
    (CVE-2021-21705)

  - In PHP versions 7.4.x below 7.4.28, 8.0.x below 8.0.16, and 8.1.x below 8.1.3, when using filter functions     with FILTER_VALIDATE_FLOAT filter and min/max limits, if the filter fails, there is a possibility to     trigger use of allocated memory after free, which can result it crashes, and potentially in overwrite of     other memory chunks and RCE. This issue affects: code that uses FILTER_VALIDATE_FLOAT with min/max limits.
    (CVE-2021-21708)

  - In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when using Postgres     database extension, supplying invalid parameters to the parametrized query may lead to PHP attempting to     free memory using uninitialized data as pointers. This could lead to RCE vulnerability or denial of     service. (CVE-2022-31625)

  - In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when pdo_mysql extension     with mysqlnd driver, if the third party is allowed to supply host to connect to and the password for the     connection, password of excessive length can trigger a buffer overflow in PHP, which can lead to a remote     code execution vulnerability. (CVE-2022-31626)

  - In PHP versions 8.1.x below 8.1.8, when fileinfo functions, such as finfo_buffer, due to incorrect patch     applied to the third party code from libmagic, incorrect function may be used to free allocated memory,     which may lead to heap corruption. (CVE-2022-31627)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:4067-1 advisory.

    - Version update to 7.2.34 [jsc#SLE-23639]

    - CVE-2022-37454: Fixed SHA-3 buffer overflow (bsc#1204577).
    - Fix integer overflow in PHP_SHA3##bits (bsc#1204577#c26).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
164200	EulerOS 2.0 SP8 : php (EulerOS-SA-2022-2229)	Nessus	Huawei Local Security Checks	2022/8/17	2023/10/13	high
167650	SUSE SLED15: apache2-mod_php7 / php7 / php7-bcmath / php7-bz2 / php7-calendar / etc (SUSE-SU-2022:3997-1)	Nessus	SuSE Local Security Checks	2022/11/16	2026/6/25	critical
293119	MiracleLinux 8 : php:8.0 (AXSA:2022-3754:01)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	high
236440	Alibaba Cloud Linux 3 : 0147: php:7.4 (ALINUX3-SA-2022:0147)	Nessus	Alibaba Cloud Linux Local Security Checks	2025/5/14	2025/5/14	high
251758	Linux Distros Unpatched Vulnerability : CVE-2022-31626	Nessus	Misc.	2025/8/19	2025/8/19	high
294328	MiracleLinux 7 : rh-php73-php-7.3.33-1.el7 (AXSA:2022-3369:01)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	high
161971	PHP 7.4.x < 7.4.30 Multiple Vulnerabilities	Nessus	CGI abuses	2022/6/9	2025/5/26	high
161975	PHP 8.1.x < 8.1.7 Multiple Vulnerabilities	Nessus	CGI abuses	2022/6/9	2025/5/26	high
162169	Slackware Linux 15.0 / current php Multiple Vulnerabilities (SSA:2022-164-01)	Nessus	Slackware Local Security Checks	2022/6/13	2023/10/20	high
162524	SUSE SLES12 Security Update : php74 (SUSE-SU-2022:2161-1)	Nessus	SuSE Local Security Checks	2022/6/24	2023/7/13	high
162546	SUSE SLES12 Security Update : php72 (SUSE-SU-2022:2183-1)	Nessus	SuSE Local Security Checks	2022/6/27	2023/7/13	high
162631	RHEL 8 : php:7.4 (RHSA-2022:5467)	Nessus	Red Hat Local Security Checks	2022/6/30	2025/4/8	high
162716	Oracle Linux 8 : php:8.0 (ELSA-2022-5468)	Nessus	Oracle Linux Local Security Checks	2022/7/5	2024/11/2	high
162992	CentOS 8 : php:8.0 (CESA-2022:5468)	Nessus	CentOS Local Security Checks	2022/7/11	2023/10/18	high
163845	RHEL 9 : php (RHSA-2022:5904)	Nessus	Red Hat Local Security Checks	2022/8/4	2024/11/7	high
165627	GLSA-202209-20 : PHP: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	2022/10/3	2023/10/10	critical
167950	SUSE SLES15: apache2-mod_php7 / php7 / php7-bcmath / php7-bz2 / php7-calendar / etc (SUSE-SU-2022:4067-1)	Nessus	SuSE Local Security Checks	2022/11/19	2026/6/25	critical

检测

插件搜索

high

critical

high

high

high

high

high

high

high

high

high

high

high

high

high

critical

critical