Vulnerabilities > CVE-2019-9020 - Use After Free vulnerability in PHP

An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. Invalid input to the function xmlrpc_decode() can lead to an invalid memory access (heap out of bounds read or read after free). This is related to xml_elem_parse_buf in ext/xmlrpc/libxmlrpc/xml_element.c.

Vulnerable Configurations

Part	Description	Count
Application	Php PHP PHP - PHP PHP 0.1 PHP PHP 0.1.1 PHP PHP 0.2 PHP PHP 0.2.0 PHP PHP 0.2.1 PHP PHP 0.2.2 PHP PHP 0.2.3 PHP PHP 0.2.4 PHP PHP 0.3 PHP PHP 0.4 PHP PHP 0.5 PHP PHP 0.5.2 PHP PHP 0.5.3 PHP PHP 0.6 PHP PHP 0.7 PHP PHP 0.9 PHP PHP 0.9.0 PHP PHP 0.9.1 PHP PHP 0.9.2 PHP PHP 0.9.3 PHP PHP 0.9.4 PHP PHP 0.10 PHP PHP 0.11 PHP PHP 0.90 PHP PHP 0.91 PHP PHP 1.0 PHP PHP 1.0.0 PHP PHP 1.0.1 PHP PHP 1.0.2 PHP PHP 1.0.3 PHP PHP 1.0.4 PHP PHP 1.1 PHP PHP 1.1.0 PHP PHP 1.1.1 PHP PHP 1.2 PHP PHP 1.2.0 PHP PHP 1.2.1 PHP PHP 1.2.2 PHP PHP 1.2.3 PHP PHP 1.2.4 PHP PHP 1.2.5 PHP PHP 1.3 PHP PHP 1.3.1 PHP PHP 1.3.5 PHP PHP 1.4 PHP PHP 1.5 PHP PHP 2.0 PHP PHP 2.0.0 PHP PHP 2.0.1 PHP PHP 2.0.2 PHP PHP 2.0B10 PHP PHP 3.0 PHP PHP 3.0.1 PHP PHP 3.0.2 PHP PHP 3.0.3 PHP PHP 3.0.4 PHP PHP 3.0.5 PHP PHP 3.0.6 PHP PHP 3.0.7 PHP PHP 3.0.8 PHP PHP 3.0.9 PHP PHP 3.0.10 PHP PHP 3.0.11 PHP PHP 3.0.12 PHP PHP 3.0.13 PHP PHP 3.0.14 PHP PHP 3.0.15 PHP PHP 3.0.16 PHP PHP 3.0.17 PHP PHP 3.0.18 PHP PHP 4.0 PHP PHP 4.0.0 PHP PHP 4.0.1 PHP PHP 4.0.2 PHP PHP 4.0.3 PHP PHP 4.0.4 PHP PHP 4.0.5 PHP PHP 4.0.6 PHP PHP 4.0.7 PHP PHP 4.1.0 PHP PHP 4.1.1 PHP PHP 4.1.2 PHP PHP 4.1.3 PHP PHP 4.2 PHP PHP 4.2.0 PHP PHP 4.2.1 PHP PHP 4.2.2 PHP PHP 4.2.3 PHP PHP 4.2.4 PHP PHP 4.3 PHP PHP 4.3.0 PHP PHP 4.3.1 PHP PHP 4.3.2 PHP PHP 4.3.3 PHP PHP 4.3.4 PHP PHP 4.3.5 PHP PHP 4.3.6 PHP PHP 4.3.7 PHP PHP 4.3.8 PHP PHP 4.3.9 PHP PHP 4.3.10 PHP PHP 4.3.11 PHP PHP 4.4.0 PHP PHP 4.4.1 PHP PHP 4.4.2 PHP PHP 4.4.3 PHP PHP 4.4.4 PHP PHP 4.4.5 PHP PHP 4.4.6 PHP PHP 4.4.7 PHP PHP 4.4.8 PHP PHP 4.4.9 PHP PHP 5.0.0 PHP PHP 5.0.1 PHP PHP 5.0.2 PHP PHP 5.0.3 PHP PHP 5.0.4 PHP PHP 5.0.5 PHP PHP 5.1 PHP PHP 5.1.0 PHP PHP 5.1.1 PHP PHP 5.1.2 PHP PHP 5.1.3 PHP PHP 5.1.4 PHP PHP 5.1.5 PHP PHP 5.1.6 PHP PHP 5.2.0 PHP PHP 5.2.1 PHP PHP 5.2.2 PHP PHP 5.2.3 PHP PHP 5.2.4 PHP PHP 5.2.5 PHP PHP 5.2.6 PHP PHP 5.2.7 PHP PHP 5.2.8 PHP PHP 5.2.9 PHP PHP 5.2.10 PHP PHP 5.2.11 PHP PHP 5.2.12 PHP PHP 5.2.13 PHP PHP 5.2.14 PHP PHP 5.2.15 PHP PHP 5.2.16 PHP PHP 5.2.17 PHP PHP 5.3.0 PHP PHP 5.3.1 PHP PHP 5.3.2 PHP PHP 5.3.3 PHP PHP 5.3.4 PHP PHP 5.3.5 PHP PHP 5.3.6 PHP PHP 5.3.7 PHP PHP 5.3.8 PHP PHP 5.3.9 PHP PHP 5.3.10 PHP PHP 5.3.11 PHP PHP 5.3.12 PHP PHP 5.3.13 PHP PHP 5.3.14 PHP PHP 5.3.15 PHP PHP 5.3.16 PHP PHP 5.3.17 PHP PHP 5.3.18 PHP PHP 5.3.19 PHP PHP 5.3.20 PHP PHP 5.3.21 PHP PHP 5.3.22 PHP PHP 5.3.23 PHP PHP 5.3.24 PHP PHP 5.3.25 PHP PHP 5.3.26 PHP PHP 5.3.27 PHP PHP 5.3.28 PHP PHP 5.3.29 PHP PHP 5.4.0 PHP PHP 5.4.1 PHP PHP 5.4.2 PHP PHP 5.4.3 PHP PHP 5.4.4 PHP PHP 5.4.5 PHP PHP 5.4.6 PHP PHP 5.4.7 PHP PHP 5.4.8 PHP PHP 5.4.9 PHP PHP 5.4.10 PHP PHP 5.4.11 PHP PHP 5.4.12 PHP PHP 5.4.13 PHP PHP 5.4.14 PHP PHP 5.4.15 PHP PHP 5.4.16 PHP PHP 5.4.17 PHP PHP 5.4.18 PHP PHP 5.4.19 PHP PHP 5.4.20 PHP PHP 5.4.21 PHP PHP 5.4.22 PHP PHP 5.4.23 PHP PHP 5.4.24 PHP PHP 5.4.25 PHP PHP 5.4.26 PHP PHP 5.4.27 PHP PHP 5.4.28 PHP PHP 5.4.29 PHP PHP 5.4.30 PHP PHP 5.4.31 PHP PHP 5.4.32 PHP PHP 5.4.33 PHP PHP 5.4.34 PHP PHP 5.4.35 PHP PHP 5.4.36 PHP PHP 5.4.37 PHP PHP 5.4.38 PHP PHP 5.4.39 PHP PHP 5.4.40 PHP PHP 5.4.41 PHP PHP 5.4.42 PHP PHP 5.4.43 PHP PHP 5.4.44 PHP PHP 5.4.45 PHP PHP 5.5.0 PHP PHP 5.5.1 PHP PHP 5.5.2 PHP PHP 5.5.3 PHP PHP 5.5.4 PHP PHP 5.5.5 PHP PHP 5.5.6 PHP PHP 5.5.7 PHP PHP 5.5.8 PHP PHP 5.5.9 PHP PHP 5.5.10 PHP PHP 5.5.11 PHP PHP 5.5.12 PHP PHP 5.5.13 PHP PHP 5.5.14 PHP PHP 5.5.15 PHP PHP 5.5.16 PHP PHP 5.5.17 PHP PHP 5.5.18 PHP PHP 5.5.19 PHP PHP 5.5.20 PHP PHP 5.5.21 PHP PHP 5.5.22 PHP PHP 5.5.23 PHP PHP 5.5.24 PHP PHP 5.5.25 PHP PHP 5.5.26 PHP PHP 5.5.27 PHP PHP 5.5.28 PHP PHP 5.5.29 PHP PHP 5.5.30 PHP PHP 5.5.31 PHP PHP 5.5.32 PHP PHP 5.5.33 PHP PHP 5.5.34 PHP PHP 5.5.35 PHP PHP 5.5.36 PHP PHP 5.5.37 PHP PHP 5.5.38 PHP PHP 5.6.0 PHP PHP 5.6.1 PHP PHP 5.6.2 PHP PHP 5.6.3 PHP PHP 5.6.4 PHP PHP 5.6.5 PHP PHP 5.6.6 PHP PHP 5.6.7 PHP PHP 5.6.8 PHP PHP 5.6.9 PHP PHP 5.6.10 PHP PHP 5.6.11 PHP PHP 5.6.12 PHP PHP 5.6.13 PHP PHP 5.6.14 PHP PHP 5.6.15 PHP PHP 5.6.16 PHP PHP 5.6.17 PHP PHP 5.6.18 PHP PHP 5.6.19 PHP PHP 5.6.20 PHP PHP 5.6.21 PHP PHP 5.6.22 PHP PHP 5.6.23 PHP PHP 5.6.24 PHP PHP 5.6.25 PHP PHP 5.6.26 PHP PHP 5.6.27 PHP PHP 5.6.28 PHP PHP 5.6.29 PHP PHP 5.6.30 PHP PHP 5.6.31 PHP PHP 5.6.32 PHP PHP 5.6.33 PHP PHP 5.6.34 PHP PHP 5.6.35 PHP PHP 5.6.36 PHP PHP 5.6.37 PHP PHP 5.6.38 PHP PHP 5.6.39 PHP PHP 7.0.0 PHP PHP 7.0.1 PHP PHP 7.0.2 PHP PHP 7.0.3 PHP PHP 7.0.4 PHP PHP 7.0.5 PHP PHP 7.0.6 PHP PHP 7.0.7 PHP PHP 7.0.8 PHP PHP 7.0.9 PHP PHP 7.0.10 PHP PHP 7.0.11 PHP PHP 7.0.12 PHP PHP 7.0.13 PHP PHP 7.0.14 PHP PHP 7.0.15 PHP PHP 7.0.16 PHP PHP 7.0.17 PHP PHP 7.0.18 PHP PHP 7.0.19 PHP PHP 7.0.20 PHP PHP 7.0.21 PHP PHP 7.0.22 PHP PHP 7.0.23 PHP PHP 7.0.24 PHP PHP 7.0.25 PHP PHP 7.0.26 PHP PHP 7.0.27 PHP PHP 7.0.28 PHP PHP 7.0.29 PHP PHP 7.0.30 PHP PHP 7.0.31 PHP PHP 7.0.32 PHP PHP 7.0.33 PHP PHP 7.1.0 PHP PHP 7.1.1 PHP PHP 7.1.2 PHP PHP 7.1.3 PHP PHP 7.1.4 PHP PHP 7.1.5 PHP PHP 7.1.6 PHP PHP 7.1.7 PHP PHP 7.1.8 PHP PHP 7.1.9 PHP PHP 7.1.10 PHP PHP 7.1.11 PHP PHP 7.1.12 PHP PHP 7.1.13 PHP PHP 7.1.14 PHP PHP 7.1.15 PHP PHP 7.1.16 PHP PHP 7.1.17 PHP PHP 7.1.18 PHP PHP 7.1.19 PHP PHP 7.1.20 PHP PHP 7.1.21 PHP PHP 7.1.22 PHP PHP 7.1.23 PHP PHP 7.1.24 PHP PHP 7.1.25 PHP PHP 7.2.0 PHP PHP 7.2.1 PHP PHP 7.2.2 PHP PHP 7.2.3 PHP PHP 7.2.4 PHP PHP 7.2.5 PHP PHP 7.2.6 PHP PHP 7.2.7 PHP PHP 7.2.8 PHP PHP 7.2.9 PHP PHP 7.2.10 PHP PHP 7.2.11 PHP PHP 7.2.12 PHP PHP 7.2.13 PHP PHP 7.3.0	1082
Application	Netapp Netapp Storage Automation Store -	1
OS	Debian Debian Debian Linux 9.0	1
OS	Canonical Canonical Ubuntu Linux 12.04 Canonical Ubuntu Linux 14.04 Canonical Ubuntu Linux 16.04	3
OS	Opensuse Opensuse Leap 42.3	1

Common Weakness Enumeration (CWE)

CWE-416 - Use After Free

Nessus

NASL family	Huawei Local Security Checks
NASL id	EULEROS_SA-2019-1402.NASL
description	According to the versions of the php packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. Invalid input to the function xmlrpc_decode() can lead to an invalid memory access (heap out of bounds read or read after free). This is related to xml_elem_parse_buf in ext/xmlrpc/libxmlrpc/xml_element.c.(CVE-2019-9020) - In PHP before 5.6.39, 7.x before 7.0.33, 7.1.x before 7.1.25, and 7.2.x before 7.2.13, a buffer over-read in PHAR reading functions may allow an attacker to read allocated or unallocated memory past the actual data when trying to parse a .phar file. This is related to phar_parse_pharfile in ext/phar/phar.c.(CVE-2018-20783) - An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. A number of heap-based buffer over-read instances are present in mbstring regular expression functions when supplied with invalid multibyte data. These occur in ext/mbstring/oniguruma/regcomp.c, ext/mbstring/oniguruma/regexec.c, ext/mbstring/oniguruma/regparse.c, ext/mbstring/oniguruma/enc/unicode.c, and ext/mbstring/oniguruma/src/utf32_be.c when a multibyte regular expression pattern contains invalid multibyte sequences.(CVE-2019-9023) - An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. A heap-based buffer over-read in PHAR reading functions in the PHAR extension may allow an attacker to read allocated or unallocated memory past the actual data when trying to parse the file name, a different vulnerability than CVE-2018-20783. This is related to phar_detect_phar_fname_ext in ext/phar/phar.c.(CVE-2019-9021) - An issue was discovered in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. Due to the way rename() across filesystems is implemented, it is possible that file being renamed is briefly available with wrong permissions while the rename is ongoing, thus enabling unauthorized users to access the data.(CVE-2019-9637) - An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. xmlrpc_decode() can allow a hostile XMLRPC server to cause PHP to read memory outside of allocated areas in base64_decode_xmlrpc in ext/xmlrpc/libxmlrpc/base64.c.(CVE-2019-9024) - An integer overflow flaw, leading to a heap-based buffer overflow was found in the way libgd read some specially-crafted gd2 files. A remote attacker could use this flaw to crash an application compiled with libgd or in certain cases execute arbitrary code with the privileges of the user running that application.(CVE-2016-1016) - A null pointer dereference flaw was found in libgd. An attacker could use a specially-crafted .gd2 file to cause an application linked with libgd to crash, leading to denial of service.(CVE-2016-10167) - A data leak was found in gdImageCreateFromGifCtx() in GD Graphics Library used in PHP before 5.6.31 and 7.1.7. An attacker could craft a malicious GIF image and read up to 762 bytes from stack.(CVE-2017-7890) - gdImageColorMatch in gd_color_match.c in the GD Graphics Library (aka LibGD) 2.2.5, as used in the imagecolormatch function in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1, has a heap-based buffer overflow. This can be exploited by an attacker who is able to trigger imagecolormatch calls with crafted image data.(CVE-2019-6977) Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	124905
published	2019-05-14
reporter	This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/124905
title	EulerOS Virtualization for ARM 64 3.0.1.0 : php (EulerOS-SA-2019-1402)

NASL family	CGI abuses
NASL id	PHP_5_6_40.NASL
description	According to its banner, the version of PHP running on the remote web server is 5.6.x prior to 5.6.40. It is, therefore, affected by multiple vulnerabilities: - An integer underflow condition exists in _gdContributionsAlloc function in gd_interpolation.c. An unauthenticated, remote attacker can have unspecified impact via vectors related to decrementing the u variable. (CVE-2016-10166) - A heap-based buffer overflow condition exists in gdImageColorMatch due to improper calculation of the allocated buffer size. An attacker can exploit this, via calling imagecolormatch function with crafted image data as parameters. (CVE-2019-6977) - A heap-based buffer over-read exists in the xmlrpc_decode function due to improper validation of input data. An unauthenticated, remote attacker can exploit this, via a specially crafted request, to cause a heap out-of-bounds read or read-after-free condition, which could result in a complete system compromise. (CVE-2019-9020) - A heap-based buffer over-read exists in the PHAR reading functions in the PHAR extension, due to improper implementation of memory operations. An unauthenticated, remote attacker can exploit this, via persuading a user to parse a specially crafted file name on the targeted system, to disclose sensitive information. (CVE-2019-9021) - Multiple heap-based buffer over-read instances exist in mbstring regular expression functions due to improper implementation of memory operations. An unauthenticated, remote attacker can exploit this by sending a specially crafted regular expression that contains multibyte sequences, to cause a condition that could allow the attacker to completely compromise the target system. (CVE-2019-9023) - An out-of-bounds read error exists in the xmlrpc_decode function due to improper implementation of memory operations. An unauthenticated, remote attacker can exploit this, via a hostile XMLRPC server to cause PHP to read from memory outside of allocated areas. (CVE-2019-9024)
last seen	2020-06-01
modified	2020-06-02
plugin id	121602
published	2019-02-06
reporter	This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/121602
title	PHP 5.6.x < 5.6.40 Multiple vulnerabilities.

NASL family	SuSE Local Security Checks
NASL id	SUSE_SU-2019-1461-1.NASL
description	This update for php7 fixes the following issues : Security issues fixed : CVE-2019-9637: Fixed improper implementation of rename function and multiple invalid memory access in EXIF extension (bsc#1128892). CVE-2019-9675: Fixed improper implementation of rename function and multiple invalid memory access in EXIF extension (bsc#1128886). CVE-2019-9638: Fixed improper implementation of rename function and multiple invalid memory access in EXIF extension ((bsc#1128889). CVE-2019-9639: Fixed improper implementation of rename function and multiple invalid memory access in EXIF extension (bsc#1128887). CVE-2019-9640: Fixed improper implementation of rename function and multiple invalid memory access in EXIF extension (bsc#1128883). CVE-2019-9022: Fixed a vulnerability which could allow a hostile DNS server to make PHP misuse memcpy (bsc#1126827). CVE-2019-9024: Fixed a vulnerability in xmlrpc_decode function which could allow to a hostile XMLRPC server to cause memory read outside the allocated areas (bsc#1126821). CVE-2019-9020: Fixed a heap out of bounds in xmlrpc_decode function (bsc#1126711). CVE-2018-20783: Fixed a buffer over-read in PHAR reading functions which could allow an attacker to read allocated and unallocated memory when parsing a phar file (bsc#1127122). CVE-2019-9021: Fixed a heap buffer-based buffer over-read in PHAR reading functions which could allow an attacker to read allocated and unallocated memory when parsing a phar file (bsc#1126713). CVE-2019-9023: Fixed multiple heap-based buffer over-read instances in mbstring regular expression functions (bsc#1126823). CVE-2019-9641: Fixed multiple invalid memory access in EXIF extension and improved insecure implementation of rename function (bsc#1128722). CVE-2018-19935: Fixed a Denial of Service in php_imap.c which could be triggered via an empty string in the message argument to imap_mail (bsc#1118832). CVE-2019-11034: Fixed a heap-buffer overflow in php_ifd_get32si() (bsc#1132838). CVE-2019-11035: Fixed a heap-buffer overflow in exif_iif_add_value() (bsc#1132837). CVE-2019-11036: Fixed buffer over-read in exif_process_IFD_TAG function leading to information disclosure (bsc#1134322). Other issue addressed: Deleted README.default_socket_timeout which is not needed anymore (bsc#1129032). Enabled php7 testsuite (bsc#1119396). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	125850
published	2019-06-12
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/125850
title	SUSE SLED15 / SLES15 Security Update : php7 (SUSE-SU-2019:1461-1)

NASL family	Ubuntu Local Security Checks
NASL id	UBUNTU_USN-3902-1.NASL
description	It was discovered that the PHP XML-RPC module incorrectly handled decoding XML data. A remote attacker could possibly use this issue to cause PHP to crash, resulting in a denial of service. (CVE-2019-9020, CVE-2019-9024) It was discovered that the PHP PHAR module incorrectly handled certain filenames. A remote attacker could possibly use this issue to cause PHP to crash, resulting in a denial of service. (CVE-2019-9021) It was discovered that PHP incorrectly parsed certain DNS responses. A remote attacker could possibly use this issue to cause PHP to crash, resulting in a denial of service. This issue only affected Ubuntu 16.04 LTS. (CVE-2019-9022) It was discovered that PHP incorrectly handled mbstring regular expressions. A remote attacker could possibly use this issue to cause PHP to crash, resulting in a denial of service. (CVE-2019-9023). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	122667
published	2019-03-07
reporter	Ubuntu Security Notice (C) 2019-2020 Canonical, Inc. / NASL script (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/122667
title	Ubuntu 14.04 LTS / 16.04 LTS : php5, php7.0 vulnerabilities (USN-3902-1)

NASL family	CGI abuses
NASL id	PHP_7_2_14.NASL
description	According to its banner, the version of PHP running on the remote web server is 7.2.x prior to 7.2.14. It is, therefore, affected by multiple vulnerabilities: - An integer underflow condition exists in _gdContributionsAlloc function in gd_interpolation.c. An unauthenticated, remote attacker can have unspecified impact via vectors related to decrementing the u variable. (CVE-2016-10166) - A denial of service (DoS) vulnerability exists in ext/imap/php_imap.c. An unauthenticated, remote attacker can exploit this issue, via an empty string in the message argument to the imap_mail function, to cause the application to stop responding. (CVE-2018-19935) - A heap-based buffer overflow exists in gdImageColorMatch in gd_color_match.c in the GD Graphics Library (aka LibGD) 2.2.5. An unauthenticated, remote attacker can exploit this via the triggering of imagecolormatch calls with crafted image data, to cause a denial of service condition or the execution of arbitrary code. (CVE-2019-6977) - A heap-based buffer over-read exists in the xmlrpc_decode function due to improper validation of input data. An unauthenticated, remote attacker can exploit this, via a specially crafted request, to cause a heap out-of-bounds read or read-after-free condition, which could result in a complete system compromise. (CVE-2019-9020) - A heap-based buffer over-read exists in the PHAR reading functions in the PHAR extension, due to improper implementation of memory operations. An unauthenticated, remote attacker can exploit this, via persuading a user to parse a specially crafted file name on the targeted system, to disclose sensitive information. (CVE-2019-9021) - An information disclosure vulnerability exists in the dns_get_record function due to improper parsing of DNS responses. An unauthenticated, remote attacker can exploit this, via a specially crafted DNS reply sent from a rogue DNS server to disclose potentially sensitive information. (CVE-2019-9022) - Multiple heap-based buffer over-read instances exist in mbstring regular expression functions due to improper implementation of memory operations. An unauthenticated, remote attacker can exploit this by sending a specially crafted regular expression that contains multibyte sequences, to cause a condition that could allow the attacker to completely compromise the target system. (CVE-2019-9023) - An out-of-bounds read error exists in the xmlrpc_decode function due to improper implementation of memory operations. An unauthenticated, remote attacker can exploit this, via a hostile XMLRPC server to cause PHP to read from memory outside of allocated areas. (CVE-2019-9024)
last seen	2020-06-01
modified	2020-06-02
plugin id	121353
published	2019-01-24
reporter	This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/121353
title	PHP 7.2.x < 7.2.14 Multiple vulnerabilities.

NASL family	Huawei Local Security Checks
NASL id	EULEROS_SA-2019-1120.NASL
description	According to the versions of the php packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - In PHP before 5.6.39, 7.x before 7.0.33, 7.1.x before 7.1.25, and 7.2.x before 7.2.13, a buffer over-read in PHAR reading functions may allow an attacker to read allocated or unallocated memory past the actual data when trying to parse a .phar file. This is related to phar_parse_pharfile in ext/phar/phar.c.(CVE-2018-20783) - An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. Invalid input to the function xmlrpc_decode() can lead to an invalid memory access (heap out of bounds read or read after free). This is related to xml_elem_parse_buf in ext/xmlrpc/libxmlrpc/xml_element.c.(CVE-2019-9020) - An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. A heap-based buffer over-read in PHAR reading functions in the PHAR extension may allow an attacker to read allocated or unallocated memory past the actual data when trying to parse the file name, a different vulnerability than CVE-2018-20783. This is related to phar_detect_phar_fname_ext in ext/phar/phar.c.(CVE-2019-9021) - An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. A number of heap-based buffer over-read instances are present in mbstring regular expression functions when supplied with invalid multibyte data. These occur in ext/mbstring/oniguruma/regcomp.c, ext/mbstring/oniguruma/regexec.c, ext/mbstring/oniguruma/regparse.c, ext/mbstring/oniguruma/enc/unicode.c, and ext/mbstring/oniguruma/src/utf32_be.c when a multibyte regular expression pattern contains invalid multibyte sequences.(CVE-2019-9023) - An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. xmlrpc_decode() can allow a hostile XMLRPC server to cause PHP to read memory outside of allocated areas in base64_decode_xmlrpc in ext/xmlrpc/libxmlrpc/base64.c.(CVE-2019-9024) Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-05-06
modified	2019-04-02
plugin id	123594
published	2019-04-02
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/123594
title	EulerOS 2.0 SP2 : php (EulerOS-SA-2019-1120)

NASL family	CGI abuses
NASL id	PHP_7_1_26.NASL
description	According to its banner, the version of PHP running on the remote web server is 7.1.x prior to 7.1.26. It is, therefore, affected by multiple vulnerabilities: - An integer underflow condition exists in _gdContributionsAlloc function in gd_interpolation.c. An unauthenticated, remote attacker can have unspecified impact via vectors related to decrementing the u variable. (CVE-2016-10166) - A denial of service (DoS) vulnerability exists in ext/imap/php_imap.c. An unauthenticated, remote attacker can exploit this issue, via an empty string in the message argument to the imap_mail function, to cause the application to stop responding. (CVE-2018-19935) - A heap-based buffer overflow condition exists in gdImageColorMatch due to improper calculation of the allocated buffer size. An unauthenticated, remote attacker can exploit this via calling the imagecolormatch function with crafted image data as parameters, to cause a denial of service condition or the execution of arbitrary code. (CVE-2019-6977) - A heap-based buffer over-read exists in the xmlrpc_decode function due to improper validation of input data. An unauthenticated, remote attacker can exploit this, via a specially crafted request, to cause a heap out-of-bounds read or read-after-free condition, which could result in a complete system compromise. (CVE-2019-9020) - A heap-based buffer over-read exists in the PHAR reading functions in the PHAR extension, due to improper implementation of memory operations. An unauthenticated, remote attacker can exploit this, via persuading a user to parse a specially crafted file name on the targeted system, to disclose sensitive information. (CVE-2019-9021) - An information disclosure vulnerability exists in the dns_get_record function due to improper parsing of DNS responses. An unauthenticated, remote attacker can exploit this, via a specially crafted DNS reply sent from a rogue DNS server to disclose potentially sensitive information. (CVE-2019-9022) - Multiple heap-based buffer over-read instances exist in mbstring regular expression functions due to improper implementation of memory operations. An unauthenticated, remote attacker can exploit this by sending a specially crafted regular expression that contains multibyte sequences, to cause a condition that could allow the attacker to completely compromise the target system. (CVE-2019-9023) - An out-of-bounds read error exists in the xmlrpc_decode function due to improper implementation of memory operations. An unauthenticated, remote attacker can exploit this, via a hostile XMLRPC server to cause PHP to read from memory outside of allocated areas. (CVE-2019-9024)
last seen	2020-06-01
modified	2020-06-02
plugin id	121510
published	2019-01-31
reporter	This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/121510
title	PHP 7.1.x < 7.1.26 Multiple vulnerabilities.

NASL family	SuSE Local Security Checks
NASL id	OPENSUSE-2019-1293.NASL
description	This update for php7 fixes the following issues: Security issues fixed: - CVE-2019-9637: Fixed improper implementation of rename function and multiple invalid memory access in EXIF extension (bsc#1128892). - CVE-2019-9675: Fixed improper implementation of rename function and multiple invalid memory access in EXIF extension (bsc#1128886). - CVE-2019-9638: Fixed improper implementation of rename function and multiple invalid memory access in EXIF extension ((bsc#1128889). - CVE-2019-9639: Fixed improper implementation of rename function and multiple invalid memory access in EXIF extension (bsc#1128887). - CVE-2019-9640: Fixed improper implementation of rename function and multiple invalid memory access in EXIF extension (bsc#1128883). - CVE-2019-9024: Fixed a vulnerability in xmlrpc_decode function which could allow to a hostile XMLRPC server to cause memory read outside the allocated areas (bsc#1126821). - CVE-2019-9020: Fixed a heap out of bounds in xmlrpc_decode function (bsc#1126711). - CVE-2018-20783: Fixed a buffer over-read in PHAR reading functions which could allow an attacker to read allocated and unallocated memory when parsing a phar file (bsc#1127122). - CVE-2019-9021: Fixed a heap buffer-based buffer over-read in PHAR reading functions which could allow an attacker to read allocated and unallocated memory when parsing a phar file (bsc#1126713). - CVE-2019-9023: Fixed multiple heap-based buffer over-read instances in mbstring regular expression functions (bsc#1126823). - CVE-2019-9641: Fixed multiple invalid memory access in EXIF extension and improved insecure implementation of rename function (bsc#1128722). Other issue addressed : - Deleted README.default_socket_timeout which is not needed anymore (bsc#1129032). This update was imported from the SUSE:SLE-12:Update update project.
last seen	2020-06-01
modified	2020-06-02
plugin id	124401
published	2019-04-30
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/124401
title	openSUSE Security Update : php7 (openSUSE-2019-1293)

NASL family	SuSE Local Security Checks
NASL id	SUSE_SU-2019-0985-1.NASL
description	This update for php5 fixes the following issues : Security issues fixed : CVE-2019-9024: Fixed a vulnerability in xmlrpc_decode function which could allow to a hostile XMLRPC server to cause memory read outside the allocated areas (bsc#1126821). CVE-2019-9020: Fixed a heap out of bounds in xmlrpc_decode function (bsc#1126711). CVE-2018-20783: Fixed a buffer over-read in PHAR reading functions which could allow an attacker to read allocated and unallocated memory when parsing a phar file (bsc#1127122). CVE-2019-9021: Fixed a heap buffer-based buffer over-read in PHAR reading functions which could allow an attacker to read allocated and unallocated memory when parsing a phar file (bsc#1126713). CVE-2019-9023: Fixed multiple heap-based buffer over-read instances in mbstring regular expression functions (bsc#1126823). CVE-2019-9641: Fixed multiple invalid memory access in EXIF extension and improved insecure implementation of rename function (bsc#1128722). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	124190
published	2019-04-19
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/124190
title	SUSE SLES12 Security Update : php5 (SUSE-SU-2019:0985-1)

NASL family	SuSE Local Security Checks
NASL id	OPENSUSE-2019-1256.NASL
description	This update for php5 fixes the following issues : Security issues fixed: - CVE-2019-9024: Fixed a vulnerability in xmlrpc_decode function which could allow to a hostile XMLRPC server to cause memory read outside the allocated areas (bsc#1126821). - CVE-2019-9020: Fixed a heap out of bounds in xmlrpc_decode function (bsc#1126711). - CVE-2018-20783: Fixed a buffer over-read in PHAR reading functions which could allow an attacker to read allocated and unallocated memory when parsing a phar file (bsc#1127122). - CVE-2019-9021: Fixed a heap buffer-based buffer over-read in PHAR reading functions which could allow an attacker to read allocated and unallocated memory when parsing a phar file (bsc#1126713). - CVE-2019-9023: Fixed multiple heap-based buffer over-read instances in mbstring regular expression functions (bsc#1126823). - CVE-2019-9641: Fixed multiple invalid memory access in EXIF extension and improved insecure implementation of rename function (bsc#1128722). This update was imported from the SUSE:SLE-12:Update update project.
last seen	2020-06-01
modified	2020-06-02
plugin id	124263
published	2019-04-24
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/124263
title	openSUSE Security Update : php5 (openSUSE-2019-1256)

NASL family	Red Hat Local Security Checks
NASL id	REDHAT-RHSA-2020-1624.NASL
description	The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1624 advisory. - php: Buffer over-read in PHAR reading functions (CVE-2018-20783) - php: Heap buffer overflow in function exif_process_IFD_TAG() (CVE-2019-11034) - php: Heap buffer overflow in function exif_iif_add_value() (CVE-2019-11035) - php: Buffer over-read in exif_process_IFD_TAG() leading to information disclosure (CVE-2019-11036) - php: Out-of-bounds read due to integer overflow in iconv_mime_decode_headers() (CVE-2019-11039) - php: Buffer over-read in exif_read_data() (CVE-2019-11040) - php: Heap buffer over-read in exif_scan_thumbnail() (CVE-2019-11041) - php: Heap buffer over-read in exif_process_user_comment() (CVE-2019-11042) - php: Invalid memory access in function xmlrpc_decode() (CVE-2019-9020) - php: Heap-based buffer over-read in PHAR reading functions (CVE-2019-9021) - php: memcpy with negative length via crafted DNS response (CVE-2019-9022) - php: Heap-based buffer over-read in mbstring regular expression functions (CVE-2019-9023) - php: Out-of-bounds read in base64_decode_xmlrpc in ext/xmlrpc/libxmlrpc/base64.c (CVE-2019-9024) - php: File rename across filesystems may allow unwanted access during processing (CVE-2019-9637) - php: Uninitialized read in exif_process_IFD_in_MAKERNOTE (CVE-2019-9638, CVE-2019-9639) - php: Invalid read in exif_process_SOFn() (CVE-2019-9640) Note that Nessus has not tested for this issue but has instead relied only on the application
last seen	2020-05-21
modified	2020-04-28
plugin id	136057
published	2020-04-28
reporter	This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/136057
title	RHEL 8 : php:7.2 (RHSA-2020:1624)

NASL family	SuSE Local Security Checks
NASL id	SUSE_SU-2019-14013-1.NASL
description	This update for php53 fixes the following issues : Security issues fixed : CVE-2019-9637: Fixed improper implementation of rename function and multiple invalid memory access in EXIF extension (bsc#1128892). CVE-2019-9675: Fixed improper implementation of rename function and multiple invalid memory access in EXIF extension (bsc#1128886). CVE-2019-9638: Fixed improper implementation of rename function and multiple invalid memory access in EXIF extension ((bsc#1128889). CVE-2019-9639: Fixed improper implementation of rename function and multiple invalid memory access in EXIF extension (bsc#1128887). CVE-2019-9640: Fixed improper implementation of rename function and multiple invalid memory access in EXIF extension (bsc#1128883). CVE-2019-9024: Fixed a vulnerability in xmlrpc_decode function which could allow to a hostile XMLRPC server to cause memory read outside the allocated areas (bsc#1126821). CVE-2019-9020: Fixed a heap out of bounds in xmlrpc_decode function (bsc#1126711). CVE-2018-20783: Fixed a buffer over-read in PHAR reading functions which could allow an attacker to read allocated and unallocated memory when parsing a phar file (bsc#1127122). CVE-2019-9021: Fixed a heap buffer-based buffer over-read in PHAR reading functions which could allow an attacker to read allocated and unallocated memory when parsing a phar file (bsc#1126713). CVE-2019-9023: Fixed multiple heap-based buffer over-read instances in mbstring regular expression functions (bsc#1126823). CVE-2019-9641: Fixed multiple invalid memory access in EXIF extension and improved insecure implementation of rename function (bsc#1128722). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	123826
published	2019-04-08
reporter	This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/123826
title	SUSE SLES11 Security Update : php53 (SUSE-SU-2019:14013-1)

NASL family	Debian Local Security Checks
NASL id	DEBIAN_DSA-4398.NASL
description	Multiple security issues were found in PHP, a widely-used open source general purpose scripting language: Multiple out-of-bounds memory accesses were found in the xmlrpc, mbstring and phar extensions and the dns_get_record() function.
last seen	2020-06-01
modified	2020-06-02
plugin id	122517
published	2019-03-01
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/122517
title	Debian DSA-4398-1 : php7.0 - security update

NASL family	SuSE Local Security Checks
NASL id	OPENSUSE-2019-1572.NASL
description	This update for php7 fixes the following issues : Security issues fixed : - CVE-2019-9637: Fixed improper implementation of rename function and multiple invalid memory access in EXIF extension (bsc#1128892). - CVE-2019-9675: Fixed improper implementation of rename function and multiple invalid memory access in EXIF extension (bsc#1128886). - CVE-2019-9638: Fixed improper implementation of rename function and multiple invalid memory access in EXIF extension ((bsc#1128889). - CVE-2019-9639: Fixed improper implementation of rename function and multiple invalid memory access in EXIF extension (bsc#1128887). - CVE-2019-9640: Fixed improper implementation of rename function and multiple invalid memory access in EXIF extension (bsc#1128883). - CVE-2019-9022: Fixed a vulnerability which could allow a hostile DNS server to make PHP misuse memcpy (bsc#1126827). - CVE-2019-9024: Fixed a vulnerability in xmlrpc_decode function which could allow to a hostile XMLRPC server to cause memory read outside the allocated areas (bsc#1126821). - CVE-2019-9020: Fixed a heap out of bounds in xmlrpc_decode function (bsc#1126711). - CVE-2018-20783: Fixed a buffer over-read in PHAR reading functions which could allow an attacker to read allocated and unallocated memory when parsing a phar file (bsc#1127122). - CVE-2019-9021: Fixed a heap buffer-based buffer over-read in PHAR reading functions which could allow an attacker to read allocated and unallocated memory when parsing a phar file (bsc#1126713). - CVE-2019-9023: Fixed multiple heap-based buffer over-read instances in mbstring regular expression functions (bsc#1126823). - CVE-2019-9641: Fixed multiple invalid memory access in EXIF extension and improved insecure implementation of rename function (bsc#1128722). - CVE-2018-19935: Fixed a Denial of Service in php_imap.c which could be triggered via an empty string in the message argument to imap_mail (bsc#1118832). - CVE-2019-11034: Fixed a heap-buffer overflow in php_ifd_get32si() (bsc#1132838). - CVE-2019-11035: Fixed a heap-buffer overflow in exif_iif_add_value() (bsc#1132837). - CVE-2019-11036: Fixed buffer over-read in exif_process_IFD_TAG function leading to information disclosure (bsc#1134322). Other issue addressed : - Deleted README.default_socket_timeout which is not needed anymore (bsc#1129032). - Enabled php7 testsuite (bsc#1119396). This update was imported from the SUSE:SLE-15:Update update project.
last seen	2020-06-01
modified	2020-06-02
plugin id	126034
published	2019-06-19
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/126034
title	openSUSE Security Update : php7 (openSUSE-2019-1572)

NASL family	Huawei Local Security Checks
NASL id	EULEROS_SA-2019-1146.NASL
description	According to the versions of the php packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - In PHP before 5.6.39, 7.x before 7.0.33, 7.1.x before 7.1.25, and 7.2.x before 7.2.13, a buffer over-read in PHAR reading functions may allow an attacker to read allocated or unallocated memory past the actual data when trying to parse a .phar file. This is related to phar_parse_pharfile in ext/phar/phar.c.(CVE-2018-20783) - An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. Invalid input to the function xmlrpc_decode() can lead to an invalid memory access (heap out of bounds read or read after free). This is related to xml_elem_parse_buf in ext/xmlrpc/libxmlrpc/xml_element.c.(CVE-2019-9020) - An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. A heap-based buffer over-read in PHAR reading functions in the PHAR extension may allow an attacker to read allocated or unallocated memory past the actual data when trying to parse the file name, a different vulnerability than CVE-2018-20783. This is related to phar_detect_phar_fname_ext in ext/phar/phar.c.(CVE-2019-9021) - An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. A number of heap-based buffer over-read instances are present in mbstring regular expression functions when supplied with invalid multibyte data. These occur in ext/mbstring/oniguruma/regcomp.c, ext/mbstring/oniguruma/regexec.c, ext/mbstring/oniguruma/regparse.c, ext/mbstring/oniguruma/enc/unicode.c, and ext/mbstring/oniguruma/src/utf32_be.c when a multibyte regular expression pattern contains invalid multibyte sequences.(CVE-2019-9023) - An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. xmlrpc_decode() can allow a hostile XMLRPC server to cause PHP to read memory outside of allocated areas in base64_decode_xmlrpc in ext/xmlrpc/libxmlrpc/base64.c.(CVE-2019-9024) Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-05-06
modified	2019-04-02
plugin id	123620
published	2019-04-02
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/123620
title	EulerOS 2.0 SP5 : php (EulerOS-SA-2019-1146)

NASL family	Huawei Local Security Checks
NASL id	EULEROS_SA-2019-1265.NASL
description	According to the versions of the php packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. Invalid input to the function xmlrpc_decode() can lead to an invalid memory access (heap out of bounds read or read after free). This is related to xml_elem_parse_buf in ext/xmlrpc/libxmlrpc/xml_element.c.i1/4^CVE-2019-9020i1/4%0 - An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. A heap-based buffer over-read in PHAR reading functions in the PHAR extension may allow an attacker to read allocated or unallocated memory past the actual data when trying to parse the file name, a different vulnerability than CVE-2018-20783. This is related to phar_detect_phar_fname_ext in ext/phar/phar.c.i1/4^CVE-2019-9021i1/4%0 Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-03-19
modified	2019-04-04
plugin id	123733
published	2019-04-04
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/123733
title	EulerOS Virtualization 2.5.3 : php (EulerOS-SA-2019-1265)

NASL family	Huawei Local Security Checks
NASL id	EULEROS_SA-2019-1545.NASL
description	According to the versions of the php packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - A flaws was discovered in the way PHP performed object unserialization. Specially crafted input processed by the unserialize() function could cause a PHP application to crash or, possibly, execute arbitrary code.(CVE-2015-4147) - An invalid free flaw was found in the way PHP
last seen	2020-06-01
modified	2020-06-02
plugin id	124998
published	2019-05-14
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/124998
title	EulerOS Virtualization 3.0.1.0 : php (EulerOS-SA-2019-1545)

NASL family	Huawei Local Security Checks
NASL id	EULEROS_SA-2019-1100.NASL
description	According to the versions of the php packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - In PHP before 5.6.39, 7.x before 7.0.33, 7.1.x before 7.1.25, and 7.2.x before 7.2.13, a buffer over-read in PHAR reading functions may allow an attacker to read allocated or unallocated memory past the actual data when trying to parse a .phar file. This is related to phar_parse_pharfile in ext/phar/phar.c.(CVE-2018-20783) - An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. Invalid input to the function xmlrpc_decode() can lead to an invalid memory access (heap out of bounds read or read after free). This is related to xml_elem_parse_buf in ext/xmlrpc/libxmlrpc/xml_element.c.(CVE-2019-9020) - An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. A heap-based buffer over-read in PHAR reading functions in the PHAR extension may allow an attacker to read allocated or unallocated memory past the actual data when trying to parse the file name, a different vulnerability than CVE-2018-20783. This is related to phar_detect_phar_fname_ext in ext/phar/phar.c.(CVE-2019-9021) - An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. A number of heap-based buffer over-read instances are present in mbstring regular expression functions when supplied with invalid multibyte data. These occur in ext/mbstring/oniguruma/regcomp.c, ext/mbstring/oniguruma/regexec.c, ext/mbstring/oniguruma/regparse.c, ext/mbstring/oniguruma/enc/unicode.c, and ext/mbstring/oniguruma/src/utf32_be.c when a multibyte regular expression pattern contains invalid multibyte sequences.(CVE-2019-9023) - An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. xmlrpc_decode() can allow a hostile XMLRPC server to cause PHP to read memory outside of allocated areas in base64_decode_xmlrpc in ext/xmlrpc/libxmlrpc/base64.c.(CVE-2019-9024) - gdImageColorMatch in gd_color_match.c in the GD Graphics Library (aka LibGD) 2.2.5, as used in the imagecolormatch function in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1, has a heap-based buffer overflow. This can be exploited by an attacker who is able to trigger imagecolormatch calls with crafted image data.(CVE-2019-6977) Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-05-06
modified	2019-03-26
plugin id	123113
published	2019-03-26
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/123113
title	EulerOS 2.0 SP3 : php (EulerOS-SA-2019-1100)

NASL family	SuSE Local Security Checks
NASL id	OPENSUSE-2019-1573.NASL
description	This update for php7 fixes the following issues : Security issues fixed : - CVE-2019-9637: Fixed improper implementation of rename function and multiple invalid memory access in EXIF extension (bsc#1128892). - CVE-2019-9675: Fixed improper implementation of rename function and multiple invalid memory access in EXIF extension (bsc#1128886). - CVE-2019-9638: Fixed improper implementation of rename function and multiple invalid memory access in EXIF extension ((bsc#1128889). - CVE-2019-9639: Fixed improper implementation of rename function and multiple invalid memory access in EXIF extension (bsc#1128887). - CVE-2019-9640: Fixed improper implementation of rename function and multiple invalid memory access in EXIF extension (bsc#1128883). - CVE-2019-9022: Fixed a vulnerability which could allow a hostile DNS server to make PHP misuse memcpy (bsc#1126827). - CVE-2019-9024: Fixed a vulnerability in xmlrpc_decode function which could allow to a hostile XMLRPC server to cause memory read outside the allocated areas (bsc#1126821). - CVE-2019-9020: Fixed a heap out of bounds in xmlrpc_decode function (bsc#1126711). - CVE-2018-20783: Fixed a buffer over-read in PHAR reading functions which could allow an attacker to read allocated and unallocated memory when parsing a phar file (bsc#1127122). - CVE-2019-9021: Fixed a heap buffer-based buffer over-read in PHAR reading functions which could allow an attacker to read allocated and unallocated memory when parsing a phar file (bsc#1126713). - CVE-2019-9023: Fixed multiple heap-based buffer over-read instances in mbstring regular expression functions (bsc#1126823). - CVE-2019-9641: Fixed multiple invalid memory access in EXIF extension and improved insecure implementation of rename function (bsc#1128722). - CVE-2018-19935: Fixed a Denial of Service in php_imap.c which could be triggered via an empty string in the message argument to imap_mail (bsc#1118832). - CVE-2019-11034: Fixed a heap-buffer overflow in php_ifd_get32si() (bsc#1132838). - CVE-2019-11035: Fixed a heap-buffer overflow in exif_iif_add_value() (bsc#1132837). - CVE-2019-11036: Fixed buffer over-read in exif_process_IFD_TAG function leading to information disclosure (bsc#1134322). Other issue addressed : - Deleted README.default_socket_timeout which is not needed anymore (bsc#1129032). - Enabled php7 testsuite (bsc#1119396). This update was imported from the SUSE:SLE-15:Update update project.
last seen	2020-06-01
modified	2020-06-02
plugin id	126035
published	2019-06-19
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/126035
title	openSUSE Security Update : php7 (openSUSE-2019-1573)

NASL family	CGI abuses
NASL id	PHP_7_3_1.NASL
description	According to its banner, the version of PHP running on the remote web server is 7.3.x prior to 7.3.1. It is, therefore, affected by multiple vulnerabilities: - An integer underflow condition exists in _gdContributionsAlloc function in gd_interpolation.c. An unauthenticated, remote attacker can have unspecified impact via vectors related to decrementing the u variable. (CVE-2016-10166) - A heap-based buffer overflow condition exists in gdImageColorMatch due to improper calculation of the allocated buffer size. An attacker can exploit this, via calling imagecolormatch function with crafted image data as parameters. (CVE-2019-6977) - A heap-based buffer over-read exists in the xmlrpc_decode function due to improper validation of input data. An unauthenticated, remote attacker can exploit this, via a specially crafted request, to cause a heap out-of-bounds read or read-after-free condition, which could result in a complete system compromise. (CVE-2019-9020) - A heap-based buffer over-read exists in the PHAR reading functions in the PHAR extension, due to improper implementation of memory operations. An unauthenticated, remote attacker can exploit this, via persuading a user to parse a specially crafted file name on the targeted system, to disclose sensitive information. (CVE-2019-9021) - Multiple heap-based buffer over-read instances exist in mbstring regular expression functions due to improper implementation of memory operations. An unauthenticated, remote attacker can exploit this by sending a specially crafted regular expression that contains multibyte sequences, to cause a condition that could allow the attacker to completely compromise the target system. (CVE-2019-9023) - An out-of-bounds read error exists in the xmlrpc_decode function due to improper implementation of memory operations. An unauthenticated, remote attacker can exploit this, via a hostile XMLRPC server to cause PHP to read from memory outside of allocated areas. (CVE-2019-9024) - An out-of-bounds read and write error exists in the mb_split function due to improper implementation of memory operations. An unauthenticated, remote attacker can exploit this by causing PHP to execute the memcpy function with a negative argument, to cause buffer over-read and over-write conditions which could allow the attacker to completely compromise the system. (CVE-2019-9025)
last seen	2020-06-01
modified	2020-06-02
plugin id	121475
published	2019-01-30
reporter	This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/121475
title	PHP 7.3.x < 7.3.1 Multiple vulnerabilities.

Redhat

advisories

rhsa
id RHSA-2019:2519
rhsa
id RHSA-2019:3299

rpms

rh-php71-php-0:7.1.30-1.el7
rh-php71-php-bcmath-0:7.1.30-1.el7
rh-php71-php-cli-0:7.1.30-1.el7
rh-php71-php-common-0:7.1.30-1.el7
rh-php71-php-dba-0:7.1.30-1.el7
rh-php71-php-dbg-0:7.1.30-1.el7
rh-php71-php-debuginfo-0:7.1.30-1.el7
rh-php71-php-devel-0:7.1.30-1.el7
rh-php71-php-embedded-0:7.1.30-1.el7
rh-php71-php-enchant-0:7.1.30-1.el7
rh-php71-php-fpm-0:7.1.30-1.el7
rh-php71-php-gd-0:7.1.30-1.el7
rh-php71-php-gmp-0:7.1.30-1.el7
rh-php71-php-intl-0:7.1.30-1.el7
rh-php71-php-json-0:7.1.30-1.el7
rh-php71-php-ldap-0:7.1.30-1.el7
rh-php71-php-mbstring-0:7.1.30-1.el7
rh-php71-php-mysqlnd-0:7.1.30-1.el7
rh-php71-php-odbc-0:7.1.30-1.el7
rh-php71-php-opcache-0:7.1.30-1.el7
rh-php71-php-pdo-0:7.1.30-1.el7
rh-php71-php-pgsql-0:7.1.30-1.el7
rh-php71-php-process-0:7.1.30-1.el7
rh-php71-php-pspell-0:7.1.30-1.el7
rh-php71-php-recode-0:7.1.30-1.el7
rh-php71-php-snmp-0:7.1.30-1.el7
rh-php71-php-soap-0:7.1.30-1.el7
rh-php71-php-xml-0:7.1.30-1.el7
rh-php71-php-xmlrpc-0:7.1.30-1.el7
rh-php71-php-zip-0:7.1.30-1.el7
rh-php72-php-0:7.2.24-1.el7
rh-php72-php-bcmath-0:7.2.24-1.el7
rh-php72-php-cli-0:7.2.24-1.el7
rh-php72-php-common-0:7.2.24-1.el7
rh-php72-php-dba-0:7.2.24-1.el7
rh-php72-php-dbg-0:7.2.24-1.el7
rh-php72-php-debuginfo-0:7.2.24-1.el7
rh-php72-php-devel-0:7.2.24-1.el7
rh-php72-php-embedded-0:7.2.24-1.el7
rh-php72-php-enchant-0:7.2.24-1.el7
rh-php72-php-fpm-0:7.2.24-1.el7
rh-php72-php-gd-0:7.2.24-1.el7
rh-php72-php-gmp-0:7.2.24-1.el7
rh-php72-php-intl-0:7.2.24-1.el7
rh-php72-php-json-0:7.2.24-1.el7
rh-php72-php-ldap-0:7.2.24-1.el7
rh-php72-php-mbstring-0:7.2.24-1.el7
rh-php72-php-mysqlnd-0:7.2.24-1.el7
rh-php72-php-odbc-0:7.2.24-1.el7
rh-php72-php-opcache-0:7.2.24-1.el7
rh-php72-php-pdo-0:7.2.24-1.el7
rh-php72-php-pgsql-0:7.2.24-1.el7
rh-php72-php-process-0:7.2.24-1.el7
rh-php72-php-pspell-0:7.2.24-1.el7
rh-php72-php-recode-0:7.2.24-1.el7
rh-php72-php-snmp-0:7.2.24-1.el7
rh-php72-php-soap-0:7.2.24-1.el7
rh-php72-php-xml-0:7.2.24-1.el7
rh-php72-php-xmlrpc-0:7.2.24-1.el7
rh-php72-php-zip-0:7.2.24-1.el7
apcu-panel-0:5.1.12-2.module+el8.1.0+3202+af5476b9
libzip-0:1.5.1-2.module+el8.1.0+3202+af5476b9
libzip-debuginfo-0:1.5.1-2.module+el8.1.0+3202+af5476b9
libzip-debugsource-0:1.5.1-2.module+el8.1.0+3202+af5476b9
libzip-devel-0:1.5.1-2.module+el8.1.0+3202+af5476b9
libzip-tools-0:1.5.1-2.module+el8.1.0+3202+af5476b9
libzip-tools-debuginfo-0:1.5.1-2.module+el8.1.0+3202+af5476b9
php-0:7.2.24-1.module+el8.2.0+4601+7c76a223
php-bcmath-0:7.2.24-1.module+el8.2.0+4601+7c76a223
php-bcmath-debuginfo-0:7.2.24-1.module+el8.2.0+4601+7c76a223
php-cli-0:7.2.24-1.module+el8.2.0+4601+7c76a223
php-cli-debuginfo-0:7.2.24-1.module+el8.2.0+4601+7c76a223
php-common-0:7.2.24-1.module+el8.2.0+4601+7c76a223
php-common-debuginfo-0:7.2.24-1.module+el8.2.0+4601+7c76a223
php-dba-0:7.2.24-1.module+el8.2.0+4601+7c76a223
php-dba-debuginfo-0:7.2.24-1.module+el8.2.0+4601+7c76a223
php-dbg-0:7.2.24-1.module+el8.2.0+4601+7c76a223
php-dbg-debuginfo-0:7.2.24-1.module+el8.2.0+4601+7c76a223
php-debuginfo-0:7.2.24-1.module+el8.2.0+4601+7c76a223
php-debugsource-0:7.2.24-1.module+el8.2.0+4601+7c76a223
php-devel-0:7.2.24-1.module+el8.2.0+4601+7c76a223
php-embedded-0:7.2.24-1.module+el8.2.0+4601+7c76a223
php-embedded-debuginfo-0:7.2.24-1.module+el8.2.0+4601+7c76a223
php-enchant-0:7.2.24-1.module+el8.2.0+4601+7c76a223
php-enchant-debuginfo-0:7.2.24-1.module+el8.2.0+4601+7c76a223
php-fpm-0:7.2.24-1.module+el8.2.0+4601+7c76a223
php-fpm-debuginfo-0:7.2.24-1.module+el8.2.0+4601+7c76a223
php-gd-0:7.2.24-1.module+el8.2.0+4601+7c76a223
php-gd-debuginfo-0:7.2.24-1.module+el8.2.0+4601+7c76a223
php-gmp-0:7.2.24-1.module+el8.2.0+4601+7c76a223
php-gmp-debuginfo-0:7.2.24-1.module+el8.2.0+4601+7c76a223
php-intl-0:7.2.24-1.module+el8.2.0+4601+7c76a223
php-intl-debuginfo-0:7.2.24-1.module+el8.2.0+4601+7c76a223
php-json-0:7.2.24-1.module+el8.2.0+4601+7c76a223
php-json-debuginfo-0:7.2.24-1.module+el8.2.0+4601+7c76a223
php-ldap-0:7.2.24-1.module+el8.2.0+4601+7c76a223
php-ldap-debuginfo-0:7.2.24-1.module+el8.2.0+4601+7c76a223
php-mbstring-0:7.2.24-1.module+el8.2.0+4601+7c76a223
php-mbstring-debuginfo-0:7.2.24-1.module+el8.2.0+4601+7c76a223
php-mysqlnd-0:7.2.24-1.module+el8.2.0+4601+7c76a223
php-mysqlnd-debuginfo-0:7.2.24-1.module+el8.2.0+4601+7c76a223
php-odbc-0:7.2.24-1.module+el8.2.0+4601+7c76a223
php-odbc-debuginfo-0:7.2.24-1.module+el8.2.0+4601+7c76a223
php-opcache-0:7.2.24-1.module+el8.2.0+4601+7c76a223
php-opcache-debuginfo-0:7.2.24-1.module+el8.2.0+4601+7c76a223
php-pdo-0:7.2.24-1.module+el8.2.0+4601+7c76a223
php-pdo-debuginfo-0:7.2.24-1.module+el8.2.0+4601+7c76a223
php-pear-1:1.10.5-9.module+el8.1.0+3202+af5476b9
php-pecl-apcu-0:5.1.12-2.module+el8.1.0+3202+af5476b9
php-pecl-apcu-debuginfo-0:5.1.12-2.module+el8.1.0+3202+af5476b9
php-pecl-apcu-debugsource-0:5.1.12-2.module+el8.1.0+3202+af5476b9
php-pecl-apcu-devel-0:5.1.12-2.module+el8.1.0+3202+af5476b9
php-pecl-zip-0:1.15.3-1.module+el8.1.0+3186+20164e6f
php-pecl-zip-debuginfo-0:1.15.3-1.module+el8.1.0+3186+20164e6f
php-pecl-zip-debugsource-0:1.15.3-1.module+el8.1.0+3186+20164e6f
php-pgsql-0:7.2.24-1.module+el8.2.0+4601+7c76a223
php-pgsql-debuginfo-0:7.2.24-1.module+el8.2.0+4601+7c76a223
php-process-0:7.2.24-1.module+el8.2.0+4601+7c76a223
php-process-debuginfo-0:7.2.24-1.module+el8.2.0+4601+7c76a223
php-recode-0:7.2.24-1.module+el8.2.0+4601+7c76a223
php-recode-debuginfo-0:7.2.24-1.module+el8.2.0+4601+7c76a223
php-snmp-0:7.2.24-1.module+el8.2.0+4601+7c76a223
php-snmp-debuginfo-0:7.2.24-1.module+el8.2.0+4601+7c76a223
php-soap-0:7.2.24-1.module+el8.2.0+4601+7c76a223
php-soap-debuginfo-0:7.2.24-1.module+el8.2.0+4601+7c76a223
php-xml-0:7.2.24-1.module+el8.2.0+4601+7c76a223
php-xml-debuginfo-0:7.2.24-1.module+el8.2.0+4601+7c76a223
php-xmlrpc-0:7.2.24-1.module+el8.2.0+4601+7c76a223
php-xmlrpc-debuginfo-0:7.2.24-1.module+el8.2.0+4601+7c76a223

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

Nessus

Redhat

References