An issue was discovered in PHP 7.0.x before 7.0.27, 7.1.x before 7.1.13, and 7.2.x before 7.2.1. Inappropriately parsing an HTTP response leads to a segmentation fault because http_header_value in ext/standard/http_fopen_wrapper.c can be a NULL value that is mishandled in an atoi call.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:2519 advisory.

    PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

    The following packages have been upgraded to a later upstream version: rh-php71-php (7.1.30). (BZ#1631672)

    Security Fix(es):

    * gd: Unsigned integer underflow _gdContributionsAlloc() (CVE-2016-10166)

    * php: Out of bounds access in php_pcre.c:php_pcre_replace_impl() (CVE-2017-9118)

    * php: Integer overflow in mysqli_api.c:mysqli_real_escape_string() (CVE-2017-9120)

    * php: Heap use after free in ext/standard/var_unserializer.re (CVE-2017-12932)

    * php: Reflected XSS in .phar 404 page (CVE-2018-5712)

    * php: Stack-based buffer under-read in php_stream_url_wrap_http_ex() in http_fopen_wrapper.c when parsing     HTTP response (CVE-2018-7584)

    * php: Infinite loop in ext/iconv/iconv.c when using stream filter with convert.incov on invalid sequence     leads to denial-of-service (CVE-2018-10546)

    * php: Reflected XSS vulnerability on PHAR 403 and 404 error pages (CVE-2018-10547)

    * php: NULL pointer dereference due to mishandling of ldap_get_dn return value allows DoS via malicious     LDAP server reply (CVE-2018-10548)

    * php: Mishandled http_header_value in an atoi() call in http_fopen_wrapper.c (CVE-2018-14884)

    * php: Cross-site scripting (XSS) flaw in Apache2 component via body of 'Transfer-Encoding: chunked'     request (CVE-2018-17082)

    * gd: Heap based buffer overflow in gdImageColorMatch() in gd_color_match.c (CVE-2019-6977)

    * php: Invalid memory access in function xmlrpc_decode() (CVE-2019-9020)

    * php: File rename across filesystems may allow unwanted access during processing (CVE-2019-9637)

    * php: Uninitialized read in exif_process_IFD_in_MAKERNOTE (CVE-2019-9638)

    * php: Uninitialized read in exif_process_IFD_in_MAKERNOTE (CVE-2019-9639)

    * php: Invalid read in exif_process_SOFn() (CVE-2019-9640)

    * php: Out-of-bounds read due to integer overflow in iconv_mime_decode_headers() (CVE-2019-11039)

    * php: Buffer over-read in exif_read_data() (CVE-2019-11040)

    * php: Out-of-bound read in timelib_meridian() (CVE-2017-16642)

    * gd: Infinite loop in gdImageCreateFromGifCtx() in gd_gif_in.c (CVE-2018-5711)

    * php: Dumpable FPM child processes allow bypassing opcache access controls (CVE-2018-10545)

    * php: Out-of-bounds read in ext/exif/exif.c:exif_read_data() when reading crafted JPEG data     (CVE-2018-10549)

    * php: exif: Buffer over-read in exif_process_IFD_in_MAKERNOTE() (CVE-2018-14851)

    * php: Buffer over-read in PHAR reading functions (CVE-2018-20783)

    * php: Heap-based buffer over-read in PHAR reading functions (CVE-2019-9021)

    * php: memcpy with negative length via crafted DNS response (CVE-2019-9022)

    * php: Heap-based buffer over-read in mbstring regular expression functions (CVE-2019-9023)

    * php: Out-of-bounds read in base64_decode_xmlrpc in ext/xmlrpc/libxmlrpc/base64.c (CVE-2019-9024)

    * php: Heap buffer overflow in function exif_process_IFD_TAG() (CVE-2019-11034)

    * php: Heap buffer overflow in function exif_iif_add_value() (CVE-2019-11035)

    * php: Buffer over-read in exif_process_IFD_TAG() leading to information disclosure (CVE-2019-11036)

    * gd: Information disclosure in gdImageCreateFromXbm() (CVE-2019-11038)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - University of Washington IMAP Toolkit 2007f on UNIX, as used in imap_open() in PHP and other products,
    launches an rsh command (by means of the imap_rimap function in c-client/imap4r1.c and the tcp_aopen
    function in osdep/unix/tcp_unix.c) without preventing argument injection, which might allow remote
    attackers to execute arbitrary OS commands if the IMAP server name is untrusted input (e.g., entered by a
    user of a web application) and if rsh has been replaced by a program with different argument semantics.
    For example, if rsh is a link to ssh (as seen on Debian and Ubuntu systems), then the attack can use an
    IMAP server name containing a "-oProxyCommand" argument. (CVE-2018-19518)

  - Integer underflow in the _gdContributionsAlloc function in gd_interpolation.c in the GD Graphics Library
    (aka libgd) before 2.2.4 allows remote attackers to have unspecified impact via vectors related to
    decrementing the u variable. (CVE-2016-10166)

  - An issue was discovered in PHP before 5.6.33, 7.0.x before 7.0.27, 7.1.x before 7.1.13, and 7.2.x before
    7.2.1. There is Reflected XSS on the PHAR 404 error page via the URI of a request for a .phar file.
    (CVE-2018-5712)

  - exif_process_IFD_in_MAKERNOTE in ext/exif/exif.c in PHP before 5.6.37, 7.0.x before 7.0.31, 7.1.x before
    7.1.20, and 7.2.x before 7.2.8 allows remote attackers to cause a denial of service (out-of-bounds read
    and application crash) via a crafted JPEG file. (CVE-2018-14851)

  - An issue was discovered in PHP before 5.6.37, 7.0.x before 7.0.31, 7.1.x before 7.1.20, and 7.2.x before
    7.2.8. An Integer Overflow leads to a heap-based buffer over-read in exif_thumbnail_extract of exif.c.
    (CVE-2018-14883)

According to its banner, the version of PHP running on the remote web server is 7.2.x prior to 7.2.1. It is, therefore, affected by multiple vulnerabilities.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its banner, the version of PHP running on the remote web server is 7.1.x prior to 7.1.13. It is, therefore, affected by the multiple vulnerabilities.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its banner, the version of PHP running on the remote web server is 7.0.x prior to 7.0.27. It is, therefore, affected by multiple vulnerabilities.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its banner, the version of PHP running on the remote web server is 7.2.x prior to 7.2.1. It is, therefore, affected by the following vulnerabilities :

  - A denial of service (DoS) vulnerability exists in the     imagecreatefromgif and imagecreatefromstring functions     of the gd_gif_in.c script within GD Graphics Library     (libgd) due to an integer signedness error. An     unauthenticated, remote attacker can exploit this issue,     via a crafted GIF file, to cause the applicaiton to stop     responding. (CVE-2018-5711)

  - A cross-site scripting (XSS) vulnerability exists due to     improper validation of .phar file before returning it to     users. An unauthenticated, remote attacker can exploit     this, by convincing a user to click a specially crafted     URL, to execute arbitrary script code in a user's browser     session. (CVE-2018-5712)

  - A denial of service (DoS) vulnerability exists in the     ext/standard/http_fopen_wrapper.c script due to     http_header_value possibly being a NULL value in an atoi     call. An unauthenticated, remote attacker can exploit     this issue, via a specifically crafted HTTP response, to     cause the application to stop responding. (CVE-2018-14884)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its banner, the version of PHP running on the remote web server is 7.1.x prior to 7.1.13. It is, therefore, affected by the following vulnerabilities :

  - A denial of service (DoS) vulnerability exists in the     imagecreatefromgif and imagecreatefromstring functions     of the gd_gif_in.c script within GD Graphics Library     (libgd) due to an integer signedness error. An     unauthenticated, remote attacker can exploit this issue,     via a crafted GIF file, to cause the applicaiton to stop     responding. (CVE-2018-5711)

  - A cross-site scripting (XSS) vulnerability exists due to     improper validation of .phar file before returning it to     users. An unauthenticated, remote attacker can exploit     this, by convincing a user to click a specially crafted     URL, to execute arbitrary script code in a user's browser     session. (CVE-2018-5712)

  - A denial of service (DoS) vulnerability exists in the     ext/standard/http_fopen_wrapper.c script due to     http_header_value possibly being a NULL value in an atoi     call. An unauthenticated, remote attacker can exploit     this issue, via a specifically crafted HTTP response, to     cause the application to stop responding. (CVE-2018-14884)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its banner, the version of PHP running on the remote web server is 7.0.x prior to 7.0.27. It is, therefore, affected by the following vulnerabilities :

  - A denial of service (DoS) vulnerability exists in the     imagecreatefromgif and imagecreatefromstring functions     of the gd_gif_in.c script within GD Graphics Library     (libgd) due to an integer signedness error. An     unauthenticated, remote attacker can exploit this issue,     via a crafted GIF file, to cause the applicaiton to stop     responding. (CVE-2018-5711)

  - A cross-site scripting (XSS) vulnerability exists due to     improper validation of .phar file before returning it to     users. An unauthenticated, remote attacker can exploit     this, by convincing a user to click a specially crafted     URL, to execute arbitrary script code in a user's browser     session. (CVE-2018-5712)

  - A denial of service (DoS) vulnerability exists in the     ext/standard/http_fopen_wrapper.c script due to     http_header_value possibly being a NULL value in an atoi     call. An unauthenticated, remote attacker can exploit     this issue, via a specifically crafted HTTP response, to     cause the application to stop responding. (CVE-2018-14884)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
194152	RHEL 7 : rh-php71-php (RHSA-2019:2519)	Nessus	Red Hat Local Security Checks	critical
406312	Alpine: php7: security update to 7.1.29-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
406312	Alpine: php7: security update to 7.1.29-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
98865	PHP 7.2.x < 7.2.1 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
98858	PHP 7.1.x < 7.1.13 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
98846	PHP 7.0.x < 7.0.27 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
105774	PHP 7.2.x < 7.2.1 Multiple Vulnerabilities	Nessus	CGI abuses	medium
105773	PHP 7.1.x < 7.1.13 Multiple Vulnerabilities	Nessus	CGI abuses	medium
105772	PHP 7.0.x < 7.0.27 Multiple Vulnerabilities	Nessus	CGI abuses	medium

Detections

Analytics

CVE-2018-14884

high

Tenable Plugins

critical

critical

critical

high

high

high

medium

medium

medium