ext/imap/php_imap.c in PHP 5.x and 7.x before 7.3.0 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an empty string in the message argument to the imap_mail function.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - University of Washington IMAP Toolkit 2007f on UNIX, as used in imap_open() in PHP and other products,
    launches an rsh command (by means of the imap_rimap function in c-client/imap4r1.c and the tcp_aopen
    function in osdep/unix/tcp_unix.c) without preventing argument injection, which might allow remote
    attackers to execute arbitrary OS commands if the IMAP server name is untrusted input (e.g., entered by a
    user of a web application) and if rsh has been replaced by a program with different argument semantics.
    For example, if rsh is a link to ssh (as seen on Debian and Ubuntu systems), then the attack can use an
    IMAP server name containing a "-oProxyCommand" argument. (CVE-2018-19518)

  - Integer underflow in the _gdContributionsAlloc function in gd_interpolation.c in the GD Graphics Library
    (aka libgd) before 2.2.4 allows remote attackers to have unspecified impact via vectors related to
    decrementing the u variable. (CVE-2016-10166)

  - An issue was discovered in PHP before 5.6.33, 7.0.x before 7.0.27, 7.1.x before 7.1.13, and 7.2.x before
    7.2.1. There is Reflected XSS on the PHAR 404 error page via the URI of a request for a .phar file.
    (CVE-2018-5712)

  - exif_process_IFD_in_MAKERNOTE in ext/exif/exif.c in PHP before 5.6.37, 7.0.x before 7.0.31, 7.1.x before
    7.1.20, and 7.2.x before 7.2.8 allows remote attackers to cause a denial of service (out-of-bounds read
    and application crash) via a crafted JPEG file. (CVE-2018-14851)

  - An issue was discovered in PHP before 5.6.37, 7.0.x before 7.0.31, 7.1.x before 7.1.20, and 7.2.x before
    7.2.8. An Integer Overflow leads to a heap-based buffer over-read in exif_thumbnail_extract of exif.c.
    (CVE-2018-14883)

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - ColossusCoinXT through 1.0.5 (a chain-based proof-of-stake cryptocurrency) allows a remote denial of
    service, exploitable by an attacker who acquires even a small amount of stake/coins in the system. The
    attacker sends invalid headers/blocks, which are stored on the victim's disk. (CVE-2018-19158)

  - ext/imap/php_imap.c in PHP 5.x and 7.x before 7.3.0 allows remote attackers to cause a denial of service
    (NULL pointer dereference and application crash) via an empty string in the message argument to the
    imap_mail function. (CVE-2018-19935)

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:4067-1 advisory.

    - Version update to 7.2.34 [jsc#SLE-23639]

    - CVE-2022-37454: Fixed SHA-3 buffer overflow (bsc#1204577).
    - Fix integer overflow in PHP_SHA3##bits (bsc#1204577#c26).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the php packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24     and 7.3.x below 7.3.11 in certain configurations of FPM     setup it is possible to cause FPM module to write past     allocated buffers into the space reserved for FCGI     protocol data, thus opening the possibility of remote     code execution.(CVE-2019-11043)

  - ext/imap/php_imap.c in PHP 5.x and 7.x before 7.3.0     allows remote attackers to cause a denial of service     (NULL pointer dereference and application crash) via an     empty string in the message argument to the imap_mail     function.(CVE-2018-19935)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the php packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - ext/imap/php_imap.c in PHP 5.x and 7.x before 7.3.0     allows remote attackers to cause a denial of service     (NULL pointer dereference and application crash) via an     empty string in the message argument to the imap_mail     function.(CVE-2018-19935)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for php7 fixes the following issues :

Security issues fixed :

  - CVE-2019-9637: Fixed improper implementation of rename     function and multiple invalid memory access in EXIF     extension (bsc#1128892).

  - CVE-2019-9675: Fixed improper implementation of rename     function and multiple invalid memory access in EXIF     extension (bsc#1128886).

  - CVE-2019-9638: Fixed improper implementation of rename     function and multiple invalid memory access in EXIF     extension ((bsc#1128889).

  - CVE-2019-9639: Fixed improper implementation of rename     function and multiple invalid memory access in EXIF     extension (bsc#1128887).

  - CVE-2019-9640: Fixed improper implementation of rename     function and multiple invalid memory access in EXIF     extension (bsc#1128883).

  - CVE-2019-9022: Fixed a vulnerability which could allow a     hostile DNS server to make PHP misuse memcpy     (bsc#1126827).

  - CVE-2019-9024: Fixed a vulnerability in xmlrpc_decode     function which could allow to a hostile XMLRPC server to     cause memory read outside the allocated areas     (bsc#1126821).

  - CVE-2019-9020: Fixed a heap out of bounds in     xmlrpc_decode function (bsc#1126711).

  - CVE-2018-20783: Fixed a buffer over-read in PHAR reading     functions which could allow an attacker to read     allocated and unallocated memory when parsing a phar     file (bsc#1127122).

  - CVE-2019-9021: Fixed a heap buffer-based buffer     over-read in PHAR reading functions which could allow an     attacker to read allocated and unallocated memory when     parsing a phar file (bsc#1126713).

  - CVE-2019-9023: Fixed multiple heap-based buffer     over-read instances in mbstring regular expression     functions (bsc#1126823).

  - CVE-2019-9641: Fixed multiple invalid memory access in     EXIF extension and improved insecure implementation of     rename function (bsc#1128722).

  - CVE-2018-19935: Fixed a Denial of Service in php_imap.c     which could be triggered via an empty string in the     message argument to imap_mail (bsc#1118832).

  - CVE-2019-11034: Fixed a heap-buffer overflow in     php_ifd_get32si() (bsc#1132838).

  - CVE-2019-11035: Fixed a heap-buffer overflow in     exif_iif_add_value() (bsc#1132837).

  - CVE-2019-11036: Fixed buffer over-read in     exif_process_IFD_TAG function leading to information     disclosure (bsc#1134322).

Other issue addressed :

  - Deleted README.default_socket_timeout which is not     needed anymore (bsc#1129032).

  - Enabled php7 testsuite (bsc#1119396).

This update was imported from the SUSE:SLE-15:Update update project.

This update for php7 fixes the following issues :

Security issues fixed :

CVE-2019-9637: Fixed improper implementation of rename function and multiple invalid memory access in EXIF extension (bsc#1128892).

CVE-2019-9675: Fixed improper implementation of rename function and multiple invalid memory access in EXIF extension (bsc#1128886).

CVE-2019-9638: Fixed improper implementation of rename function and multiple invalid memory access in EXIF extension ((bsc#1128889).

CVE-2019-9639: Fixed improper implementation of rename function and multiple invalid memory access in EXIF extension (bsc#1128887).

CVE-2019-9640: Fixed improper implementation of rename function and multiple invalid memory access in EXIF extension (bsc#1128883).

CVE-2019-9022: Fixed a vulnerability which could allow a hostile DNS server to make PHP misuse memcpy (bsc#1126827).

CVE-2019-9024: Fixed a vulnerability in xmlrpc_decode function which could allow to a hostile XMLRPC server to cause memory read outside the allocated areas (bsc#1126821).

CVE-2019-9020: Fixed a heap out of bounds in xmlrpc_decode function (bsc#1126711).

CVE-2018-20783: Fixed a buffer over-read in PHAR reading functions which could allow an attacker to read allocated and unallocated memory when parsing a phar file (bsc#1127122).

CVE-2019-9021: Fixed a heap buffer-based buffer over-read in PHAR reading functions which could allow an attacker to read allocated and unallocated memory when parsing a phar file (bsc#1126713).

CVE-2019-9023: Fixed multiple heap-based buffer over-read instances in mbstring regular expression functions (bsc#1126823).

CVE-2019-9641: Fixed multiple invalid memory access in EXIF extension and improved insecure implementation of rename function (bsc#1128722).

CVE-2018-19935: Fixed a Denial of Service in php_imap.c which could be triggered via an empty string in the message argument to imap_mail (bsc#1118832).

CVE-2019-11034: Fixed a heap-buffer overflow in php_ifd_get32si() (bsc#1132838).

CVE-2019-11035: Fixed a heap-buffer overflow in exif_iif_add_value() (bsc#1132837).

CVE-2019-11036: Fixed buffer over-read in exif_process_IFD_TAG function leading to information disclosure (bsc#1134322).

Other issue addressed: Deleted README.default_socket_timeout which is not needed anymore (bsc#1129032).

Enabled php7 testsuite (bsc#1119396).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for php7 fixes the following issues :

Security issue fixed :

  - CVE-2019-6977: Fixed a heap-based buffer overflow the GD     Graphics Library used in the imagecolormatch function     (bsc#1123354).

  - CVE-2019-6978: Fixed a double free in the gdImage*Ptr()     functions (bsc#1123522).

  - CVE-2018-19935: Fixed a Denial of Service in php_imap.c     which could be triggered via an empty string in the     message argument to imap_mail (bsc#1118832).

This update was imported from the SUSE:SLE-12:Update update project.

This update for php7 fixes the following issues :

Security issue fixed :

CVE-2019-6977: Fixed a heap-based buffer overflow the GD Graphics Library used in the imagecolormatch function (bsc#1123354).

CVE-2019-6978: Fixed a double free in the gdImage*Ptr() functions (bsc#1123522).

CVE-2018-19935: Fixed a Denial of Service in php_imap.c which could be triggered via an empty string in the message argument to imap_mail (bsc#1118832).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its banner, the version of PHP running on the remote web server is 7.1.x prior to 7.1.26. It is, therefore, affected by multiple vulnerabilities:

  - An integer underflow condition exists in _gdContributionsAlloc   function in gd_interpolation.c. An unauthenticated, remote attacker   can have unspecified impact via vectors related to decrementing   the u variable. (CVE-2016-10166)

  - A denial of service (DoS) vulnerability exists in   ext/imap/php_imap.c. An unauthenticated, remote attacker can   exploit this issue, via an empty string in the message argument   to the imap_mail function, to cause the application to stop   responding. (CVE-2018-19935)

  - A heap-based buffer overflow condition exists in gdImageColorMatch   due to improper calculation of the allocated buffer size. An   unauthenticated, remote attacker can exploit this via calling the   imagecolormatch function with crafted image data as parameters, to   cause a denial of service condition or the execution of arbitrary   code. (CVE-2019-6977)

  - A heap-based buffer over-read exists in the xmlrpc_decode function   due to improper validation of input data. An unauthenticated, remote   attacker can exploit this, via a specially crafted request, to cause   a heap out-of-bounds read or read-after-free condition, which could   result in a complete system compromise. (CVE-2019-9020)

  - A heap-based buffer over-read exists in the PHAR reading functions   in the PHAR extension, due to improper implementation of memory   operations. An unauthenticated, remote attacker can exploit this,   via persuading a user to parse a specially crafted file name on the   targeted system, to disclose sensitive information. (CVE-2019-9021)

  - An information disclosure vulnerability exists in the   dns_get_record function due to improper parsing of DNS responses. An   unauthenticated, remote attacker can exploit this, via a specially   crafted DNS reply sent from a rogue DNS server to disclose   potentially sensitive information. (CVE-2019-9022)

  - Multiple heap-based buffer over-read instances exist in mbstring   regular expression functions due to improper implementation of   memory operations. An unauthenticated, remote attacker can exploit   this by sending a specially crafted regular expression that contains   multibyte sequences, to cause a condition that could allow the   attacker to completely compromise the target system. (CVE-2019-9023)

  - An out-of-bounds read error exists in the xmlrpc_decode function   due to improper implementation of memory operations. An   unauthenticated, remote attacker can exploit this, via a hostile   XMLRPC server to cause PHP to read from memory outside of allocated   areas. (CVE-2019-9024)

According to its banner, the version of PHP running on the remote web server is 7.2.x prior to 7.2.14. It is, therefore, affected by multiple vulnerabilities:

  - An integer underflow condition exists in _gdContributionsAlloc   function in gd_interpolation.c. An unauthenticated, remote attacker   can have unspecified impact via vectors related to decrementing   the u variable. (CVE-2016-10166)

  - A denial of service (DoS) vulnerability exists in   ext/imap/php_imap.c. An unauthenticated, remote attacker can   exploit this issue, via an empty string in the message argument   to the imap_mail function, to cause the application to stop   responding. (CVE-2018-19935)

  - A heap-based buffer overflow exists in gdImageColorMatch in   gd_color_match.c in the GD Graphics Library (aka LibGD) 2.2.5.
  An unauthenticated, remote attacker can exploit this via the   triggering of imagecolormatch calls with crafted image data, to   cause a denial of service condition or the execution of arbitrary   code. (CVE-2019-6977)

  - A heap-based buffer over-read exists in the xmlrpc_decode function   due to improper validation of input data. An unauthenticated, remote   attacker can exploit this, via a specially crafted request, to cause   a heap out-of-bounds read or read-after-free condition, which could   result in a complete system compromise. (CVE-2019-9020)

  - A heap-based buffer over-read exists in the PHAR reading functions   in the PHAR extension, due to improper implementation of memory   operations. An unauthenticated, remote attacker can exploit this,   via persuading a user to parse a specially crafted file name on the   targeted system, to disclose sensitive information. (CVE-2019-9021)

  - An information disclosure vulnerability exists in the   dns_get_record function due to improper parsing of DNS responses. An   unauthenticated, remote attacker can exploit this, via a specially   crafted DNS reply sent from a rogue DNS server to disclose   potentially sensitive information. (CVE-2019-9022)

  - Multiple heap-based buffer over-read instances exist in mbstring   regular expression functions due to improper implementation of   memory operations. An unauthenticated, remote attacker can exploit   this by sending a specially crafted regular expression that contains   multibyte sequences, to cause a condition that could allow the   attacker to completely compromise the target system. (CVE-2019-9023)

  - An out-of-bounds read error exists in the xmlrpc_decode function   due to improper implementation of memory operations. An   unauthenticated, remote attacker can exploit this, via a hostile   XMLRPC server to cause PHP to read from memory outside of allocated   areas. (CVE-2019-9024)

ext/imap/php_imap.c in PHP 5.x and 7.x before 7.3.0 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an empty string in the message argument to the imap_mail function.(CVE-2018-19935)

University of Washington IMAP Toolkit 2007f on UNIX, as used in imap_open() in PHP and other products, launches an rsh command (by means of the imap_rimap function in c-client/imap4r1.c and the tcp_aopen function in osdep/unix/tcp_unix.c) without preventing argument injection, which might allow remote attackers to execute arbitrary OS commands if the IMAP server name is untrusted input (e.g., entered by a user of a web application) and if rsh has been replaced by a program with different argument semantics. For example, if rsh is a link to ssh (as seen on Debian and Ubuntu systems), then the attack can use an IMAP server name containing a '-oProxyCommand' argument.(CVE-2018-19518)

**PHP version 7.2.13** (06 Dec 2018)

**ftp:**

  - Fixed bug php#77151 (ftp_close(): SSL_read on shutdown).
    (Remi)

**CLI:**

  - Fixed bug php#77111 (php-win.exe corrupts unicode     symbols from cli parameters). (Anatol)

**Fileinfo:**

  - Fixed bug php#77095 (slowness regression in 7.2/7.3     (compared to 7.1)). (Anatol)

**iconv:**

  - Fixed bug php#77147 (Fixing 60494 ignored     ICONV_MIME_DECODE_CONTINUE_ON_ERROR). (cmb)

**Core:**

  - Fixed bug php#77231 (Segfault when using     convert.quoted-printable-encode filter). (Stas)

**IMAP:**

  - Fixed bug php#77153 (imap_open allows to run arbitrary     shell commands via mailbox parameter). (Stas)

**ODBC:**

  - Fixed bug php#77079 (odbc_fetch_object has incorrect     type signature). (Jon Allen)

**Opcache:**

  - Fixed bug php#77058 (Type inference in opcache causes     side effects). (Nikita)

  - Fixed bug php#77092 (array_diff_key() - segmentation     fault). (Nikita)

**Phar:**

  - Fixed bug php#77022 (PharData always creates new files     with mode 0666). (Stas)

  - Fixed bug php#77143 (Heap Buffer Overflow (READ: 4) in     phar_parse_pharfile). (Stas)

**PGSQL:**

  - Fixed bug php#77047 (pg_convert has a broken regex for     the 'TIME WITHOUT TIMEZONE' data type). (Andy Gajetzki)

**SOAP:**

  - Fixed bug php#50675 (SoapClient can't handle object     references correctly). (Cameron Porter)

  - Fixed bug php#76348 (WSDL_CACHE_MEMORY causes     Segmentation fault). (cmb)

  - Fixed bug php#77141 (Signedness issue in SOAP when     precision=-1). (cmb)

**Sockets:**

  - Fixed bug php#67619 (Validate length on socket_write).
    (thiagooak)

----

**From upstream**

**IMAP**

  - Fix php#77020 NULL pointer dereference in imap_mail     CVE-2018-19935

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its banner, the version of PHP running on the remote web server is 5.6.x prior to 5.6.39. It is, therefore, affected by multiple vulnerabilities:

  - An arbitrary command injection vulnerability exists in the   imap_open function due to improper filters for mailbox names prior   to passing them to rsh or ssh commands. An authenticated, remote   attacker can exploit this by sending a specially crafted IMAP server   name to cause the execution of arbitrary commands on the target   system. (CVE-2018-19518)

  - A denial of service (DoS) vulnerability exists in   ext/imap/php_imap.c. An unauthenticated, remote attacker can   exploit this issue, via an empty string in the message argument   to the imap_mail function, to cause the application to stop   responding. (CVE-2018-19935)

  - A heap buffer over-read exists in the phar_parse_pharfile function.
  An unauthenticated, remote attacker can exploit this to read   allocated or unallocated memory past the actual data when trying to   parse a .phar file. (CVE-2018-20783)

Vulnerabilities have been discovered in php5, a server-side, HTML-embedded scripting language. Note that this update includes a change to the default behavior for IMAP connections. See below for details.

CVE-2018-19518

An argument injection vulnerability in imap_open() may allow a remote attacker to execute arbitrary OS commands on the IMAP server.

The fix for the CVE-2018-19518 vulnerability included this additional note from the upstream developers :

Starting with 5.6.38, rsh/ssh logins are disabled by default. Use imap.enable_insecure_rsh if you want to enable them. Note that the IMAP library does not filter mailbox names before passing them to rsh/ssh command, thus passing untrusted data to this function with rsh/ssh enabled is insecure.

CVE-2018-19935

A NULL pointer dereference leads to an application crash and a denial of service via an empty string in the message argument to the imap_mail function of ext/imap/php_imap.c.

For Debian 8 'Jessie', these problems have been fixed in version 5.6.39+dfsg-0+deb8u1.

We recommend that you upgrade your php5 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple security issues were found in PHP, a widely-used open source general purpose scripting language: The EXIF module was susceptible to denial of service/information disclosure when parsing malformed images, the Apache module allowed cross-site-scripting via the body of a 'Transfer-Encoding: chunked' request and the IMAP extension performed insufficient input validation which can result in the execution of arbitrary shell commands in the imap_open() function and denial of service in the imap_mail() function.

According to its banner, the version of PHP running on the remote web server is 7.3.0 [alpha|beta] prior to 7.3.0. It is, therefore, affected by multiple vulnerabilities:

  - An arbitrary command injection vulnerability exists in   the imap_open function due to improper filters for mailbox names   prior to passing them to rsh or ssh commands. An authenticated,   remote attacker can exploit this by sending a specially crafted IMAP   server name to cause the execution of arbitrary commands on the   target system. (CVE-2018-19518)

  - A denial of service vulnerability exists in the imap_mail function   due to improper data validation. An unauthenticated, remote attacker   can exploit this via an empty string in the message argument to the   imap_mail function to cause the application to stop responding.
  (CVE-2018-19935)

  - A heap buffer over-read exists in the phar_parse_pharfile function.
  An unauthenticated, remote attacker can exploit this to read   allocated or unallocated memory past the actual data when trying to   parse a .phar file. (CVE-2018-20783)

ID	Name	Product	Family	Severity
406312	Alpine: php7: security update to 7.1.29-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
406312	Alpine: php7: security update to 7.1.29-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
406298	Alpine: php5: security update to 5.6.39-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
406298	Alpine: php5: security update to 5.6.39-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
167950	SUSE SLES15: apache2-mod_php7 / php7 / php7-bcmath / php7-bz2 / php7-calendar / etc (SUSE-SU-2022:4067-1)	Nessus	SuSE Local Security Checks	critical
132812	EulerOS Virtualization for ARM 64 3.0.5.0 : php (EulerOS-SA-2020-1058)	Nessus	Huawei Local Security Checks	critical
132616	EulerOS 2.0 SP8 : php (EulerOS-SA-2020-1023)	Nessus	Huawei Local Security Checks	high
126035	openSUSE Security Update : php7 (openSUSE-2019-1573)	Nessus	SuSE Local Security Checks	critical
126034	openSUSE Security Update : php7 (openSUSE-2019-1572)	Nessus	SuSE Local Security Checks	critical
125850	SUSE SLED15 / SLES15 Security Update : php7 (SUSE-SU-2019:1461-1)	Nessus	SuSE Local Security Checks	critical
122394	openSUSE Security Update : php7 (openSUSE-2019-207)	Nessus	SuSE Local Security Checks	critical
122146	SUSE SLES12 Security Update : php7 (SUSE-SU-2019:0333-1)	Nessus	SuSE Local Security Checks	critical
121510	PHP 7.1.x < 7.1.26 Multiple vulnerabilities.	Nessus	CGI abuses	critical
121353	PHP 7.2.x < 7.2.14 Multiple vulnerabilities.	Nessus	CGI abuses	critical
121132	Amazon Linux AMI : php56 / php70,php71,php72 (ALAS-2019-1147)	Nessus	Amazon Linux Local Security Checks	high
120854	Fedora 28 : php (2018-dfe1f0bac6)	Nessus	Fedora Local Security Checks	high
120566	Fedora 29 : php (2018-7ebfe1e6f2)	Nessus	Fedora Local Security Checks	high
119764	PHP 5.6.x < 5.6.39 Multiple vulnerabilities	Nessus	CGI abuses	high
119695	Debian DLA-1608-1 : php5 security update	Nessus	Debian Local Security Checks	high
119561	Debian DSA-4353-1 : php7.0 - security update	Nessus	Debian Local Security Checks	high
111217	PHP 7.3.0 [alpha\|beta] < 7.3.0 Multiple vulnerabilities	Nessus	CGI abuses	high

Detections

Analytics

CVE-2018-19935

high

Tenable Plugins

critical

critical

high

high

critical

critical

high

critical

critical

critical

critical

critical

critical

critical

high

high

high

high

high

high

high