This update for php7 fixes the following issues :

CVE-2020-7070: Fixed an issue where percent-encoded cookies could have been used to overwrite existing prefixed cookie names (bsc#1177352).

Added tmpfiles.d for php-fpm to provide a base for a socket (bsc#1173786)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:2992 advisory.

    PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

    The following packages have been upgraded to a later upstream version: rh-php73-php (7.3.29). (BZ#1977764)

    Security Fix(es):

    * php: Wrong ciphertext/tag in AES-CCM encryption for a 12 bytes IV (CVE-2020-7069)

    * php: FILTER_VALIDATE_URL accepts URLs with invalid userinfo (CVE-2020-7071)

    * php: SSRF bypass in FILTER_VALIDATE_URL (CVE-2021-21705)

    * php: Use of freed hash key in the phar_parse_zipfile function (CVE-2020-7068)

    * php: URL decoding of cookie names can lead to different interpretation of cookies between browser and     server (CVE-2020-7070)

    * php: NULL pointer dereference in SoapClient (CVE-2021-21702)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

**PHP version 7.4.11** (01 Oct 2020)

**Core:**

  - Fixed bug php#79699 (PHP parses encoded cookie names so     malicious `__Host-` cookies can be sent).
    (**CVE-2020-7070**) (Stas)

  - Fixed bug php#79979 (passing value to by-ref param via     CUFA crashes). (cmb, Nikita)

  - Fixed bug php#80037 (Typed property must not be accessed     before initialization when __get() declared). (Nikita)

  - Fixed bug php#80048 (Bug php#69100 has not been fixed     for Windows). (cmb)

  - Fixed bug php#80049 (Memleak when coercing integers to     string via variadic argument). (Nikita)

**Calendar:**

  - Fixed bug php#80007 (Potential type confusion in     unixtojd() parameter parsing). (Andy Postnikov)

**OPcache:**

  - Fixed bug php#80002 (calc free space for new interned     string is wrong). (t-matsuno)

  - Fixed bug php#80046 (FREE for SWITCH_STRING optimized     away). (Nikita)

  - Fixed bug php#79825 (opcache.file_cache causes SIGSEGV     when custom opcode handlers changed). (SammyK)

**OpenSSL:**

  - Fixed bug php#79601 (Wrong ciphertext/tag in AES-CCM     encryption for a 12 bytes IV). (**CVE-2020-7069**)     (Jakub Zelenka)

**PDO:**

  - Fixed bug php#80027 (Terrible performance using     $query->fetch on queries with many bind parameters     (Matteo)

**Standard:**

  - Fixed bug php#79986 (str_ireplace bug with diacritics     characters). (cmb)

  - Fixed bug php#80077 (getmxrr test bug). (Rainer Jung)

  - Fixed bug php#72941 (Modifying bucket->data by-ref has     no effect any longer). (cmb)

  - Fixed bug php#80067 (Omitting the port in bindto setting     errors). (cmb)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for php7 fixes the following issues :

  - CVE-2020-7069: Fixed an issue when AES-CCM mode was used     with openssl_encrypt() function with 12 bytes IV, only     first 7 bytes of the IV was used (bsc#1177351). 

  - CVE-2020-7070: Fixed an issue where percent-encoded     cookies could have been used to overwrite existing     prefixed cookie names (bsc#1177352).

This update was imported from the SUSE:SLE-15-SP2:Update update project.

This update for php7 fixes the following issues :

  - CVE-2020-7069: Fixed an issue when AES-CCM mode was used     with openssl_encrypt() function with 12 bytes IV, only     first 7 bytes of the IV was used (bsc#1177351).

  - CVE-2020-7070: Fixed an issue where percent-encoded     cookies could have been used to overwrite existing     prefixed cookie names (bsc#1177352). 

  - Added tmpfiles.d for php-fpm to provide a base for a     socket (bsc#1173786) 

This update was imported from the SUSE:SLE-15:Update update project.

The remote host is affected by the vulnerability described in GLSA-202012-16 (PHP: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in PHP. Please review the       CVE identifiers and change log referenced below for details.
  Impact :

    An attacker could cause a Denial of Service condition or obtain       sensitive information.
  Workaround :

    There is no known workaround at this time.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2021:4213 advisory.

  - In PHP versions 7.2.x below 7.2.33, 7.3.x below 7.3.21 and 7.4.x below 7.4.9, while processing PHAR files     using phar extension, phar_parse_zipfile could be tricked into accessing freed memory, which could lead to     a crash or information disclosure. (CVE-2020-7068)

  - In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when AES-CCM mode is used     with openssl_encrypt() function with 12 bytes IV, only first 7 bytes of the IV is actually used. This can     lead to both decreased security and incorrect encryption data. (CVE-2020-7069)

  - In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when PHP is processing     incoming HTTP cookie values, the cookie names are url-decoded. This may lead to cookies with prefixes like
    __Host confused with cookies that decode to such prefix, thus leading to an attacker being able to forge     cookie which is supposed to be secure. See also CVE-2020-8184 for more information. (CVE-2020-7070)

  - In PHP versions 7.3.x below 7.3.26, 7.4.x below 7.4.14 and 8.0.0, when validating URL with functions like     filter_var($url, FILTER_VALIDATE_URL), PHP will accept an URL with invalid password as valid URL. This may     lead to functions that rely on URL being valid to mis-parse the URL and produce wrong data as components     of the URL. (CVE-2020-7071)

  - In PHP versions 7.3.x below 7.3.27, 7.4.x below 7.4.15 and 8.0.x below 8.0.2, when using SOAP extension to     connect to a SOAP server, a malicious SOAP server could return malformed XML data as a response that would     cause PHP to access a null pointer and thus cause a crash. (CVE-2021-21702)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:4213 advisory.

  - php: Use of freed hash key in the phar_parse_zipfile function (CVE-2020-7068)

  - php: Wrong ciphertext/tag in AES-CCM encryption for a 12 bytes IV (CVE-2020-7069)

  - php: URL decoding of cookie names can lead to different interpretation of cookies between browser and     server (CVE-2020-7070)

  - php: FILTER_VALIDATE_URL accepts URLs with invalid userinfo (CVE-2020-7071)

  - php: NULL pointer dereference in SoapClient (CVE-2021-21702)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:4069-1 advisory.

    - Version update to 7.4.33:
    - CVE-2022-31630: Fixed out-of-bounds read due to insufficient input validation in imageloadfont()     (bsc#1204979).
    - CVE-2022-37454: Fixed buffer overflow in hash_update() on long parameter (bsc#1204577).

    - Version update to 7.4.32 (jsc#SLE-23639)
    - CVE-2022-31628: Fixed an uncontrolled recursion in the phar uncompressor while decompressing 'quines'     gzip files. (bsc#1203867)
    - CVE-2022-31629: Fixed a bug which could lead an attacker to set an insecure cookie that will treated as     secure in the victim's browser. (bsc#1203870)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:4068-1 advisory.

    - Version update to 7.4.33:
    - CVE-2022-31630: Fixed out-of-bounds read due to insufficient input validation in imageloadfont()     (bsc#1204979).
    - CVE-2022-37454: Fixed buffer overflow in hash_update() on long parameter (bsc#1204577).

    - Version update to 7.4.32 (jsc#SLE-23639)
    - CVE-2022-31628: Fixed an uncontrolled recursion in the phar uncompressor while decompressing 'quines'     gzip files. (bsc#1203867)
    - CVE-2022-31629: Fixed a bug which could lead an attacker to set an insecure cookie that will treated as     secure in the victim's browser. (bsc#1203870)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when PHP is processing     incoming HTTP cookie values, the cookie names are url-decoded. This may lead to cookies with prefixes like
    __Host confused with cookies that decode to such prefix, thus leading to an attacker being able to forge     cookie which is supposed to be secure. See also CVE-2020-8184 for more information. (CVE-2020-7070)

Note that Nessus relies on the presence of the package as reported by the vendor.

According to its self-reported version, the Tenable SecurityCenter application installed on the remote host is less than 5.19.0 and is therefore affected by multiple vulnerabilities in the following components: 
  - Apache FOP
  - Underscore
  - Handlebars
  - PHP
  - sqlite

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

**PHP version 7.3.23** (01 Oct 2020)

**Core:**

  - Fixed bug php#80048 (Bug php#69100 has not been fixed     for Windows). (cmb)

  - Fixed bug php#80049 (Memleak when coercing integers to     string via variadic argument). (Nikita)

  - Fixed bug php#79699 (PHP parses encoded cookie names so     malicious `__Host-` cookies can be sent).
    (**CVE-2020-7070**) (Stas)

**Calendar:**

  - Fixed bug php#80007 (Potential type confusion in     unixtojd() parameter parsing). (Andy Postnikov)

**OPcache:**

  - Fixed bug php#80002 (calc free space for new interned     string is wrong). (t-matsuno)

  - Fixed bug php#79825 (opcache.file_cache causes SIGSEGV     when custom opcode handlers changed). (SammyK)

**OpenSSL:**

  - Fixed bug php#79601 (Wrong ciphertext/tag in AES-CCM     encryption for a 12 bytes IV). (**CVE-2020-7069**)     (Jakub Zelenka)

**PDO:**

  - Fixed bug php#80027 (Terrible performance using     $query->fetch on queries with many bind parameters     (Matteo)

**Standard:**

  - Fixed bug php#79986 (str_ireplace bug with diacritics     characters). (cmb)

  - Fixed bug php#80077 (getmxrr test bug). (Rainer Jung)

  - Fixed bug php#72941 (Modifying bucket->data by-ref has     no effect any longer). (cmb)

  - Fixed bug php#80067 (Omitting the port in bindto setting     errors). (cmb)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名稱	產品	系列	已發布	已更新	嚴重性
143747	SUSE SLES12 Security Update : php7 (SUSE-SU-2020:2920-1)	Nessus	SuSE Local Security Checks	2020/12/9	2024/2/5	medium
152348	RHEL 7 : rh-php73-php (RHSA-2021:2992)	Nessus	Red Hat Local Security Checks	2021/8/9	2024/11/7	medium
141299	Fedora 33 : php (2020-4573f0e03a)	Nessus	Fedora Local Security Checks	2020/10/8	2024/2/16	medium
141662	openSUSE Security Update : php7 (openSUSE-2020-1703)	Nessus	SuSE Local Security Checks	2020/10/21	2024/2/14	medium
142078	openSUSE Security Update : php7 (openSUSE-2020-1767)	Nessus	SuSE Local Security Checks	2020/10/30	2024/2/13	medium
144602	GLSA-202012-16 : PHP: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2020/12/24	2024/1/31	medium
185043	Rocky Linux 8 : php:7.4 (RLSA-2021:4213)	Nessus	Rocky Linux Local Security Checks	2023/11/7	2023/11/7	medium
155095	CentOS 8 : php:7.4 (CESA-2021:4213)	Nessus	CentOS Local Security Checks	2021/11/11	2023/11/24	medium
167937	SUSE SLED15: apache2-mod_php7 / php7 / php7-bcmath / php7-bz2 / php7-calendar / etc (SUSE-SU-2022:4069-1)	Nessus	SuSE Local Security Checks	2022/11/19	2026/6/25	critical
167963	SUSE SLES12: apache2-mod_php74 / php74 / php74-bcmath / php74-bz2 / etc (SUSE-SU-2022:4068-1)	Nessus	SuSE Local Security Checks	2022/11/19	2026/6/25	critical
260337	Linux Distros Unpatched Vulnerability : CVE-2020-7070	Nessus	Misc.	2025/9/2	2026/11/6	medium
152986	Tenable SecurityCenter < 5.19.0 Multiple Vulnerabilities (TNS-2021-14)	Nessus	Misc.	2021/9/3	2024/5/10	critical
141295	Fedora 31 : php (2020-94763cb98b)	Nessus	Fedora Local Security Checks	2020/10/8	2024/2/16	medium

偵測

搜尋 Plugin

medium

medium

medium

medium

medium

medium

medium

medium

critical

critical

medium

critical

medium