According to the versions of the php packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - PHP is an HTML-embedded scripting language. PHP     attempts to make it easy for developers to write     dynamically generated web pages. PHP also offers     built-in database integration for several commercial     and non-commercial database management systems, so     writing a database-enabled webpage with PHP is fairly     simple. The most common use of PHP coding is probably     as a replacement for CGI scripts. The php package     contains the module (often referred to as mod_php)     which adds support for the PHP language to Apache HTTP     Server. Security Fix(es):A flaw was found in HAProxy     before 2.0.6. In legacy mode, messages featuring a     transfer-encoding header missing the 'chunked' value     were not being correctly rejected. The impact was     limited but if combined with the 'http-reuse always'     setting, it could be used to help construct an HTTP     request smuggling attack against a vulnerable component     employing a lenient parser that would ignore the     content-length header as soon as it saw a     transfer-encoding one (even if not entirely valid     according to the specification).(CVE-2017-16642)In PHP     before 5.6.32, 7.x before 7.0.25, and 7.1.x before     7.1.11, an error in the date extension's     timelib_meridian handling of 'front of' and 'back of'     directives could be used by attackers able to supply     date strings to leak information from the interpreter,     related to ext/date/lib/parse_date.c out-of-bounds     reads affecting the php_parse_date function. NOTE: this     is a different issue than     CVE-2017-11145.(CVE-2017-11145)ext/standard/var_unseria     lizer.re in PHP before 5.6.26 mishandles     object-deserialization failures, which allows remote     attackers to cause a denial of service (memory     corruption) or possibly have unspecified other impact     via an unserialize call that references a partially     constructed object.(CVE-2016-10397)Double free     vulnerability in the zend_ts_hash_graceful_destroy     function in zend_ts_hash.c in the Zend Engine in PHP     through 5.5.20 and 5.6.x through 5.6.4 allows remote     attackers to cause a denial of service or possibly have     unspecified other impact via unknown     vectors.(CVE-2016-7412)Oniguruma through 6.9.3, as used     in PHP 7.3.x and other products, has a heap-based     buffer over-read in str_lower_case_match in     regexec.c.(CVE-2019-19246)When PHP EXIF extension is     parsing EXIF information from an image, e.g. via     exif_read_data() function, in PHP versions 7.2.x below     7.2.26, 7.3.x below 7.3.13 and 7.4.0 it is possible to     supply it with data what will cause it to read past the     allocated buffer. This may lead to information     disclosure or     crash.(CVE-2019-11047)main/php_open_temporary_file.c in     PHP before 5.5.28 and 5.6.x before 5.6.12 does not     ensure thread safety, which allows remote attackers to     cause a denial of service (race condition and heap     memory corruption) by leveraging an application that     performs many temporary-file     accesses.(CVE-2017-7272)When PHP EXIF extension is     parsing EXIF information from an image, e.g. via     exif_read_data() function, in PHP versions 7.2.x below     7.2.26, 7.3.x below 7.3.13 and 7.4.0 it is possible to     supply it with data what will cause it to read past the     allocated buffer. This may lead to information     disclosure or crash.(CVE-2019-11050)An issue was     discovered in Oniguruma 6.x before 6.9.4_rc2. In the     function fetch_interval_quantifier (formerly known as     fetch_range_quantifier) in regparse.c, PFETCH is called     without checking PEND. This leads to a heap-based     buffer     over-read.(CVE-2019-19204)main/streams/xp_socket.c in     PHP 7.x before 2017-03-07 misparses fsockopen calls,     such as by interpreting fsockopen('127.0.0.1:80', 443)     as if the address/port were 127.0.0.1:80:443, which is     later truncated to 127.0.0.1:80. This behavior has a     security risk if the explicitly provided port number     (i.e., 443 in this example) is hardcoded into an     application as a security policy, but the hostname     argument (i.e., 127.0.0.1:80 in this example) is     obtained from untrusted input.(CVE-2017-7189)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - 2017-03-07 之前的 PHP 7.x 中的 main/streams/xp_socket.c 错误解析 fsockopen 调用，例如将 fsockopen('127.0.0.1:80', 443) 解释为地址/端口 127.0.0.1:80:443，其稍后被截断为 127.0.0.1:80。如果将明确提供的端口号（即本例中的 443）作为安全策略硬编码到应用程序中，但是主机名参数（即本例中的 127.0.0.1:80）是从不受信任的输入中获取的，则此行为存在安全风险。(CVE-2017-7189)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且供應商未提供可用的修補程式。

  - 2017-03-07 之前 PHP 7.x 中的 main/streams/xp_socket.c 會錯誤剖析 fsockopen 呼叫，例如將 fsockopen('127.0.0.1:80', 443) 視為位址/連接埠為 127.0.0.1:80:443，它稍後會截斷為 127.0.0.1:80。如果將明確提供的連接埠號碼 (亦即此範例中的 443) 作為安全性原則硬式編碼至應用程式，但主機名稱引數 (即此範例中的 127.0.0.1:80) 是從未受信任的輸入取得，則此行為具有安全性風險。(CVE-2017-7189)

請注意，Nessus 依賴供應商報告的套件存在。

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - main/streams/xp_socket.c in PHP 7.x before 2017-03-07 misparses fsockopen calls, such as by interpreting     fsockopen('127.0.0.1:80', 443) as if the address/port were 127.0.0.1:80:443, which is later truncated to     127.0.0.1:80. This behavior has a security risk if the explicitly provided port number (i.e., 443 in this     example) is hardcoded into an application as a security policy, but the hostname argument (i.e.,     127.0.0.1:80 in this example) is obtained from untrusted input. (CVE-2017-7189)

Note that Nessus relies on the presence of the package as reported by the vendor.

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - 2017 年 3 月 7 日より前の PHP 7.x の main/streams/xp_socket.c は、たとえば fsockopen ('127.0.0.1:80', 443) をアドレス/ポートが 127.0.0.1:80:443 であるかのように解釈することなどにより、fsockopen 呼び出しを誤って解析します。これは後で切り捨てられて 127.0.0.1:80 になります。明示的に提供されたポート番号 (この例では 443 など) がセキュリティポリシーとしてアプリケーションにハードコードされているものの、ホスト名引数 (この例では 127.0.0.1:80) が信頼できない入力から取得されている場合、この動作にはセキュリティ上のリスクがあります。(CVE-2017-7189)

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

ID	名稱	產品	系列	已發布	已更新	嚴重性
136245	EulerOS Virtualization for ARM 64 3.0.2.0 : php (EulerOS-SA-2020-1542)	Nessus	Huawei Local Security Checks	2020/5/1	2025/2/21	high
221400	Linux Distros 未修补的漏洞: CVE-2017-7189	Nessus	Misc.	2025/3/4	2025/9/14	high
221400	Linux Distros 未修補弱點：CVE-2017-7189	Nessus	Misc.	2025/3/4	2025/9/14	high
221400	Linux Distros Unpatched Vulnerability : CVE-2017-7189	Nessus	Misc.	2025/3/4	2025/9/14	high
221400	Linux Distros のパッチ未適用の脆弱性: CVE-2017-7189	Nessus	Misc.	2025/3/4	2025/9/14	high

偵測

搜尋 Plugin

high

high

high

high

high