The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-a03b06dbd0 advisory.

    **PHP version 8.3.12** (26 Sep 2024)

    **CGI:**

    * Fixed bug [GHSA-p99j-rfp4-xqvq](https://github.com/php/php-src/security/advisories/GHSA-p99j-rfp4-xqvq)     (Bypass of CVE-2024-4577, Parameter Injection Vulnerability). (**CVE-2024-8926**) (nielsdos)
    * Fixed bug [GHSA-94p6-54jq-9mwp](https://github.com/php/php-src/security/advisories/GHSA-94p6-54jq-9mwp)     (cgi.force_redirect configuration is bypassable due to the environment variable collision).
    (**CVE-2024-8927**) (nielsdos)

    **Core:**

    * Fixed bug [GH-15408](https://github.com/php/php-src/issues/15408) (MSan false-positve on     zend_max_execution_timer). (zeriyoshi)
    * Fixed bug [GH-15515](https://github.com/php/php-src/issues/15515) (Configure error grep illegal option     q). (Peter Kokot)
    * Fixed bug [GH-15514](https://github.com/php/php-src/issues/15514) (Configure error: genif.sh: syntax     error). (Peter Kokot)
    * Fixed bug [GH-15565](https://github.com/php/php-src/issues/15565) (--disable-ipv6 during compilation     produces error EAI_SYSTEM not found). (nielsdos)
    * Fixed bug [GH-15587](https://github.com/php/php-src/issues/15587) (CRC32 API build error on arm 32-bit).
    (Bernd Kuhls, Thomas Petazzoni)
    * Fixed bug [GH-15330](https://github.com/php/php-src/issues/15330) (Do not scan generator frames more     than once). (Arnaud)
    * Fixed uninitialized lineno in constant AST of internal enums. (ilutov)

    **Curl:**

    * FIxed bug [GH-15547](https://github.com/php/php-src/issues/15547) (curl_multi_select overflow on timeout     argument). (David Carlier)

    **DOM:**

    * Fixed bug [GH-15551](https://github.com/php/php-src/issues/15551) (Segmentation fault (access null     pointer) in ext/dom/xml_common.h). (nielsdos)
    * Fixed bug [GH-15654](https://github.com/php/php-src/issues/15654) (Signed integer overflow in     ext/dom/nodelist.c). (nielsdos)

    **Fileinfo:**

    * Fixed bug [GH-15752](https://github.com/php/php-src/issues/15752) (Incorrect error message for     finfo_file with an empty filename argument). (DanielEScherzer)

    **FPM:**

    * Fixed bug [GHSA-865w-9rf3-2wh5](https://github.com/php/php-src/security/advisories/GHSA-865w-9rf3-2wh5)     (Logs from childrens may be altered). (**CVE-2024-9026**) (Jakub Zelenka)

    **MySQLnd:**

    * Fixed bug [GH-15432](https://github.com/php/php-src/issues/15432) (Heap corruption when querying a     vector). (cmb, Kamil Tekiela)

    **Opcache:**

    * Fixed bug [GH-15661](https://github.com/php/php-src/issues/15661) (Access null pointer in     Zend/Optimizer/zend_inference.c). (nielsdos)
    * Fixed bug [GH-15658](https://github.com/php/php-src/issues/15658) (Segmentation fault in     Zend/zend_vm_execute.h). (nielsdos)

    **SAPI:**

    * Fixed bug [GHSA-9pqp-7h25-4f32](https://github.com/php/php-src/security/advisories/GHSA-9pqp-7h25-4f32)     (Erroneous parsing of multipart form data). (**CVE-2024-8925**) (Arnaud)

    **Standard:**

    * Fixed bug [GH-15552](https://github.com/php/php-src/issues/15552) (Signed integer overflow in     ext/standard/scanf.c). (cmb)

    **Streams:**

    * Fixed bug [GH-15628](https://github.com/php/php-src/issues/15628) (php_stream_memory_get_buffer() not     zero-terminated). (cmb)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:10949 advisory.

    PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

    Security Fix(es):

    * php: host/secure cookie bypass due to partial CVE-2022-31629 fix (CVE-2024-2756)

    * php: password_verify can erroneously return true, opening ATO risk (CVE-2024-3096)

    * php: Filter bypass in filter_var (FILTER_VALIDATE_URL) (CVE-2024-5458)

    * php: Erroneous parsing of multipart form data (CVE-2024-8925)

    * php: cgi.force_redirect configuration is bypassable due to the environment variable collision     (CVE-2024-8927)

    * php: PHP-FPM Log Manipulation Vulnerability (CVE-2024-9026)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:7315 advisory.

    PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

    Security Fix(es):

    * php: host/secure cookie bypass due to partial CVE-2022-31629 fix (CVE-2024-2756)

    * php: password_verify can erroneously return true, opening ATO risk (CVE-2024-3096)

    * php: Filter bypass in filter_var (FILTER_VALIDATE_URL) (CVE-2024-5458)

    * php: Erroneous parsing of multipart form data (CVE-2024-8925)

    * php: cgi.force_redirect configuration is bypassable due to the environment variable collision     (CVE-2024-8927)

    * php: PHP-FPM Log Manipulation Vulnerability (CVE-2024-9026)

    * php: Leak partial content of the heap through heap buffer over-read in mysqlnd (CVE-2024-8929)

    * php: Single byte overread with convert.quoted-printable-decode filter (CVE-2024-11233)

    * php: Configuring a proxy in a stream context might allow for CRLF injection in URIs (CVE-2024-11234)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of PHP installed on the remote host is prior to 8.3.12. It is, therefore, affected by multiple vulnerabilities as referenced in the Version 8.3.12 advisory.

  - In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using a certain non-     standard configurations of Windows codepages, the fixes for CVE-2024-4577     https://github.com/advisories/GHSA-vxpp-6299-mxw3 may still be bypassed and the same command injection     related to Windows Best Fit codepage behavior can be achieved. This may allow a malicious user to pass     options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the     server, etc. (CVE-2024-8926)

  - In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, erroneous parsing of     multipart form data contained in an HTTP POST request could lead to legitimate data not being processed.
    This could lead to malicious attacker able to control part of the submitted data being able to exclude     portion of other data, potentially leading to erroneous application behavior. (CVE-2024-8925)

  - In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, HTTP_REDIRECT_STATUS     variable is used to check whether or not CGI binary is being run by the HTTP server. However, in certain     scenarios, the content of this variable can be controlled by the request submitter via HTTP headers, which     can lead to cgi.force_redirect option not being correctly applied. In certain configurations this may lead     to arbitrary file inclusion in PHP. (CVE-2024-8927)

  - In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using PHP-FPM SAPI and     it is configured to catch workers output through catch_workers_output = yes, it may be possible to pollute     the final log or remove up to 4 characters from the log messages by manipulating log message content.
    Additionally, if PHP-FPM is configured to use syslog output, it may be possible to further remove log data     using the same vulnerability. (CVE-2024-9026)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of PHP installed on the remote host is prior to 8.2.24. It is, therefore, affected by multiple vulnerabilities as referenced in the Version 8.2.24 advisory.

  - In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using a certain non-     standard configurations of Windows codepages, the fixes for CVE-2024-4577     https://github.com/advisories/GHSA-vxpp-6299-mxw3 may still be bypassed and the same command injection     related to Windows Best Fit codepage behavior can be achieved. This may allow a malicious user to pass     options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the     server, etc. (CVE-2024-8926)

  - In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, erroneous parsing of     multipart form data contained in an HTTP POST request could lead to legitimate data not being processed.
    This could lead to malicious attacker able to control part of the submitted data being able to exclude     portion of other data, potentially leading to erroneous application behavior. (CVE-2024-8925)

  - In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, HTTP_REDIRECT_STATUS     variable is used to check whether or not CGI binary is being run by the HTTP server. However, in certain     scenarios, the content of this variable can be controlled by the request submitter via HTTP headers, which     can lead to cgi.force_redirect option not being correctly applied. In certain configurations this may lead     to arbitrary file inclusion in PHP. (CVE-2024-8927)

  - In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using PHP-FPM SAPI and     it is configured to catch workers output through catch_workers_output = yes, it may be possible to pollute     the final log or remove up to 4 characters from the log messages by manipulating log message content.
    Additionally, if PHP-FPM is configured to use syslog output, it may be possible to further remove log data     using the same vulnerability. (CVE-2024-9026)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7049-1 advisory.

    It was discovered that PHP incorrectly handled parsing multipart form data. A remote attacker could     possibly use this issue to inject payloads and cause PHP to ignore legitimate data. (CVE-2024-8925)

    It was discovered that PHP incorrectly handled the cgi.force_redirect configuration option due to     environment variable collisions. In certain configurations, an attacker could possibly use this issue     bypass force_redirect restrictions. (CVE-2024-8927)

    It was discovered that PHP-FPM incorrectly handled logging. A remote attacker could possibly use this     issue to alter and inject arbitrary contents into log files. This issue only affected Ubuntu 22.04 LTS,     and Ubuntu 24.04 LTS. (CVE-2024-9026)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3733-1 advisory.

    - CVE-2024-8925: Fixed erroneous parsing of multipart form data in HTTP POST requests leads to legitimate     data not being processed (bsc#1231360)
    - CVE-2024-8927: Fixed cgi.force_redirect configuration is bypassable due to an environment variable     collision (bsc#1231358)
    - CVE-2024-9026: Fixed pollution of worker output logs in PHP-FPM (bsc#1231382)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2025-10238:04 advisory.

    php: host/secure cookie bypass due to partial CVE-2022-31629 fix     (CVE-2024-2756)         php: password_verify can erroneously return true, opening ATO risk     (CVE-2024-3096)         php: Filter bypass in filter_var (FILTER_VALIDATE_URL) (CVE-2024-5458)         php: Erroneous parsing of multipart form data (CVE-2024-8925)         php: cgi.force_redirect configuration is bypassable due to the environment     variable collision (CVE-2024-8927)         php: PHP-FPM Log Manipulation Vulnerability (CVE-2024-9026)         php: Leak partial content of the heap through heap buffer over-read in     mysqlnd (CVE-2024-8929)         php: Single byte overread with convert.quoted-printable-decode filter     (CVE-2024-11233)         php: Configuring a proxy in a stream context might allow for CRLF injection     in URIs (CVE-2024-11234)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-872 advisory.

    The upstream advisory describes this issue as follows:

    A memory-related vulnerability in PHP's filter handling system, particularly when processing input with     convert.quoted-printable-decode filters, leads to a segmentation fault. This vulnerability is triggered     through specific sequences of input data, causing PHP to crash. When exploited, it allows an attacker to     extract a single byte of data from the heap or cause a DoS. (CVE-2024-11233)

    The upstream advisory describes this issue as follows:

    Configuring a proxy in a stream context might allow for CRLF injection in URIs, resulting in HTTP request     smuggling attacks. (CVE-2024-11234)

    Erroneous parsing of multipart form data

    NOTE: Fixed in 8.3.12, 8.2.24NOTE: https://github.com/php/php-     src/security/advisories/GHSA-9pqp-7h25-4f32NOTE: https://github.com/php/php-     src/commit/19b49258d0c5a61398d395d8afde1123e8d161e0 (PHP-8.2.24) (CVE-2024-8925)

    cgi.force_redirect configuration is byppassible due to the environment variable collision

    NOTE: Fixed in 8.3.12, 8.2.24NOTE: https://github.com/php/php-     src/security/advisories/GHSA-94p6-54jq-9mwpNOTE: https://github.com/php/php-     src/commit/48808d98f4fc2a05193cdcc1aedd6c66816450f1 (PHP-8.2.24) (CVE-2024-8927)

    php: Erroneous parsing of multipart form data (CVE-2024-8928)

    The upstream advisory describes this issue as follows:

    By connecting to a fake MySQL server or tampering with network packets and initiating a SQL Query, it is     possible to abuse the function static enum_func_status php_mysqlnd_rset_field_read when parsing MySQL     fields packets in order to include the rest of the heap content starting from the address of the cursor of     the currently read buffer.

    Using PHP-FPM which stays alive between request, and between two different SQL query requests, as the     previous buffer used to store received data from MySQL is not emptied and malloc allocates a memory region     which is very near the previous one, one is able to extract the response content of the previous MySQL     request from the PHP-FPM worker. (CVE-2024-8929)

    The upstream advisory describes this issue as follows:

    Uncontrolled long string inputs to ldap_escape on 32-bit systems can cause an integer overflow, resulting     in an out-of-bounds write. (CVE-2024-8932)

    Logs from childrens may be altered

    NOTE: Fixed in 8.3.12, 8.2.24NOTE: https://github.com/php/php-     src/security/advisories/GHSA-865w-9rf3-2wh5NOTE: https://github.com/php/php-     src/commit/1f8e16172c7961045c2b0f34ba7613e3f21cdee8 (PHP-8.2.24) (CVE-2024-9026)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:10951 advisory.

    PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

    Security Fix(es):

    * php: host/secure cookie bypass due to partial CVE-2022-31629 fix (CVE-2024-2756)

    * php: password_verify can erroneously return true, opening ATO risk (CVE-2024-3096)

    * php: Filter bypass in filter_var (FILTER_VALIDATE_URL) (CVE-2024-5458)

    * php: Erroneous parsing of multipart form data (CVE-2024-8925)

    * php: cgi.force_redirect configuration is bypassable due to the environment variable collision     (CVE-2024-8927)

    * php: PHP-FPM Log Manipulation Vulnerability (CVE-2024-9026)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:10950 advisory.

    PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

    Security Fix(es):

    * php: host/secure cookie bypass due to partial CVE-2022-31629 fix (CVE-2024-2756)

    * php: password_verify can erroneously return true, opening ATO risk (CVE-2024-3096)

    * php: Filter bypass in filter_var (FILTER_VALIDATE_URL) (CVE-2024-5458)

    * php: Erroneous parsing of multipart form data (CVE-2024-8925)

    * php: cgi.force_redirect configuration is bypassable due to the environment variable collision     (CVE-2024-8927)

    * php: PHP-FPM Log Manipulation Vulnerability (CVE-2024-9026)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
211244	Fedora 41 : php (2024-a03b06dbd0)	Nessus	Fedora Local Security Checks	2024/11/14	2025/11/3	critical
212502	RHEL 9 : php:8.2 (RHSA-2024:10949)	Nessus	Red Hat Local Security Checks	2024/12/11	2025/4/29	high
235805	RHEL 9 : php (RHSA-2025:7315)	Nessus	Red Hat Local Security Checks	2025/5/13	2025/7/1	high
207821	PHP 8.3.x < 8.3.12 Multiple Vulnerabilities	Nessus	CGI abuses	2024/9/26	2025/5/26	high
207822	PHP 8.2.x < 8.2.24 Multiple Vulnerabilities	Nessus	CGI abuses	2024/9/26	2025/5/26	high
207997	Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS : PHP vulnerabilities (USN-7049-1)	Nessus	Ubuntu Local Security Checks	2024/10/1	2025/9/3	high
209317	SUSE SLES15 / openSUSE 15 Security Update : php7 (SUSE-SU-2024:3733-1)	Nessus	SuSE Local Security Checks	2024/10/19	2024/11/22	high
282967	MiracleLinux 9 : php-8.0.30-2.el9 (AXSA:2025-10238:04)	Nessus	Miracle Linux Local Security Checks	2026/1/13	2026/1/13	high
281610	Amazon Linux 2023 : php8.2, php8.2-bcmath, php8.2-cli (ALAS2023-2025-872)	Nessus	Amazon Linux Local Security Checks	2026/1/2	2026/1/2	high
212416	RHEL 8 : php:8.2 (RHSA-2024:10951)	Nessus	Red Hat Local Security Checks	2024/12/11	2025/3/22	high
212506	RHEL 9 : php:8.1 (RHSA-2024:10950)	Nessus	Red Hat Local Security Checks	2024/12/11	2025/4/29	high

检测

插件搜索

critical

high

high

high

high

high

high

high

high

high

high