An issue was discovered in PHP before 5.6.35, 7.0.x before 7.0.29, 7.1.x before 7.1.16, and 7.2.x before 7.2.4. Dumpable FPM child processes allow bypassing opcache access controls because fpm_unix.c makes a PR_SET_DUMPABLE prctl call, allowing one user (in a multiuser environment) to obtain sensitive information from the process memory of a second user's PHP applications by running gcore on the PID of the PHP-FPM worker process.

According to the versions of the php packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The get_icu_disp_value_src_php function in     ext/intl/locale/locale_methods.c in PHP before 5.3.29,     5.4.x before 5.4.30, and 5.5.x before 5.5.14 does not     properly restrict calls to the ICU uresbund.cpp     component, which allows remote attackers to cause a     denial of service (buffer overflow) or possibly have     unspecified other impact via a locale_get_display_name     call with a long first argument.(CVE-2014-9912)

  - Use-after-free vulnerability in the spl_ptr_heap_insert     function in ext/spl/spl_heap.c in PHP before 5.5.27 and     5.6.x before 5.6.11 allows remote attackers to execute     arbitrary code by triggering a failed     SplMinHeap::compare operation.(CVE-2015-4116)

  - A flaw was found in the way the way PHP's Phar     extension parsed Phar archives. A specially crafted     archive could cause PHP to crash or, possibly, execute     arbitrary code when opened.(CVE-2015-7803)

  - A flaw was found in the way the way PHP's Phar     extension parsed Phar archives. A specially crafted     archive could cause PHP to crash or, possibly, execute     arbitrary code when opened.(CVE-2015-7804)

  - ext/libxml/libxml.c in PHP before 5.5.22 and 5.6.x     before 5.6.6, when PHP-FPM is used, does not isolate     each thread from libxml_disable_entity_loader changes     in other threads, which allows remote attackers to     conduct XML External Entity (XXE) and XML Entity     Expansion (XEE) attacks via a crafted XML document, a     related issue to CVE-2015-5161.(CVE-2015-8866)

  - Stack consumption vulnerability in GD in PHP before     5.6.12 allows remote attackers to cause a denial of     service via a crafted imagefilltoborder     call.(CVE-2015-8874)

  - It was found that the exif_convert_any_to_int()     function in PHP was vulnerable to floating point     exceptions when parsing tags in image files. A remote     attacker with the ability to upload a malicious image     could crash PHP, causing a Denial of     Service.(CVE-2016-10158)

  - Integer overflow in the phar_parse_pharfile function in     ext/phar/phar.c in PHP before 5.6.30 and 7.0.x before     7.0.15 allows remote attackers to cause a denial of     service (memory consumption or application crash) via a     truncated manifest entry in a PHAR     archive.(CVE-2016-10159)

  - The php_url_parse_ex function in ext/standard/url.c in     PHP before 5.5.38 allows remote attackers to cause a     denial of service (buffer over-read) or possibly have     unspecified other impact via vectors involving the     smart_str data type.(CVE-2016-6288)

  - The exif_process_IFD_in_MAKERNOTE function in     ext/exif/exif.c in PHP before 5.5.38, 5.6.x before     5.6.24, and 7.x before 7.0.9 allows remote attackers to     cause a denial of service (out-of-bounds array access     and memory corruption), obtain sensitive information     from process memory, or possibly have unspecified other     impact via a crafted JPEG image.(CVE-2016-6291)

  - The exif_process_user_comment function in     ext/exif/exif.c in PHP before 5.5.38, 5.6.x before     5.6.24, and 7.x before 7.0.9 allows remote attackers to     cause a denial of service (NULL pointer dereference and     application crash) via a crafted JPEG     image.(CVE-2016-6292)

  - The locale_accept_from_http function in     ext/intl/locale/locale_methods.c in PHP before 5.5.38,     5.6.x before 5.6.24, and 7.x before 7.0.9 does not     properly restrict calls to the ICU     uloc_acceptLanguageFromHTTP function, which allows     remote attackers to cause a denial of service     (out-of-bounds read) or possibly have unspecified other     impact via a call with a long argument.(CVE-2016-6294)

  - ext/session/session.c in PHP before 5.6.25 and 7.x     before 7.0.10 skips invalid session names in a way that     triggers incorrect parsing, which allows remote     attackers to inject arbitrary-type session data by     leveraging control of a session name, as demonstrated     by object injection.(CVE-2016-7125)

  - The exif_process_IFD_in_TIFF function in     ext/exif/exif.c in PHP before 5.6.25 and 7.x before     7.0.10 mishandles the case of a thumbnail offset that     exceeds the file size, which allows remote attackers to     obtain sensitive information from process memory via a     crafted TIFF image.(CVE-2016-7128)

  - The php_wddx_push_element function in ext/wddx/wddx.c     in PHP before 5.6.26 and 7.x before 7.0.11 allows     remote attackers to cause a denial of service (invalid     pointer access and out-of-bounds read) or possibly have     unspecified other impact via an incorrect boolean     element in a wddxPacket XML document, leading to     mishandling in a wddx_deserialize call.(CVE-2016-7418)

  - In PHP before 5.6.31, 7.x before 7.0.21, and 7.1.x     before 7.1.7, a stack-based buffer overflow in the     zend_ini_do_op() function in Zend/zend_ini_parser.c     could cause a denial of service or potentially allow     executing code. NOTE: this is only relevant for PHP     applications that accept untrusted input (instead of     the system's php.ini file) for the parse_ini_string or     parse_ini_file function, e.g., a web application for     syntax validation of php.ini     directives.(CVE-2017-11628)

  - An issue was discovered in PHP before 5.6.35, 7.0.x     before 7.0.29, 7.1.x before 7.1.16, and 7.2.x before     7.2.4. Dumpable FPM child processes allow bypassing     opcache access controls because fpm_unix.c makes a     PR_SET_DUMPABLE prctl call, allowing one user (in a     multiuser environment) to obtain sensitive information     from the process memory of a second user's PHP     applications by running gcore on the PID of the PHP-FPM     worker process.(CVE-2018-10545)

  - An issue was discovered in ext/phar/phar_object.c in     PHP before 5.6.36, 7.0.x before 7.0.30, 7.1.x before     7.1.17, and 7.2.x before 7.2.5. There is Reflected XSS     on the PHAR 403 and 404 error pages via request data of     a request for a .phar file.(CVE-2018-10547)

  - exif_process_IFD_in_MAKERNOTE in ext/exif/exif.c in PHP     before 5.6.37, 7.0.x before 7.0.31, 7.1.x before     7.1.20, and 7.2.x before 7.2.8 allows remote attackers     to cause a denial of service (out-of-bounds read and     application crash) via a crafted JPEG     file.(CVE-2018-14851)

  - A cross-site scripting (XSS) vulnerability in Apache2     component of PHP was found. When using     'Transfer-Encoding: chunked', the request allows remote     attackers to potentially run a malicious script in a     victim's browser. This vulnerability can be exploited     only by producing malformed requests and it's believed     it's unlikely to be used in practical cross-site     scripting attack.(CVE-2018-17082)

  - gd_gif_in.c in the GD Graphics Library (aka libgd), as     used in PHP before 5.6.33, 7.0.x before 7.0.27, 7.1.x     before 7.1.13, and 7.2.x before 7.2.1, has an integer     signedness error that leads to an infinite loop via a     crafted GIF file, as demonstrated by a call to the     imagecreatefromgif or imagecreatefromstring PHP     function. This is related to GetCode_ and     gdImageCreateFromGifCtx.(CVE-2018-5711)

  - An issue was discovered in PHP before 5.6.33, 7.0.x     before 7.0.27, 7.1.x before 7.1.13, and 7.2.x before     7.2.1. There is Reflected XSS on the PHAR 404 error     page via the URI of a request for a .phar     file.(CVE-2018-5712)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its banner, the version of PHP running on the remote web server is 5.6.x prior to 5.6.35. It is, therefore, affected by a security bypass vulnerability. Dumpable FPM child processes allow bypassing opcache access controls because fpm_unix.c makes a PR_SET_DUMPABLE prctl call, allowing one user (in a multiuser environment) to obtain sensitive information from the process memory of a second user's PHP applications by running gcore on the PID of the PHP-FPM worker process.

According to its banner, the version of PHP running on the remote web server is 7.2.x prior to 7.2.4. It is, therefore, affected by opcache access controls bypass via dumpable FPM child processes.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its banner, the version of PHP running on the remote web server is 7.1.x prior to 7.1.17. It is, therefore, affected by multiple vulnerabilities.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its banner, the version of PHP running on the remote web server is 7.0.x prior to 7.0.30. It is, therefore, affected by multiple vulnerabilities.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for php5 fixes the following issues: Security issues fixed :

  - CVE-2018-10545: Fix access controls in FPM child     processes (bsc#1091367).

  - CVE-2018-10547: Fix Reflected XSS on the PHAR 403 and     404 error pages (bsc#1091362).

  - CVE-2018-10546: Fix an infinite loop exists in     ext/iconv/iconv.c (bsc#1091363).

  - CVE-2018-10548: Fix remote denial of service in     ext/ldap/ldap.c (bsc#1091355).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for php7 fixes the following issues: Security issues fixed :

  - CVE-2018-10545: Fix access controls in FPM child     processes (bsc#1091367).

  - CVE-2018-10547: Fix Reflected XSS on the PHAR 403 and     404 error pages (bsc#1091362).

  - CVE-2018-10546: Fix an infinite loop exists in     ext/iconv/iconv.c (bsc#1091363).

  - CVE-2018-10548: Fix remote denial of service in     ext/ldap/ldap.c (bsc#1091355).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201812-01 (PHP: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in PHP. Please review the       referenced CVE identifiers for details.
  Impact :

    An attacker could cause a Denial of Service condition or obtain       sensitive information.
  Workaround :

    There is no known workaround at this time.

According to its self-reported version, the Tenable SecurityCenter application installed on the remote host is prior to 5.7.1. It is, therefore, affected by multiple vulnerabilities.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several vulnerabilities were found in PHP, a widely-used open source general purpose scripting language :

  - CVE-2018-7584     Buffer underread in parsing HTTP responses

  - CVE-2018-10545     Dumpable FPM child processes allowed the bypass of     opcache access controls

  - CVE-2018-10546     Denial of service via infinite loop in convert.iconv     stream filter

  - CVE-2018-10547     The fix for CVE-2018-5712 (shipped in DSA 4080) was     incomplete

  - CVE-2018-10548     Denial of service via malformed LDAP server responses

  - CVE-2018-10549     Out-of-bounds read when parsing malformed JPEG files

Several vulnerabilities were found in PHP, a widely-used open source general purpose scripting language :

CVE-2018-7584

A stack-buffer-overflow while parsing HTTP response results in copying a large string and possible memory corruption and/or denial of service

CVE-2018-10545

Dumpable FPM child processes allow bypassing opcache access controls resulting in potential information disclosure where one user can obtain information about another user's running PHP applications

CVE-2018-10546

An invalid sequence of bytes can trigger an infinite loop in the stream filter convert.iconv

CVE-2018-10547

A previous fix for CVE-2018-5712 may not be complete, resulting in an additional vulnerability in the form of a reflected XSS in the PHAR 403 and 404 error pages

CVE-2018-10548

A malicious remote LDAP server can send a crafted response that will cause a denial of service (NULL pointer dereference resulting in an application crash)

CVE-2018-10549

A crafted JPEG file can case an out-of-bounds read and heap buffer overflow

For Debian 8 'Jessie', these problems have been fixed in version 5.6.36+dfsg-0+deb8u1.

We recommend that you upgrade your php5 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for php5 fixes the following issues :

Security issues fixed :

  - CVE-2018-10545: Fix access controls in FPM child     processes (bsc#1091367).

  - CVE-2018-10547: Fix Reflected XSS on the PHAR 403 and     404 error pages (bsc#1091362).

  - CVE-2018-10546: Fix an infinite loop exists in     ext/iconv/iconv.c (bsc#1091363).

  - CVE-2018-10548: Fix remote denial of service in     ext/ldap/ldap.c (bsc#1091355).

This update was imported from the SUSE:SLE-12:Update update project.

This update for php53 fixes the following issues: Security issues fixed :

  - CVE-2018-10545: Fix access controls in FPM child     processes (bsc#1091367).

  - CVE-2018-10547: Fix Reflected XSS on the PHAR 403 and     404 error pages (bsc#1091362).

  - CVE-2018-10546: Fix an infinite loop exists in     ext/iconv/iconv.c (bsc#1091363).

  - CVE-2018-10548: Fix remote denial of service in     ext/ldap/ldap.c (bsc#1091355).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that PHP incorrectly handled opcache access controls when configured to use PHP-FPM. A local user could possibly use this issue to obtain sensitive information from another user's PHP applications. (CVE-2018-10545)

It was discovered that the PHP iconv stream filter incorrect handled certain invalid multibyte sequences. A remote attacker could possibly use this issue to cause PHP to hang, resulting in a denial of service.
(CVE-2018-10546)

It was discovered that the PHP PHAR error pages incorrectly filtered certain data. A remote attacker could possibly use this issue to perform a reflected XSS attack. (CVE-2018-10547)

It was discovered that PHP incorrectly handled LDAP. A malicious remote LDAP server could possibly use this issue to cause PHP to crash, resulting in a denial of service. (CVE-2018-10548)

It was discovered that PHP incorrectly handled certain exif tags in JPEG images. A remote attacker could possibly use this issue to cause PHP to crash, resulting in a denial of service. This issue only affected Ubuntu 16.04 LTS, Ubuntu 17.10, and Ubuntu 18.04 LTS.
(CVE-2018-10549).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for php7 fixes the following issues :

Security issues fixed :

  - CVE-2018-10545: Fix access controls in FPM child     processes (bsc#1091367).

  - CVE-2018-10547: Fix Reflected XSS on the PHAR 403 and     404 error pages (bsc#1091362).

  - CVE-2018-10546: Fix an infinite loop exists in     ext/iconv/iconv.c (bsc#1091363).

  - CVE-2018-10548: Fix remote denial of service in     ext/ldap/ldap.c (bsc#1091355).

This update was imported from the SUSE:SLE-12:Update update project.

Several issues have been discovered in PHP (recursive acronym for PHP:
Hypertext Preprocessor), a widely-used open source general-purpose scripting language that is especially suited for web development and can be embedded into HTML.

CVE-2018-10545

Dumpable FPM child processes allow bypassing opcache access controls because fpm_unix.c makes a PR_SET_DUMPABLE prctl call, allowing one user (in a multiuser environment) to obtain sensitive information from the process memory of a second user's PHP applications by running gcore on the PID of the PHP-FPM worker process.

CVE-2018-10547

There is a reflected XSS on the PHAR 403 and 404 error pages via request data of a request for a .phar file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2018-5712.

CVE-2018-10548

ext/ldap/ldap.c allows remote LDAP servers to cause a denial of service (NULL pointer dereference and application crash) because of mishandling of the ldap_get_dn return value.

For Debian 7 'Wheezy', these problems have been fixed in version 5.4.45-0+deb7u14.

We recommend that you upgrade your php5 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its banner, the version of PHP running on the remote web server is 7.2.x prior to 7.2.5. It is, therefore, affected by multiple vulnerabilities.

According to its banner, the version of PHP running on the remote web server is 7.1.x prior to 7.1.17. It is, therefore, affected by multiple vulnerabilities.

According to its banner, the version of PHP running on the remote web server is 7.0.x prior to 7.0.30. It is, therefore, affected by multiple vulnerabilities.

ID	Name	Product	Family	Severity
137966	EulerOS Virtualization 3.0.6.0 : php (EulerOS-SA-2020-1747)	Nessus	Huawei Local Security Checks	critical
132184	EulerOS 2.0 SP3 : php (EulerOS-SA-2019-2649)	Nessus	Huawei Local Security Checks	critical
131592	EulerOS 2.0 SP2 : php (EulerOS-SA-2019-2438)	Nessus	Huawei Local Security Checks	critical
129178	EulerOS 2.0 SP5 : php (EulerOS-SA-2019-1984)	Nessus	Huawei Local Security Checks	critical
122591	PHP 5.6.x < 5.6.35 Security Bypass Vulnerability	Nessus	CGI abuses	medium
98867	PHP 7.2.x < 7.2.4 Dumpable FPM Child Processes	Web App Scanning	Component Vulnerability	medium
98860	PHP 7.1.x < 7.1.17 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
98849	PHP 7.0.x < 7.0.30 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
120023	SUSE SLES12 Security Update : php5 (SUSE-SU-2018:1291-1)	Nessus	SuSE Local Security Checks	medium
120021	SUSE SLES12 Security Update : php7 (SUSE-SU-2018:1176-1)	Nessus	SuSE Local Security Checks	medium
119320	GLSA-201812-01 : PHP: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
117672	Tenable SecurityCenter < 5.7.1 Multiple Vulnerabilities (TNS-2018-12)	Nessus	Misc.	critical
110928	Debian DSA-4240-1 : php7.0 - security update	Nessus	Debian Local Security Checks	critical
110697	Debian DLA-1397-1 : php5 security update	Nessus	Debian Local Security Checks	critical
109878	openSUSE Security Update : php5 (openSUSE-2018-465)	Nessus	SuSE Local Security Checks	high
109860	SUSE SLES11 Security Update : php53 (SUSE-SU-2018:1294-1)	Nessus	SuSE Local Security Checks	high
109812	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : PHP vulnerabilities (USN-3646-1)	Nessus	Ubuntu Local Security Checks	high
109714	openSUSE Security Update : php7 (openSUSE-2018-441)	Nessus	SuSE Local Security Checks	high
109657	Debian DLA-1373-1 : php5 security update	Nessus	Debian Local Security Checks	high
109579	PHP 7.2.x < 7.2.5 Stack Buffer Overflow	Nessus	CGI abuses	high
109578	PHP 7.1.x < 7.1.17 Multiple Vulnerabilities	Nessus	CGI abuses	high
109577	PHP 7.0.x < 7.0.30 Multiple Vulnerabilities	Nessus	CGI abuses	high

Detections

Analytics

CVE-2018-10545

medium

Tenable Plugins

critical

critical

critical

critical

medium

medium

high

high

medium

medium

high

critical

critical

critical

high

high

high

high

high

high

high

high