Vulnerabilities > CVE-2020-7061 - Out-of-bounds Read vulnerability in multiple products

#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were  
# extracted from Fedora Security Advisory FEDORA-2020-32f9a2b308.
#

include("compat.inc");

if (description)
{
  script_id(134132);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2020/03/06");

  script_cve_id("CVE-2020-7061", "CVE-2020-7062", "CVE-2020-7063");
  script_xref(name:"FEDORA", value:"2020-32f9a2b308");

  script_name(english:"Fedora 31 : php (2020-32f9a2b308)");
  script_summary(english:"Checks rpm output for the updated package.");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote Fedora host is missing a security update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"**PHP version 7.3.15** (20 Feb 2020)

**Core:**

  - Fixed bug php#71876 (Memory corruption
    htmlspecialchars(): charset `*' not supported). (Nikita)

  - Fixed bug #php#79146 (cscript can fail to run on some
    systems). (clarodeus)

  - Fixed bug php#78323 (Code 0 is returned on invalid
    options). (Ivan Mikheykin)

  - Fixed bug php#76047 (Use-after-free when accessing
    already destructed backtrace arguments). (Nikita)

**CURL:**

  - Fixed bug php#79078 (Hypothetical use-after-free in
    curl_multi_add_handle()). (cmb)

**Intl:**

  - Fixed bug php#79212 (NumberFormatter::format() may
    detect wrong type). (cmb)

**Libxml:**

  - Fixed bug php#79191 (Error in SoapClient ctor disables
    DOMDocument::save()). (Nikita, cmb)

**MBString:**

  - Fixed bug php#79154 (mb_convert_encoding() can modify
    $from_encoding). (cmb)

**MySQLnd:**

  - Fixed bug php#79084 (mysqlnd may fetch wrong column
    indexes with MYSQLI_BOTH). (cmb)

**OpenSSL:**

  - Fixed bug php#79145 (openssl memory leak). (cmb, Nikita)

**Phar:**

  - Fixed bug php#79082 (Files added to tar with
    Phar::buildFromIterator have all-access permissions).
    (**CVE-2020-7063**) (stas)

  - Fixed bug php#79171 (heap-buffer-overflow in
    phar_extract_file). (**CVE-2020-7061**) (cmb)

  - Fixed bug php#76584 (PharFileInfo::decompress not
    working). (cmb)

**Reflection:**

  - Fixed bug php#79115 (ReflectionClass::isCloneable call
    reflected class __destruct). (Nikita)

**Session:**

  - Fixed bug php#79221 (NULL pointer Dereference in PHP
    Session Upload Progress). (**CVE-2020-7062**) (stas)

**SPL:**

  - Fixed bug php#79151 (heap use after free caused by
    spl_dllist_it_helper_move_forward). (Nikita)

**Standard:**

  - Fixed bug php#78902 (Memory leak when using
    stream_filter_append). (liudaixiao)

**Testing:**

  - Fixed bug php#78090 (bug45161.phpt takes forever to
    finish). (cmb)

**XSL:**

  - Fixed bug php#70078 (XSL callbacks with nodes as
    parameter leak memory). (cmb)

Note that Tenable Network Security has extracted the preceding
description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as
possible without introducing additional issues."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bodhi.fedoraproject.org/updates/FEDORA-2020-32f9a2b308"
  );
  script_set_attribute(attribute:"solution", value:"Update the affected php package.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:php");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora:31");

  script_set_attribute(attribute:"vuln_publication_date", value:"2020/02/27");
  script_set_attribute(attribute:"patch_publication_date", value:"2020/02/27");
  script_set_attribute(attribute:"plugin_publication_date", value:"2020/02/28");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"Fedora Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");


if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/RedHat/release");
if (isnull(release) || "Fedora" >!< release) audit(AUDIT_OS_NOT, "Fedora");
os_ver = pregmatch(pattern: "Fedora.*release ([0-9]+)", string:release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Fedora");
os_ver = os_ver[1];
if (! preg(pattern:"^31([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Fedora 31", "Fedora " + os_ver);

if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);


cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Fedora", cpu);


flag = 0;
if (rpm_check(release:"FC31", reference:"php-7.3.15-1.fc31")) flag++;


if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_WARNING,
    extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "php");
}

#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Amazon Linux AMI Security Advisory ALAS-2020-1351.
#

include("compat.inc");

if (description)
{
  script_id(134573);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2020/03/18");

  script_cve_id("CVE-2020-7061", "CVE-2020-7062", "CVE-2020-7063");
  script_xref(name:"ALAS", value:"2020-1351");

  script_name(english:"Amazon Linux AMI : php73 (ALAS-2020-1351)");
  script_summary(english:"Checks rpm output for the updated packages");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote Amazon Linux AMI host is missing a security update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"In PHP versions 7.3.x below 7.3.15 and 7.4.x below 7.4.3, while
extracting PHAR files on Windows using phar extension, certain content
inside PHAR file could lead to one-byte read past the allocated
buffer. This could potentially lead to information disclosure or
crash. (CVE-2020-7061)

In PHP versions 7.2.x below 7.2.28, 7.3.x below 7.3.15 and 7.4.x below
7.4.3, when using file upload functionality, if upload progress
tracking is enabled, but session.upload_progress.cleanup is set to 0
(disabled), and the file upload fails, the upload procedure would try
to clean up data that does not exist and encounter NULL pointer
dereference, which would likely lead to a crash. (CVE-2020-7062)

In PHP versions 7.2.x below 7.2.28, 7.3.x below 7.3.15 and 7.4.x below
7.4.3, when creating PHAR archive using PharData::buildFromIterator()
function, the files are added with default permissions (0666, or all
access) even if the original files on the filesystem were with more
restrictive permissions. This may result in files having more lax
permissions than intended when such archive is extracted.
(CVE-2020-7063)"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://alas.aws.amazon.com/ALAS-2020-1351.html"
  );
  script_set_attribute(
    attribute:"solution", 
    value:"Run 'yum update php73' to update your system."
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:php73");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:php73-bcmath");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:php73-cli");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:php73-common");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:php73-dba");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:php73-dbg");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:php73-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:php73-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:php73-embedded");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:php73-enchant");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:php73-fpm");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:php73-gd");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:php73-gmp");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:php73-imap");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:php73-intl");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:php73-json");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:php73-ldap");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:php73-mbstring");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:php73-mysqlnd");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:php73-odbc");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:php73-opcache");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:php73-pdo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:php73-pdo-dblib");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:php73-pgsql");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:php73-process");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:php73-pspell");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:php73-recode");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:php73-snmp");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:php73-soap");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:php73-tidy");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:php73-xml");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:php73-xmlrpc");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:amazon:linux");

  script_set_attribute(attribute:"vuln_publication_date", value:"2020/02/27");
  script_set_attribute(attribute:"patch_publication_date", value:"2020/03/13");
  script_set_attribute(attribute:"plugin_publication_date", value:"2020/03/16");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"Amazon Linux Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/AmazonLinux/release", "Host/AmazonLinux/rpm-list");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");


if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);

release = get_kb_item("Host/AmazonLinux/release");
if (isnull(release) || !strlen(release)) audit(AUDIT_OS_NOT, "Amazon Linux");
os_ver = pregmatch(pattern: "^AL(A|\d)", string:release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Amazon Linux");
os_ver = os_ver[1];
if (os_ver != "A")
{
  if (os_ver == 'A') os_ver = 'AMI';
  audit(AUDIT_OS_NOT, "Amazon Linux AMI", "Amazon Linux " + os_ver);
}

if (!get_kb_item("Host/AmazonLinux/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);


flag = 0;
if (rpm_check(release:"ALA", reference:"php73-7.3.15-1.24.amzn1")) flag++;
if (rpm_check(release:"ALA", reference:"php73-bcmath-7.3.15-1.24.amzn1")) flag++;
if (rpm_check(release:"ALA", reference:"php73-cli-7.3.15-1.24.amzn1")) flag++;
if (rpm_check(release:"ALA", reference:"php73-common-7.3.15-1.24.amzn1")) flag++;
if (rpm_check(release:"ALA", reference:"php73-dba-7.3.15-1.24.amzn1")) flag++;
if (rpm_check(release:"ALA", reference:"php73-dbg-7.3.15-1.24.amzn1")) flag++;
if (rpm_check(release:"ALA", reference:"php73-debuginfo-7.3.15-1.24.amzn1")) flag++;
if (rpm_check(release:"ALA", reference:"php73-devel-7.3.15-1.24.amzn1")) flag++;
if (rpm_check(release:"ALA", reference:"php73-embedded-7.3.15-1.24.amzn1")) flag++;
if (rpm_check(release:"ALA", reference:"php73-enchant-7.3.15-1.24.amzn1")) flag++;
if (rpm_check(release:"ALA", reference:"php73-fpm-7.3.15-1.24.amzn1")) flag++;
if (rpm_check(release:"ALA", reference:"php73-gd-7.3.15-1.24.amzn1")) flag++;
if (rpm_check(release:"ALA", reference:"php73-gmp-7.3.15-1.24.amzn1")) flag++;
if (rpm_check(release:"ALA", reference:"php73-imap-7.3.15-1.24.amzn1")) flag++;
if (rpm_check(release:"ALA", reference:"php73-intl-7.3.15-1.24.amzn1")) flag++;
if (rpm_check(release:"ALA", reference:"php73-json-7.3.15-1.24.amzn1")) flag++;
if (rpm_check(release:"ALA", reference:"php73-ldap-7.3.15-1.24.amzn1")) flag++;
if (rpm_check(release:"ALA", reference:"php73-mbstring-7.3.15-1.24.amzn1")) flag++;
if (rpm_check(release:"ALA", reference:"php73-mysqlnd-7.3.15-1.24.amzn1")) flag++;
if (rpm_check(release:"ALA", reference:"php73-odbc-7.3.15-1.24.amzn1")) flag++;
if (rpm_check(release:"ALA", reference:"php73-opcache-7.3.15-1.24.amzn1")) flag++;
if (rpm_check(release:"ALA", reference:"php73-pdo-7.3.15-1.24.amzn1")) flag++;
if (rpm_check(release:"ALA", reference:"php73-pdo-dblib-7.3.15-1.24.amzn1")) flag++;
if (rpm_check(release:"ALA", reference:"php73-pgsql-7.3.15-1.24.amzn1")) flag++;
if (rpm_check(release:"ALA", reference:"php73-process-7.3.15-1.24.amzn1")) flag++;
if (rpm_check(release:"ALA", reference:"php73-pspell-7.3.15-1.24.amzn1")) flag++;
if (rpm_check(release:"ALA", reference:"php73-recode-7.3.15-1.24.amzn1")) flag++;
if (rpm_check(release:"ALA", reference:"php73-snmp-7.3.15-1.24.amzn1")) flag++;
if (rpm_check(release:"ALA", reference:"php73-soap-7.3.15-1.24.amzn1")) flag++;
if (rpm_check(release:"ALA", reference:"php73-tidy-7.3.15-1.24.amzn1")) flag++;
if (rpm_check(release:"ALA", reference:"php73-xml-7.3.15-1.24.amzn1")) flag++;
if (rpm_check(release:"ALA", reference:"php73-xmlrpc-7.3.15-1.24.amzn1")) flag++;

if (flag)
{
  if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
  else security_warning(0);
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "php73 / php73-bcmath / php73-cli / php73-common / php73-dba / etc");
}

#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Gentoo Linux Security Advisory GLSA 202003-57.
#
# The advisory text is Copyright (C) 2001-2020 Gentoo Foundation, Inc.
# and licensed under the Creative Commons - Attribution / Share Alike 
# license. See http://creativecommons.org/licenses/by-sa/3.0/
#

include("compat.inc");

if (description)
{
  script_id(134965);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2020/04/24");

  script_cve_id("CVE-2018-19518", "CVE-2020-7059", "CVE-2020-7060", "CVE-2020-7061", "CVE-2020-7062", "CVE-2020-7063", "CVE-2020-7064", "CVE-2020-7065", "CVE-2020-7066");
  script_xref(name:"GLSA", value:"202003-57");

  script_name(english:"GLSA-202003-57 : PHP: Multiple vulnerabilities");
  script_summary(english:"Checks for updated package(s) in /var/db/pkg");

  script_set_attribute(
    attribute:"synopsis", 
    value:
"The remote Gentoo host is missing one or more security-related
patches."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"The remote host is affected by the vulnerability described in GLSA-202003-57
(PHP: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in PHP. Please review the
      CVE identifiers referenced below for details.
  
Impact :

    An attacker could possibly execute arbitrary shell commands, cause a
      Denial of Service condition or obtain sensitive information.
  
Workaround :

    There is no known workaround at this time."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://security.gentoo.org/glsa/202003-57"
  );
  script_set_attribute(
    attribute:"solution", 
    value:
"All PHP 7.2.x users should upgrade to the latest version:
      # emerge --sync
      # emerge --ask --oneshot --verbose '>=dev-lang/php-7.2.29:7.2'
    All PHP 7.3.x users should upgrade to the latest version:
      # emerge --sync
      # emerge --ask --oneshot --verbose '>=dev-lang/php-7.3.16:7.3'
    All PHP 7.4.x users should upgrade to the latest version:
      # emerge --sync
      # emerge --ask --oneshot --verbose '>=dev-lang/php-7.4.4:7.4'"
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:F/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2018-19518");
  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"metasploit_name", value:'php imap_open Remote Code Execution');
  script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:php");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:gentoo:linux");

  script_set_attribute(attribute:"vuln_publication_date", value:"2018/11/25");
  script_set_attribute(attribute:"patch_publication_date", value:"2020/03/26");
  script_set_attribute(attribute:"plugin_publication_date", value:"2020/03/27");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"Gentoo Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/Gentoo/release", "Host/Gentoo/qpkg-list");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("qpkg.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/Gentoo/release")) audit(AUDIT_OS_NOT, "Gentoo");
if (!get_kb_item("Host/Gentoo/qpkg-list")) audit(AUDIT_PACKAGE_LIST_MISSING);


flag = 0;

if (qpkg_check(package:"dev-lang/php", unaffected:make_list("ge 7.2.29", "ge 7.3.16", "ge 7.4.4"), vulnerable:make_list("lt 7.2.29", "lt 7.3.16", "lt 7.4.4"))) flag++;

if (flag)
{
  if (report_verbosity > 0) security_hole(port:0, extra:qpkg_report_get());
  else security_hole(0);
  exit(0);
}
else
{
  tested = qpkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "PHP");
}

#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were  
# extracted from Fedora Security Advisory FEDORA-2020-4ea970ebc6.
#

include("compat.inc");

if (description)
{
  script_id(134133);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2020/03/06");

  script_cve_id("CVE-2020-7061", "CVE-2020-7062", "CVE-2020-7063");
  script_xref(name:"FEDORA", value:"2020-4ea970ebc6");

  script_name(english:"Fedora 30 : php (2020-4ea970ebc6)");
  script_summary(english:"Checks rpm output for the updated package.");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote Fedora host is missing a security update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"**PHP version 7.3.15** (20 Feb 2020)

**Core:**

  - Fixed bug php#71876 (Memory corruption
    htmlspecialchars(): charset `*' not supported). (Nikita)

  - Fixed bug #php#79146 (cscript can fail to run on some
    systems). (clarodeus)

  - Fixed bug php#78323 (Code 0 is returned on invalid
    options). (Ivan Mikheykin)

  - Fixed bug php#76047 (Use-after-free when accessing
    already destructed backtrace arguments). (Nikita)

**CURL:**

  - Fixed bug php#79078 (Hypothetical use-after-free in
    curl_multi_add_handle()). (cmb)

**Intl:**

  - Fixed bug php#79212 (NumberFormatter::format() may
    detect wrong type). (cmb)

**Libxml:**

  - Fixed bug php#79191 (Error in SoapClient ctor disables
    DOMDocument::save()). (Nikita, cmb)

**MBString:**

  - Fixed bug php#79154 (mb_convert_encoding() can modify
    $from_encoding). (cmb)

**MySQLnd:**

  - Fixed bug php#79084 (mysqlnd may fetch wrong column
    indexes with MYSQLI_BOTH). (cmb)

**OpenSSL:**

  - Fixed bug php#79145 (openssl memory leak). (cmb, Nikita)

**Phar:**

  - Fixed bug php#79082 (Files added to tar with
    Phar::buildFromIterator have all-access permissions).
    (**CVE-2020-7063**) (stas)

  - Fixed bug php#79171 (heap-buffer-overflow in
    phar_extract_file). (**CVE-2020-7061**) (cmb)

  - Fixed bug php#76584 (PharFileInfo::decompress not
    working). (cmb)

**Reflection:**

  - Fixed bug php#79115 (ReflectionClass::isCloneable call
    reflected class __destruct). (Nikita)

**Session:**

  - Fixed bug php#79221 (NULL pointer Dereference in PHP
    Session Upload Progress). (**CVE-2020-7062**) (stas)

**SPL:**

  - Fixed bug php#79151 (heap use after free caused by
    spl_dllist_it_helper_move_forward). (Nikita)

**Standard:**

  - Fixed bug php#78902 (Memory leak when using
    stream_filter_append). (liudaixiao)

**Testing:**

  - Fixed bug php#78090 (bug45161.phpt takes forever to
    finish). (cmb)

**XSL:**

  - Fixed bug php#70078 (XSL callbacks with nodes as
    parameter leak memory). (cmb)

Note that Tenable Network Security has extracted the preceding
description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as
possible without introducing additional issues."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bodhi.fedoraproject.org/updates/FEDORA-2020-4ea970ebc6"
  );
  script_set_attribute(attribute:"solution", value:"Update the affected php package.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:php");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora:30");

  script_set_attribute(attribute:"vuln_publication_date", value:"2020/02/27");
  script_set_attribute(attribute:"patch_publication_date", value:"2020/02/27");
  script_set_attribute(attribute:"plugin_publication_date", value:"2020/02/28");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"Fedora Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");


if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/RedHat/release");
if (isnull(release) || "Fedora" >!< release) audit(AUDIT_OS_NOT, "Fedora");
os_ver = pregmatch(pattern: "Fedora.*release ([0-9]+)", string:release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Fedora");
os_ver = os_ver[1];
if (! preg(pattern:"^30([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Fedora 30", "Fedora " + os_ver);

if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);


cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Fedora", cpu);


flag = 0;
if (rpm_check(release:"FC30", reference:"php-7.3.15-1.fc30")) flag++;


if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_WARNING,
    extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "php");
}