Vulnerabilities > CVE-2018-7584 - Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in PHP

CVSS 7.5 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

PARTIAL

Integrity impact

PARTIAL

Availability impact

PARTIAL

network

low complexity

nessus

exploit available

NVD

Published: 2018-03-01

Updated: 2019-08-19

Summary

In PHP through 5.6.33, 7.0.x before 7.0.28, 7.1.x through 7.1.14, and 7.2.x through 7.2.2, there is a stack-based buffer under-read while parsing an HTTP response in the php_stream_url_wrap_http_ex function in ext/standard/http_fopen_wrapper.c. This subsequently results in copying a large string.

Vulnerable Configurations

Part	Description	Count
Application	Php PHP PHP - PHP PHP 0.1 PHP PHP 0.1.1 PHP PHP 0.2 PHP PHP 0.2.0 PHP PHP 0.2.1 PHP PHP 0.2.2 PHP PHP 0.2.3 PHP PHP 0.2.4 PHP PHP 0.3 PHP PHP 0.4 PHP PHP 0.5 PHP PHP 0.5.2 PHP PHP 0.5.3 PHP PHP 0.6 PHP PHP 0.7 PHP PHP 0.9 PHP PHP 0.9.0 PHP PHP 0.9.1 PHP PHP 0.9.2 PHP PHP 0.9.3 PHP PHP 0.9.4 PHP PHP 0.10 PHP PHP 0.11 PHP PHP 0.90 PHP PHP 0.91 PHP PHP 1.0 PHP PHP 1.0.0 PHP PHP 1.0.1 PHP PHP 1.0.2 PHP PHP 1.0.3 PHP PHP 1.0.4 PHP PHP 1.1 PHP PHP 1.1.0 PHP PHP 1.1.1 PHP PHP 1.2 PHP PHP 1.2.0 PHP PHP 1.2.1 PHP PHP 1.2.2 PHP PHP 1.2.3 PHP PHP 1.2.4 PHP PHP 1.2.5 PHP PHP 1.3 PHP PHP 1.3.1 PHP PHP 1.3.5 PHP PHP 1.4 PHP PHP 1.5 PHP PHP 2.0 PHP PHP 2.0.0 PHP PHP 2.0.1 PHP PHP 2.0.2 PHP PHP 2.0B10 PHP PHP 3.0 PHP PHP 3.0.1 PHP PHP 3.0.2 PHP PHP 3.0.3 PHP PHP 3.0.4 PHP PHP 3.0.5 PHP PHP 3.0.6 PHP PHP 3.0.7 PHP PHP 3.0.8 PHP PHP 3.0.9 PHP PHP 3.0.10 PHP PHP 3.0.11 PHP PHP 3.0.12 PHP PHP 3.0.13 PHP PHP 3.0.14 PHP PHP 3.0.15 PHP PHP 3.0.16 PHP PHP 3.0.17 PHP PHP 3.0.18 PHP PHP 4.0 PHP PHP 4.0.0 PHP PHP 4.0.1 PHP PHP 4.0.2 PHP PHP 4.0.3 PHP PHP 4.0.4 PHP PHP 4.0.5 PHP PHP 4.0.6 PHP PHP 4.0.7 PHP PHP 4.1.0 PHP PHP 4.1.1 PHP PHP 4.1.2 PHP PHP 4.1.3 PHP PHP 4.2 PHP PHP 4.2.0 PHP PHP 4.2.1 PHP PHP 4.2.2 PHP PHP 4.2.3 PHP PHP 4.2.4 PHP PHP 4.3 PHP PHP 4.3.0 PHP PHP 4.3.1 PHP PHP 4.3.2 PHP PHP 4.3.3 PHP PHP 4.3.4 PHP PHP 4.3.5 PHP PHP 4.3.6 PHP PHP 4.3.7 PHP PHP 4.3.8 PHP PHP 4.3.9 PHP PHP 4.3.10 PHP PHP 4.3.11 PHP PHP 4.4.0 PHP PHP 4.4.1 PHP PHP 4.4.2 PHP PHP 4.4.3 PHP PHP 4.4.4 PHP PHP 4.4.5 PHP PHP 4.4.6 PHP PHP 4.4.7 PHP PHP 4.4.8 PHP PHP 4.4.9 PHP PHP 5.0.0 PHP PHP 5.0.1 PHP PHP 5.0.2 PHP PHP 5.0.3 PHP PHP 5.0.4 PHP PHP 5.0.5 PHP PHP 5.1 PHP PHP 5.1.0 PHP PHP 5.1.1 PHP PHP 5.1.2 PHP PHP 5.1.3 PHP PHP 5.1.4 PHP PHP 5.1.5 PHP PHP 5.1.6 PHP PHP 5.2.0 PHP PHP 5.2.1 PHP PHP 5.2.2 PHP PHP 5.2.3 PHP PHP 5.2.4 PHP PHP 5.2.5 PHP PHP 5.2.6 PHP PHP 5.2.7 PHP PHP 5.2.8 PHP PHP 5.2.9 PHP PHP 5.2.10 PHP PHP 5.2.11 PHP PHP 5.2.12 PHP PHP 5.2.13 PHP PHP 5.2.14 PHP PHP 5.2.15 PHP PHP 5.2.16 PHP PHP 5.2.17 PHP PHP 5.3.0 PHP PHP 5.3.1 PHP PHP 5.3.2 PHP PHP 5.3.3 PHP PHP 5.3.4 PHP PHP 5.3.5 PHP PHP 5.3.6 PHP PHP 5.3.7 PHP PHP 5.3.8 PHP PHP 5.3.9 PHP PHP 5.3.10 PHP PHP 5.3.11 PHP PHP 5.3.12 PHP PHP 5.3.13 PHP PHP 5.3.14 PHP PHP 5.3.15 PHP PHP 5.3.16 PHP PHP 5.3.17 PHP PHP 5.3.18 PHP PHP 5.3.19 PHP PHP 5.3.20 PHP PHP 5.3.21 PHP PHP 5.3.22 PHP PHP 5.3.23 PHP PHP 5.3.24 PHP PHP 5.3.25 PHP PHP 5.3.26 PHP PHP 5.3.27 PHP PHP 5.3.28 PHP PHP 5.3.29 PHP PHP 5.4.0 PHP PHP 5.4.1 PHP PHP 5.4.2 PHP PHP 5.4.3 PHP PHP 5.4.4 PHP PHP 5.4.5 PHP PHP 5.4.6 PHP PHP 5.4.7 PHP PHP 5.4.8 PHP PHP 5.4.9 PHP PHP 5.4.10 PHP PHP 5.4.11 PHP PHP 5.4.12 PHP PHP 5.4.13 PHP PHP 5.4.14 PHP PHP 5.4.15 PHP PHP 5.4.16 PHP PHP 5.4.17 PHP PHP 5.4.18 PHP PHP 5.4.19 PHP PHP 5.4.20 PHP PHP 5.4.21 PHP PHP 5.4.22 PHP PHP 5.4.23 PHP PHP 5.4.24 PHP PHP 5.4.25 PHP PHP 5.4.26 PHP PHP 5.4.27 PHP PHP 5.4.28 PHP PHP 5.4.29 PHP PHP 5.4.30 PHP PHP 5.4.31 PHP PHP 5.4.32 PHP PHP 5.4.33 PHP PHP 5.4.34 PHP PHP 5.4.35 PHP PHP 5.4.36 PHP PHP 5.4.37 PHP PHP 5.4.38 PHP PHP 5.4.39 PHP PHP 5.4.40 PHP PHP 5.4.41 PHP PHP 5.4.42 PHP PHP 5.4.43 PHP PHP 5.4.44 PHP PHP 5.4.45 PHP PHP 5.5.0 PHP PHP 5.5.1 PHP PHP 5.5.2 PHP PHP 5.5.3 PHP PHP 5.5.4 PHP PHP 5.5.5 PHP PHP 5.5.6 PHP PHP 5.5.7 PHP PHP 5.5.8 PHP PHP 5.5.9 PHP PHP 5.5.10 PHP PHP 5.5.11 PHP PHP 5.5.12 PHP PHP 5.5.13 PHP PHP 5.5.14 PHP PHP 5.5.15 PHP PHP 5.5.16 PHP PHP 5.5.17 PHP PHP 5.5.18 PHP PHP 5.5.19 PHP PHP 5.5.20 PHP PHP 5.5.21 PHP PHP 5.5.22 PHP PHP 5.5.23 PHP PHP 5.5.24 PHP PHP 5.5.25 PHP PHP 5.5.26 PHP PHP 5.5.27 PHP PHP 5.5.28 PHP PHP 5.5.29 PHP PHP 5.5.30 PHP PHP 5.5.31 PHP PHP 5.5.32 PHP PHP 5.5.33 PHP PHP 5.5.34 PHP PHP 5.5.35 PHP PHP 5.5.36 PHP PHP 5.5.37 PHP PHP 5.5.38 PHP PHP 5.6.0 PHP PHP 5.6.1 PHP PHP 5.6.2 PHP PHP 5.6.3 PHP PHP 5.6.4 PHP PHP 5.6.5 PHP PHP 5.6.6 PHP PHP 5.6.7 PHP PHP 5.6.8 PHP PHP 5.6.9 PHP PHP 5.6.10 PHP PHP 5.6.11 PHP PHP 5.6.12 PHP PHP 5.6.13 PHP PHP 5.6.14 PHP PHP 5.6.15 PHP PHP 5.6.16 PHP PHP 5.6.17 PHP PHP 5.6.18 PHP PHP 5.6.19 PHP PHP 5.6.20 PHP PHP 5.6.21 PHP PHP 5.6.22 PHP PHP 5.6.23 PHP PHP 5.6.24 PHP PHP 5.6.25 PHP PHP 5.6.26 PHP PHP 5.6.27 PHP PHP 5.6.28 PHP PHP 5.6.29 PHP PHP 5.6.30 PHP PHP 5.6.31 PHP PHP 5.6.32 PHP PHP 5.6.33 PHP PHP 7.0.0 PHP PHP 7.0.1 PHP PHP 7.0.2 PHP PHP 7.0.3 PHP PHP 7.0.4 PHP PHP 7.0.5 PHP PHP 7.0.6 PHP PHP 7.0.7 PHP PHP 7.0.8 PHP PHP 7.0.9 PHP PHP 7.0.10 PHP PHP 7.0.11 PHP PHP 7.0.12 PHP PHP 7.0.13 PHP PHP 7.0.14 PHP PHP 7.0.15 PHP PHP 7.0.16 PHP PHP 7.0.17 PHP PHP 7.0.18 PHP PHP 7.0.19 PHP PHP 7.0.20 PHP PHP 7.0.21 PHP PHP 7.0.22 PHP PHP 7.0.23 PHP PHP 7.0.24 PHP PHP 7.0.25 PHP PHP 7.0.26 PHP PHP 7.0.27 PHP PHP 7.1.0 PHP PHP 7.1.1 PHP PHP 7.1.2 PHP PHP 7.1.3 PHP PHP 7.1.4 PHP PHP 7.1.5 PHP PHP 7.1.6 PHP PHP 7.1.7 PHP PHP 7.1.8 PHP PHP 7.1.9 PHP PHP 7.1.10 PHP PHP 7.1.11 PHP PHP 7.1.12 PHP PHP 7.1.13 PHP PHP 7.1.14 PHP PHP 7.2.0 PHP PHP 7.2.1 PHP PHP 7.2.2	990
OS	Canonical Canonical Ubuntu Linux 12.04 Canonical Ubuntu Linux 14.04 Canonical Ubuntu Linux 16.04 Canonical Ubuntu Linux 17.10	4
OS	Debian Debian Debian Linux 7.0 Debian Debian Linux 8.0 Debian Debian Linux 9.0	3

Common Weakness Enumeration (CWE)

CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer

Common Attack Pattern Enumeration and Classification (CAPEC)

Buffer Overflow via Environment Variables
This attack pattern involves causing a buffer overflow through manipulation of environment variables. Once the attacker finds that they can modify an environment variable, they may try to overflow associated buffers. This attack leverages implicit trust often placed in environment variables.
Overflow Buffers
Buffer Overflow attacks target improper or missing bounds checking on buffer operations, typically triggered by input injected by an attacker. As a consequence, an attacker is able to write past the boundaries of allocated buffer regions in memory, causing a program crash or potentially redirection of execution as per the attackers' choice.
Client-side Injection-induced Buffer Overflow
This type of attack exploits a buffer overflow vulnerability in targeted client software through injection of malicious content from a custom-built hostile service.
Filter Failure through Buffer Overflow
In this attack, the idea is to cause an active filter to fail by causing an oversized transaction. An attacker may try to feed overly long input strings to the program in an attempt to overwhelm the filter (by causing a buffer overflow) and hoping that the filter does not fail securely (i.e. the user input is let into the system unfiltered).
MIME Conversion
An attacker exploits a weakness in the MIME conversion routine to cause a buffer overflow and gain control over the mail server machine. The MIME system is designed to allow various different information formats to be interpreted and sent via e-mail. Attack points exist when data are converted to MIME compatible format and back.

Exploit-Db

description	PHP 7.2.2 - 'php_stream_url_wrap_http_ex' Buffer Overflow. CVE-2018-7584. Dos exploit for PHP platform
file	exploits/php/dos/44846.txt
id	EDB-ID:44846
last seen	2018-06-06
modified	2018-06-06
platform	php
port
published	2018-06-06
reporter	Exploit-DB
source	https://www.exploit-db.com/download/44846/
title	PHP 7.2.2 - 'php_stream_url_wrap_http_ex' Buffer Overflow
type	dos

Nessus

NASL family	Fedora Local Security Checks
NASL id	FEDORA_2018-E8BC8D2784.NASL
description	PHP version 7.1.15 (01 Mar 2018) Apache2Handler: - Fixed bug php#75882 (a simple way for segfaults in threadsafe php just with configuration). (Anatol) Date: - Fixed bug php#75857 (Timezone gets truncated when formatted). (carusogabriel) - Fixed bug php#75928 (Argument 2 for `DateTimeZone::listIdentifiers()` should accept `null`). (Pedro Lacerda) - Fixed bug php#68406 (calling var_dump on a DateTimeZone object modifies it). (jhdxr) PGSQL: - Fixed php#75838 (Memory leak in pg_escape_bytea()). (ard_1 at mail dot ru) ODBC: - Fixed bug php#73725 (Unable to retrieve value of varchar(max) type). (Anatol) LDAP: - Fixed bug php#49876 (Fix LDAP path lookup on 64-bit distros). (dzuelke) libxml2: - Fixed bug php#75871 (use pkg-config where available). (pmmaga) Phar: - Fixed bug php#65414 (deal with leading slash when adding files correctly). (bishopb) SPL: - Fixed bug php#74519 (strange behavior of AppendIterator). (jhdxr) Standard: - Fixed bug php#75916 (DNS_CAA record results contain garbage). (Mike, Philip Sharp) - Fixed bug php#75981 (stack-buffer-overflow while parsing HTTP response). (Stas) Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-05
modified	2018-03-12
plugin id	107282
published	2018-03-12
reporter	This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/107282
title	Fedora 26 : php (2018-e8bc8d2784)
code	#%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Fedora Security Advisory FEDORA-2018-e8bc8d2784. # include("compat.inc"); if (description) { script_id(107282); script_version("1.9"); script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/04"); script_cve_id("CVE-2018-7584"); script_xref(name:"FEDORA", value:"2018-e8bc8d2784"); script_name(english:"Fedora 26 : php (2018-e8bc8d2784)"); script_summary(english:"Checks rpm output for the updated package."); script_set_attribute( attribute:"synopsis", value:"The remote Fedora host is missing a security update." ); script_set_attribute( attribute:"description", value: "PHP version 7.1.15 (01 Mar 2018) Apache2Handler: - Fixed bug php#75882 (a simple way for segfaults in threadsafe php just with configuration). (Anatol) Date: - Fixed bug php#75857 (Timezone gets truncated when formatted). (carusogabriel) - Fixed bug php#75928 (Argument 2 for `DateTimeZone::listIdentifiers()` should accept `null`). (Pedro Lacerda) - Fixed bug php#68406 (calling var_dump on a DateTimeZone object modifies it). (jhdxr) PGSQL: - Fixed php#75838 (Memory leak in pg_escape_bytea()). (ard_1 at mail dot ru) ODBC: - Fixed bug php#73725 (Unable to retrieve value of varchar(max) type). (Anatol) LDAP: - Fixed bug php#49876 (Fix LDAP path lookup on 64-bit distros). (dzuelke) libxml2: - Fixed bug php#75871 (use pkg-config where available). (pmmaga) Phar: - Fixed bug php#65414 (deal with leading slash when adding files correctly). (bishopb) SPL: - Fixed bug php#74519 (strange behavior of AppendIterator). (jhdxr) Standard: - Fixed bug php#75916 (DNS_CAA record results contain garbage). (Mike, Philip Sharp) - Fixed bug php#75981 (stack-buffer-overflow while parsing HTTP response). (Stas) Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues." ); script_set_attribute( attribute:"see_also", value:"https://bodhi.fedoraproject.org/updates/FEDORA-2018-e8bc8d2784" ); script_set_attribute(attribute:"solution", value:"Update the affected php package."); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P"); script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C"); script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"); script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available"); script_set_attribute(attribute:"exploit_available", value:"true"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:php"); script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora:26"); script_set_attribute(attribute:"vuln_publication_date", value:"2018/03/01"); script_set_attribute(attribute:"patch_publication_date", value:"2018/03/11"); script_set_attribute(attribute:"plugin_publication_date", value:"2018/03/12"); script_set_attribute(attribute:"generated_plugin", value:"current"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"Fedora Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/RedHat/release"); if (isnull(release) \|\| "Fedora" >!< release) audit(AUDIT_OS_NOT, "Fedora"); os_ver = pregmatch(pattern: "Fedora.*release ([0-9]+)", string:release); if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Fedora"); os_ver = os_ver[1]; if (! preg(pattern:"^26([^0-9]\|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Fedora 26", "Fedora " + os_ver); if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH); if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Fedora", cpu); flag = 0; if (rpm_check(release:"FC26", reference:"php-7.1.15-1.fc26")) flag++; if (flag) { security_report_v4( port : 0, severity : SECURITY_HOLE, extra : rpm_report_get() ); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "php"); }

NASL family	Misc.
NASL id	SECURITYCENTER_5_7_1_TNS_2018_12.NASL
description	According to its self-reported version, the Tenable SecurityCenter application installed on the remote host is prior to 5.7.1. It is, therefore, affected by multiple vulnerabilities. Note that Nessus has not tested for these issues but has instead relied only on the application
last seen	2020-06-01
modified	2020-06-02
plugin id	117672
published	2018-09-24
reporter	This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/117672
title	Tenable SecurityCenter < 5.7.1 Multiple Vulnerabilities (TNS-2018-12)

NASL family	Fedora Local Security Checks
NASL id	FEDORA_2018-A89CCF7133.NASL
description	PHP version 7.1.15 (01 Mar 2018) Apache2Handler: - Fixed bug php#75882 (a simple way for segfaults in threadsafe php just with configuration). (Anatol) Date: - Fixed bug php#75857 (Timezone gets truncated when formatted). (carusogabriel) - Fixed bug php#75928 (Argument 2 for `DateTimeZone::listIdentifiers()` should accept `null`). (Pedro Lacerda) - Fixed bug php#68406 (calling var_dump on a DateTimeZone object modifies it). (jhdxr) PGSQL: - Fixed php#75838 (Memory leak in pg_escape_bytea()). (ard_1 at mail dot ru) ODBC: - Fixed bug php#73725 (Unable to retrieve value of varchar(max) type). (Anatol) LDAP: - Fixed bug php#49876 (Fix LDAP path lookup on 64-bit distros). (dzuelke) libxml2: - Fixed bug php#75871 (use pkg-config where available). (pmmaga) Phar: - Fixed bug php#65414 (deal with leading slash when adding files correctly). (bishopb) SPL: - Fixed bug php#74519 (strange behavior of AppendIterator). (jhdxr) Standard: - Fixed bug php#75916 (DNS_CAA record results contain garbage). (Mike, Philip Sharp) - Fixed bug php#75981 (stack-buffer-overflow while parsing HTTP response). (Stas) Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-05
modified	2018-03-07
plugin id	107172
published	2018-03-07
reporter	This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/107172
title	Fedora 27 : php (2018-a89ccf7133)

NASL family	Huawei Local Security Checks
NASL id	EULEROS_SA-2018-1158.NASL
description	According to the version of the php packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - In PHP through 5.6.33, 7.0.x before 7.0.28, 7.1.x through 7.1.14, and 7.2.x through 7.2.2, there is a stack-based buffer under-read while parsing an HTTP response in the php_stream_url_wrap_http_ex function in ext/standard/http_fopen_wrapper.c. This subsequently results in copying a large string.(CVE-2018-7584) Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-05-06
modified	2018-06-28
plugin id	110734
published	2018-06-28
reporter	This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/110734
title	EulerOS 2.0 SP3 : php (EulerOS-SA-2018-1158)

NASL family	CGI abuses
NASL id	PHP_7_0_28.NASL
description	According to its banner, the version of PHP running on the remote web server is 7.0.x prior to 7.0.28. It is, therefore, affected by a stack buffer overflow vulnerability.
last seen	2020-06-01
modified	2020-06-02
plugin id	107217
published	2018-03-08
reporter	This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/107217
title	PHP 7.0.x < 7.0.28 Stack Buffer Overflow

NASL family	CGI abuses
NASL id	PHP_7_1_15.NASL
description	According to its banner, the version of PHP running on the remote web server is 7.1.x prior to 7.1.15. It is, therefore, affected by a stack buffer overflow vulnerability.
last seen	2020-06-01
modified	2020-06-02
plugin id	107218
published	2018-03-08
reporter	This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/107218
title	PHP 7.1.x < 7.1.15 Stack Buffer Overflow

NASL family	SuSE Local Security Checks
NASL id	SUSE_SU-2018-0646-1.NASL
description	This update for php7 provides the following fix: Security issues fixed : - CVE-2018-7584: Fixed stack-based buffer under-read while parsing an HTTPresponse in the php_stream_url_wrap_http_ex (bsc#1083639). Bug fixes : - Fix a memory leak in the pg_escape_bytea function of the pgsql extension. (bsc#1076970) Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	120017
published	2019-01-02
reporter	This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/120017
title	SUSE SLES12 Security Update : php7 (SUSE-SU-2018:0646-1)

NASL family	Huawei Local Security Checks
NASL id	EULEROS_SA-2018-1097.NASL
description	According to the versions of the php packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - In PHP through 5.6.33, 7.0.x before 7.0.28, 7.1.x through 7.1.14, and 7.2.x through 7.2.2, there is a stack-based buffer under-read while parsing an HTTP response in the php_stream_url_wrap_http_ex function in ext/standard/http_fopen_wrapper.c. This subsequently results in copying a large string.(CVE-2018-7584) - In PHP before 5.5.32, 5.6.x before 5.6.18, and 7.x before 7.0.3, all of the return values of stream_get_meta_data can be controlled if the input can be controlled (e.g., during file uploads). For example, a
last seen	2020-05-06
modified	2018-05-02
plugin id	109495
published	2018-05-02
reporter	This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/109495
title	EulerOS 2.0 SP2 : php (EulerOS-SA-2018-1097)

NASL family	Huawei Local Security Checks
NASL id	EULEROS_SA-2018-1096.NASL
description	According to the versions of the php packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - In PHP through 5.6.33, 7.0.x before 7.0.28, 7.1.x through 7.1.14, and 7.2.x through 7.2.2, there is a stack-based buffer under-read while parsing an HTTP response in the php_stream_url_wrap_http_ex function in ext/standard/http_fopen_wrapper.c. This subsequently results in copying a large string.(CVE-2018-7584) - In PHP before 5.5.32, 5.6.x before 5.6.18, and 7.x before 7.0.3, all of the return values of stream_get_meta_data can be controlled if the input can be controlled (e.g., during file uploads). For example, a
last seen	2020-05-06
modified	2018-05-02
plugin id	109494
published	2018-05-02
reporter	This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/109494
title	EulerOS 2.0 SP1 : php (EulerOS-SA-2018-1096)

NASL family	Red Hat Local Security Checks
NASL id	REDHAT-RHSA-2020-1112.NASL
description	The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1112 advisory. - php: Reflected XSS vulnerability on PHAR 403 and 404 error pages (CVE-2018-10547) - php: Reflected XSS on PHAR 404 page (CVE-2018-5712) - php: Stack-based buffer under-read in php_stream_url_wrap_http_ex() in http_fopen_wrapper.c when parsing HTTP response (CVE-2018-7584) - php: Out-of-bounds read in base64_decode_xmlrpc in ext/xmlrpc/libxmlrpc/base64.c (CVE-2019-9024) Note that Nessus has not tested for this issue but has instead relied only on the application
last seen	2020-04-23
modified	2020-03-31
plugin id	135040
published	2020-03-31
reporter	This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/135040
title	RHEL 7 : php (RHSA-2020:1112)

NASL family	SuSE Local Security Checks
NASL id	OPENSUSE-2018-269.NASL
description	This update for php5 fixes the following issues : Security issues fixed : - CVE-2018-7584: Fixed stack-based buffer under-read while parsing an HTTPresponse in the php_stream_url_wrap_http_ex (bsc#1083639). This update was imported from the SUSE:SLE-12:Update update project.
last seen	2020-06-05
modified	2018-03-19
plugin id	108438
published	2018-03-19
reporter	This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/108438
title	openSUSE Security Update : php5 (openSUSE-2018-269)

NASL family	Amazon Linux Local Security Checks
NASL id	ALA_ALAS-2018-982.NASL
description	Stack-based buffer under-read in ext/standard/http_fopen_wrapper.c:php_stream_url_wrap_http_ex function when parsing HTTP response allows denial of service : In PHP through 5.6.33, 7.0.x before 7.0.28, 7.1.x through 7.1.14, and 7.2.x through 7.2.2, there is a stack-based buffer under-read while parsing an HTTP response in the php_stream_url_wrap_http_ex function in ext/standard/http_fopen_wrapper.c. This subsequently results in copying a large string. (CVE-2018-7584)
last seen	2020-06-01
modified	2020-06-02
plugin id	108691
published	2018-03-29
reporter	This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/108691
title	Amazon Linux AMI : php71 (ALAS-2018-982)

NASL family	Debian Local Security Checks
NASL id	DEBIAN_DLA-1397.NASL
description	Several vulnerabilities were found in PHP, a widely-used open source general purpose scripting language : CVE-2018-7584 A stack-buffer-overflow while parsing HTTP response results in copying a large string and possible memory corruption and/or denial of service CVE-2018-10545 Dumpable FPM child processes allow bypassing opcache access controls resulting in potential information disclosure where one user can obtain information about another user
last seen	2020-06-01
modified	2020-06-02
plugin id	110697
published	2018-06-27
reporter	This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/110697
title	Debian DLA-1397-1 : php5 security update

NASL family	CGI abuses
NASL id	PHP_5_6_34.NASL
description	According to its banner, the version of PHP running on the remote web server is 5.6.x prior to 5.6.34. It is, therefore, affected by a stack buffer overflow vulnerability.
last seen	2020-06-01
modified	2020-06-02
plugin id	107216
published	2018-03-08
reporter	This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/107216
title	PHP 5.6.x < 5.6.34 Stack Buffer Overflow

NASL family	CGI abuses
NASL id	PHP_7_2_3.NASL
description	According to its banner, the version of PHP running on the remote web server is 7.2.x prior to 7.2.3. It is, therefore, affected by a stack buffer overflow vulnerability.
last seen	2020-06-01
modified	2020-06-02
plugin id	107219
published	2018-03-08
reporter	This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/107219
title	PHP 7.2.x < 7.2.3 Stack Buffer Overflow

NASL family	Slackware Local Security Checks
NASL id	SLACKWARE_SSA_2018-067-02.NASL
description	New php packages are available for Slackware 14.0, 14.1, 14.2, and -current to fix a security issue.
last seen	2020-06-01
modified	2020-06-02
plugin id	107234
published	2018-03-09
reporter	This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/107234
title	Slackware 14.0 / 14.1 / 14.2 / current : php (SSA:2018-067-02)

NASL family	SuSE Local Security Checks
NASL id	OPENSUSE-2018-244.NASL
description	This update for php7 provides the following fix : Security issues fixed : - CVE-2018-7584: Fixed stack-based buffer under-read while parsing an HTTPresponse in the php_stream_url_wrap_http_ex (bsc#1083639). Bug fixes : - Fix a memory leak in the pg_escape_bytea function of the pgsql extension. (bsc#1076970) This update was imported from the SUSE:SLE-12:Update update project.
last seen	2020-06-05
modified	2018-03-12
plugin id	107285
published	2018-03-12
reporter	This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/107285
title	openSUSE Security Update : php7 (openSUSE-2018-244)

NASL family	Debian Local Security Checks
NASL id	DEBIAN_DLA-1326.NASL
description	Wei Lei and Liu Yang of Nanyang Technological University discovered a stack-based buffer overflow in PHP5 when parsing a malformed HTTP response which can be exploited to cause a denial of service. For Debian 7
last seen	2020-03-17
modified	2018-03-30
plugin id	108726
published	2018-03-30
reporter	This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/108726
title	Debian DLA-1326-1 : php5 security update

NASL family	Debian Local Security Checks
NASL id	DEBIAN_DSA-4240.NASL
description	Several vulnerabilities were found in PHP, a widely-used open source general purpose scripting language : - CVE-2018-7584 Buffer underread in parsing HTTP responses - CVE-2018-10545 Dumpable FPM child processes allowed the bypass of opcache access controls - CVE-2018-10546 Denial of service via infinite loop in convert.iconv stream filter - CVE-2018-10547 The fix for CVE-2018-5712 (shipped in DSA 4080) was incomplete - CVE-2018-10548 Denial of service via malformed LDAP server responses - CVE-2018-10549 Out-of-bounds read when parsing malformed JPEG files
last seen	2020-06-01
modified	2020-06-02
plugin id	110928
published	2018-07-06
reporter	This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/110928
title	Debian DSA-4240-1 : php7.0 - security update

NASL family	Amazon Linux Local Security Checks
NASL id	ALA_ALAS-2018-988.NASL
description	Stack-based buffer under-read in ext/standard/http_fopen_wrapper.c:php_stream_url_wrap_http_ex function when parsing HTTP response allows denial of service In PHP through 5.6.33, 7.0.x before 7.0.28, 7.1.x through 7.1.14, and 7.2.x through 7.2.2, there is a stack-based buffer under-read while parsing an HTTP response in the php_stream_url_wrap_http_ex function in ext/standard/http_fopen_wrapper.c. This subsequently results in copying a large string. (CVE-2018-7584)
last seen	2020-06-01
modified	2020-06-02
plugin id	108849
published	2018-04-06
reporter	This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/108849
title	Amazon Linux AMI : php70 / php56 (ALAS-2018-988)

NASL family	MacOS X Local Security Checks
NASL id	MACOS_10_13_5.NASL
description	The remote host is running a version of macOS / Mac OS X that is 10.13.x prior to 10.13.5. It is, therefore, affected by multiple vulnerabilities. Note that successful exploitation of the most serious issues can result in arbitrary code execution.
last seen	2020-06-01
modified	2020-06-02
plugin id	110324
published	2018-06-05
reporter	This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/110324
title	macOS 10.13.x < 10.13.5 Multiple Vulnerabilities

NASL family	Scientific Linux Local Security Checks
NASL id	SL_20200407_PHP_ON_SL7_X.NASL
description	* php: Reflected XSS on PHAR 404 page * php: Stack-based buffer under-read in php_stream_url_wrap_http_ex() in http_fopen_wrapper.c when parsing HTTP response * php: Reflected XSS vulnerability on PHAR 403 and 404 error pages * php: Out-of-bounds read in base64_decode_xmlrpc in ext/xmlrpc/libxmlrpc/base64.c
last seen	2020-04-30
modified	2020-04-21
plugin id	135827
published	2020-04-21
reporter	This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/135827
title	Scientific Linux Security Update : php on SL7.x x86_64 (20200407)

NASL family	SuSE Local Security Checks
NASL id	SUSE_SU-2018-0717-1.NASL
description	This update for php5 fixes the following issues: Security issues fixed : - CVE-2018-7584: Fixed stack-based buffer under-read while parsing an HTTPresponse in the php_stream_url_wrap_http_ex (bsc#1083639). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	120018
published	2019-01-02
reporter	This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/120018
title	SUSE SLES12 Security Update : php5 (SUSE-SU-2018:0717-1)

NASL family	CentOS Local Security Checks
NASL id	CENTOS_RHSA-2020-1112.NASL
description	The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1112 advisory. - php: Reflected XSS vulnerability on PHAR 403 and 404 error pages (CVE-2018-10547) - php: Reflected XSS on PHAR 404 page (CVE-2018-5712) - php: Stack-based buffer under-read in php_stream_url_wrap_http_ex() in http_fopen_wrapper.c when parsing HTTP response (CVE-2018-7584) - php: Out-of-bounds read in base64_decode_xmlrpc in ext/xmlrpc/libxmlrpc/base64.c (CVE-2019-9024) Note that Nessus has not tested for this issue but has instead relied only on the application
last seen	2020-06-06
modified	2020-04-10
plugin id	135338
published	2020-04-10
reporter	This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/135338
title	CentOS 7 : php (CESA-2020:1112)

NASL family	Ubuntu Local Security Checks
NASL id	UBUNTU_USN-3600-1.NASL
description	It was discovered that PHP incorrectly handled certain stream metadata. A remote attacker could possibly use this issue to set arbitrary metadata. This issue only affected Ubuntu 14.04 LTS. (CVE-2016-10712) It was discovered that PHP incorrectly handled the PHAR 404 error page. A remote attacker could possibly use this issue to conduct cross-site scripting (XSS) attacks. This issue only affected Ubuntu 16.04 LTS and Ubuntu 17.10. (CVE-2018-5712) It was discovered that PHP incorrectly handled parsing certain HTTP responses. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2018-7584). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	108483
published	2018-03-20
reporter	Ubuntu Security Notice (C) 2018-2019 Canonical, Inc. / NASL script (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/108483
title	Ubuntu 14.04 LTS / 16.04 LTS / 17.10 : php5, php7.0, php7.1 vulnerabilities (USN-3600-1)

NASL family	SuSE Local Security Checks
NASL id	SUSE_SU-2018-0806-1.NASL
description	This update for php53 fixes several issues. These security issues were fixed : - CVE-2016-10712: In PHP all of the return values of stream_get_meta_data could be controlled if the input can be controlled (e.g., during file uploads). (bsc#1080234) - CVE-2018-5712: Prevent reflected XSS on the PHAR 404 error page via the URI of a request for a .phar file that allowed for information disclosure (bsc#1076220) - CVE-2018-5711: Prevent integer signedness error that could have lead to an infinite loop via a crafted GIF file allowing for DoS (bsc#1076391) - CVE-2016-5773: php_zip.c in the zip extension in PHP improperly interacted with the unserialize implementation and garbage collection, which allowed remote attackers to execute arbitrary code or cause a denial of service (use-after-free and application crash) via crafted serialized data containing a ZipArchive object. (bsc#986247) - CVE-2016-5771: spl_array.c in the SPL extension in PHP improperly interacted with the unserialize implementation and garbage collection, which allowed remote attackers to execute arbitrary code or cause a denial of service (use-after-free and application crash) via crafted serialized data. (bsc#986391) - CVE-2018-7584: Fixed stack-based buffer under-read while parsing an HTTPresponse in the php_stream_url_wrap_http_ex. (bsc#1083639) Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	108650
published	2018-03-27
reporter	This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/108650
title	SUSE SLES11 Security Update : php53 (SUSE-SU-2018:0806-1)

Packetstorm

data source	https://packetstormsecurity.com/files/download/148068/php722-overflow.txt
id	PACKETSTORM:148068
last seen	2018-06-07
published	2018-06-06
reporter	Wei Lei
source	https://packetstormsecurity.com/files/148068/PHP-7.22-php_stream_url_wrap_http_ex-Buffer-Overflow.html
title	PHP 7.22 php_stream_url_wrap_http_ex Buffer Overflow

Redhat

advisories

rhsa

id	RHSA-2019:2519

rpms

rh-php71-php-0:7.1.30-1.el7
rh-php71-php-bcmath-0:7.1.30-1.el7
rh-php71-php-cli-0:7.1.30-1.el7
rh-php71-php-common-0:7.1.30-1.el7
rh-php71-php-dba-0:7.1.30-1.el7
rh-php71-php-dbg-0:7.1.30-1.el7
rh-php71-php-debuginfo-0:7.1.30-1.el7
rh-php71-php-devel-0:7.1.30-1.el7
rh-php71-php-embedded-0:7.1.30-1.el7
rh-php71-php-enchant-0:7.1.30-1.el7
rh-php71-php-fpm-0:7.1.30-1.el7
rh-php71-php-gd-0:7.1.30-1.el7
rh-php71-php-gmp-0:7.1.30-1.el7
rh-php71-php-intl-0:7.1.30-1.el7
rh-php71-php-json-0:7.1.30-1.el7
rh-php71-php-ldap-0:7.1.30-1.el7
rh-php71-php-mbstring-0:7.1.30-1.el7
rh-php71-php-mysqlnd-0:7.1.30-1.el7
rh-php71-php-odbc-0:7.1.30-1.el7
rh-php71-php-opcache-0:7.1.30-1.el7
rh-php71-php-pdo-0:7.1.30-1.el7
rh-php71-php-pgsql-0:7.1.30-1.el7
rh-php71-php-process-0:7.1.30-1.el7
rh-php71-php-pspell-0:7.1.30-1.el7
rh-php71-php-recode-0:7.1.30-1.el7
rh-php71-php-snmp-0:7.1.30-1.el7
rh-php71-php-soap-0:7.1.30-1.el7
rh-php71-php-xml-0:7.1.30-1.el7
rh-php71-php-xmlrpc-0:7.1.30-1.el7
rh-php71-php-zip-0:7.1.30-1.el7
php-0:5.4.16-48.el7
php-bcmath-0:5.4.16-48.el7
php-cli-0:5.4.16-48.el7
php-common-0:5.4.16-48.el7
php-dba-0:5.4.16-48.el7
php-debuginfo-0:5.4.16-48.el7
php-devel-0:5.4.16-48.el7
php-embedded-0:5.4.16-48.el7
php-enchant-0:5.4.16-48.el7
php-fpm-0:5.4.16-48.el7
php-gd-0:5.4.16-48.el7
php-intl-0:5.4.16-48.el7
php-ldap-0:5.4.16-48.el7
php-mbstring-0:5.4.16-48.el7
php-mysql-0:5.4.16-48.el7
php-mysqlnd-0:5.4.16-48.el7
php-odbc-0:5.4.16-48.el7
php-pdo-0:5.4.16-48.el7
php-pgsql-0:5.4.16-48.el7
php-process-0:5.4.16-48.el7
php-pspell-0:5.4.16-48.el7
php-recode-0:5.4.16-48.el7
php-snmp-0:5.4.16-48.el7
php-soap-0:5.4.16-48.el7
php-xml-0:5.4.16-48.el7
php-xmlrpc-0:5.4.16-48.el7

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

Exploit-Db

Nessus

Packetstorm

Redhat

References