An issue was discovered in PHP 7.3.x before 7.3.0alpha3, 7.2.x before 7.2.8, and before 7.1.20. The php-fpm master process restarts a child process in an endless loop when using program execution functions (e.g., passthru, exec, shell_exec, or system) with a non-blocking STDIN stream, causing this master process to consume 100% of the CPU, and consume disk space with a large volume of error logs, as demonstrated by an attack by a customer of a shared-hosting facility.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - An issue was discovered in PHP 7.3.x before 7.3.0alpha3, 7.2.x before 7.2.8, and before 7.1.20. The php-
    fpm master process restarts a child process in an endless loop when using program execution functions
    (e.g., passthru, exec, shell_exec, or system) with a non-blocking STDIN stream, causing this master
    process to consume 100% of the CPU, and consume disk space with a large volume of error logs, as
    demonstrated by an attack by a customer of a shared-hosting facility. (CVE-2015-9253)

  - exif_read_from_impl in ext/exif/exif.c in PHP 7.2.x through 7.2.7 allows attackers to trigger a use-after-
    free (in exif_read_from_file) because it closes a stream that it is not responsible for closing. The
    vulnerable code is reachable through the PHP exif_read_data function. (CVE-2018-12882)

  - exif_process_IFD_in_MAKERNOTE in ext/exif/exif.c in PHP before 5.6.37, 7.0.x before 7.0.31, 7.1.x before
    7.1.20, and 7.2.x before 7.2.8 allows remote attackers to cause a denial of service (out-of-bounds read
    and application crash) via a crafted JPEG file. (CVE-2018-14851)

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:4067-1 advisory.

    - Version update to 7.2.34 [jsc#SLE-23639]

    - CVE-2022-37454: Fixed SHA-3 buffer overflow (bsc#1204577).
    - Fix integer overflow in PHP_SHA3##bits (bsc#1204577#c26).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:0679-1 advisory.

    - CVE-2021-21703: Fixed local privilege escalation via PHP-FPM (bsc#1192050).
    - CVE-2021-21707: Fixed special character breaks path in xml parsing (bsc#1193041).
    - CVE-2017-8923: Fixed denial of service (application crash) when using .= with a long string     (zend_string_extend func in Zend/zend_string.h) (bsc#1038980).
    - CVE-2015-9253: Fixed endless loop when the master process restarts a child process using program     execution functions (bsc#1081790).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:0577-1 advisory.

    - CVE-2015-9253: Fixed endless loop when the master process restarts a child process using program     execution functions (bsc#1081790).
    - CVE-2017-8923: Fixed denial of service (application crash) when using .= with a long string     (zend_string_extend func in Zend/zend_string.h) (bsc#1038980).
    - CVE-2021-21707: Fixed special character handling that broke path in xml parsing (bsc#1193041).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5300-1 advisory.

    It was discovered that PHP incorrectly handled certain scripts. An attacker could possibly use this issue     to cause a denial of service. (CVE-2015-9253, CVE-2017-8923, CVE-2017-9118, CVE-2017-9120)

    It was discovered that PHP incorrectly handled certain inputs. An attacker could possibly use this issue     to cause a denial of service, or possibly obtain sensitive information. (CVE-2017-9119)

    It was discovered that PHP incorrectly handled certain scripts with XML parsing functions. An attacker     could possibly use this issue to obtain sensitive information. (CVE-2021-21707)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4279-1 advisory.

    It was discovered that PHP incorrectly handled certain scripts. An attacker could possibly use this issue     to cause a denial of service. This issue only affected Ubuntu 12.04 ESM, Ubuntu 14.04 ESM and Ubuntu 16.04     LTS. (CVE-2015-9253)

    It was discovered that PHP incorrectly handled certain inputs. An attacker could possibly use this issue     to expose sensitive information. (CVE-2020-7059)

    It was discovered that PHP incorrectly handled certain inputs. An attacker could possibly use this issue     to execute arbitrary code. This issue only affected Ubuntu 14.04 ESM, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS     and Ubuntu 19.10. (CVE-2020-7060)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3766-1 advisory.

    It was discovered that PHP incorrectly handled restarting certain child processes when php-fpm is used. A     remote attacker could possibly use this issue to cause a denial of service. This issue was only addressed     in Ubuntu 18.04 LTS. (CVE-2015-9253)

    It was discovered that PHP incorrectly handled certain exif tags in JPEG images. A remote attacker could     possibly use this issue to cause PHP to crash, resulting in a denial of service. (CVE-2018-14851,     CVE-2018-14883)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
406331	Alpine: php7: security update to 7.2.8-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
406331	Alpine: php7: security update to 7.2.8-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
167950	SUSE SLES15: apache2-mod_php7 / php7 / php7-bcmath / php7-bz2 / php7-calendar / etc (SUSE-SU-2022:4067-1)	Nessus	SuSE Local Security Checks	critical
158582	SUSE SLES15: apache2-mod_php7 / php7 / php7-bcmath / php7-bz2 / php7-calendar / etc (SUSE-SU-2022:0679-1)	Nessus	SuSE Local Security Checks	critical
158448	SUSE SLES12: apache2-mod_php72 / php72 / php72-bcmath / php72-bz2 / etc (SUSE-SU-2022:0577-1)	Nessus	SuSE Local Security Checks	critical
158273	Ubuntu 16.04 ESM : PHP vulnerabilities (USN-5300-1)	Nessus	Ubuntu Local Security Checks	critical
133764	Ubuntu 16.04 LTS / 18.04 LTS : PHP vulnerabilities (USN-4279-1)	Nessus	Ubuntu Local Security Checks	critical
117539	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : PHP vulnerabilities (USN-3766-1)	Nessus	Ubuntu Local Security Checks	high

Detections

Analytics

CVE-2015-9253

medium

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

high