An issue was discovered in PHP 7.3.x before 7.3.1. An invalid multibyte string supplied as an argument to the mb_split() function in ext/mbstring/php_mbregex.c can cause PHP to execute memcpy() with a negative argument, which could read and write past buffers allocated for the data.

According to the versions of the php packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - When PHP EXIF extension is parsing EXIF information     from an image, e.g. via exif_read_data() function, in     PHP versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and     7.3.x below 7.3.6 it is possible to supply it with data     what will cause it to read past the allocated buffer.
    This may lead to information disclosure or     crash.(CVE-2019-11040)

  - Function iconv_mime_decode_headers() in PHP versions     7.1.x below 7.1.30, 7.2.x below 7.2.19 and 7.3.x below     7.3.6 may perform out-of-buffer read due to integer     overflow when parsing MIME headers. This may lead to     information disclosure or crash.(CVE-2019-11039)

  - ** DISPUTED ** An issue was discovered in PHP 7.x     before 7.1.27 and 7.3.x before 7.3.3.
    phar_tar_writeheaders_int in ext/phar/tar.c has a     buffer overflow via a long link value. NOTE: The vendor     indicates that the link value is used only when an     archive contains a symlink, which currently cannot     happen: 'This issue allows theoretical compromise of     security, but a practical attack is usually     impossible.'(CVE-2019-9675)

  - An issue was discovered in PHP 7.3.x before 7.3.1. An     invalid multibyte string supplied as an argument to the     mb_split() function in ext/mbstring/php_mbregex.c can     cause PHP to execute memcpy() with a negative argument,     which could read and write past buffers allocated for     the data.(CVE-2019-9025)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the php packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - PHP is an HTML-embedded scripting language. PHP     attempts to make it easy for developers to write     dynamically generated web pages. PHP also offers     built-in database integration for several commercial     and non-commercial database management systems, so     writing a database-enabled webpage with PHP is fairly     simple. The most common use of PHP coding is probably     as a replacement for CGI scripts. The php package     contains the module (often referred to as mod_php)     which adds support for the PHP language to Apache HTTP     Server.Security Fix(es):Function     iconv_mime_decode_headers() in PHP versions 7.1.x below     7.1.30, 7.2.x below 7.2.19 and 7.3.x below 7.3.6 may     perform out-of-buffer read due to integer overflow when     parsing MIME headers. This may lead to information     disclosure or crash.(CVE-2019-11039)When PHP EXIF     extension is parsing EXIF information from an image,     e.g. via exif_read_data() function, in PHP versions     7.1.x below 7.1.30, 7.2.x below 7.2.19 and 7.3.x below     7.3.6 it is possible to supply it with data what will     cause it to read past the allocated buffer. This may     lead to information disclosure or     crash.(CVE-2019-11040)An issue was discovered in PHP     7.3.x before 7.3.1. An invalid multibyte string     supplied as an argument to the mb_split() function in     ext/mbstring/php_mbregex.c can cause PHP to execute     memcpy() with a negative argument, which could read and     write past buffers allocated for the     data.(CVE-2019-9025)An issue was discovered in PHP 7.x     before 7.1.27 and 7.3.x before 7.3.3.
    phar_tar_writeheaders_int in ext/phar/tar.c has a     buffer overflow via a long link value. NOTE: The vendor     indicates that the link value is used only when an     archive contains a symlink, which currently cannot     happen: 'This issue allows theoretical compromise of     security, but a practical attack is usually     impossible.'(CVE-2019-9675)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its banner, the version of PHP running on the remote web server is 5.6.x prior to 5.6.40, 7.1.x prior to 7.1.26, 7.2.x prior to 7.2.14 or 7.3.x prior to 7.3.1. It is, therefore, affected by multiple vulnerabilities:

 - An integer underflow condition exists in _gdContributionsAlloc function in gd_interpolation.c. An unauthenticated, remote attacker can have unspecified impact via vectors related to decrementing the u variable. (CVE-2016-10166)

 - A heap-based buffer overflow condition exists in gdImageColorMatch due to improper calculation of the allocated buffer size. An attacker can exploit this, via calling imagecolormatch function with crafted image data as parameters. (CVE-2019-6977)

 - A heap-based buffer over-read exists in the xmlrpc_decode function due to improper validation of input data. An unauthenticated, remote attacker can exploit this, via a specially crafted request, to cause a heap out-of-bounds read or read-after-free condition, which could result in a complete system compromise. (CVE-2019-9020)

 - A heap-based buffer over-read exists in the PHAR reading functions in the PHAR extension, due to improper implementation of memory operations. An unauthenticated, remote attacker can exploit this, via persuading a user to parse a specially crafted file name on the targeted system, to disclose sensitive information. (CVE-2019-9021)

 - An out-of-bounds read error exists in the dns_get_record function due to improper parsing of DNS responses. An unauthenticated, remote attacker can exploit this, via a specially crafted DNS reply, to disclose memory contents. (CVE-2019-9022)

 - Multiple heap-based buffer over-read instances exist in mbstring regular expression functions due to improper implementation of memory operations. An unauthenticated, remote attacker can exploit this by sending a specially crafted regular expression that contains multibyte sequences, to cause a condition that could allow the attacker to completely compromise the target system. (CVE-2019-9023)

 - An out-of-bounds read error exists in the xmlrpc_decode function due to improper implementation of memory operations. An unauthenticated, remote attacker can exploit this, via a hostile XMLRPC server to cause PHP to read from memory outside of allocated areas. (CVE-2019-9024)

 - An out-of-bounds read and write error exists in the mb_split function due to improper implementation of memory operations. An unauthenticated, remote attacker can exploit this by causing PHP to execute the memcpy function with a negative argument, to cause buffer over-read and over-write conditions which could allow the attacker to completely compromise the system. (CVE-2019-9025)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its banner, the version of PHP running on the remote web server is 7.3.x prior to 7.3.1. It is, therefore, affected by multiple vulnerabilities:

  - An integer underflow condition exists in _gdContributionsAlloc   function in gd_interpolation.c. An unauthenticated, remote attacker   can have unspecified impact via vectors related to decrementing   the u variable.
  (CVE-2016-10166)

  - A heap-based buffer overflow condition exists in   gdImageColorMatch due to improper calculation of the allocated   buffer size. An attacker can exploit this, via calling   imagecolormatch function with crafted image data as parameters.
  (CVE-2019-6977)

  - A heap-based buffer over-read exists in the xmlrpc_decode function   due to improper validation of input data. An unauthenticated, remote   attacker can exploit this, via a specially crafted request, to cause   a heap out-of-bounds read or read-after-free condition, which could   result in a complete system compromise.
  (CVE-2019-9020)

  - A heap-based buffer over-read exists in the PHAR reading functions   in the PHAR extension, due to improper implementation of memory   operations. An unauthenticated, remote attacker can exploit this,   via persuading a user to parse a specially crafted file name on the   targeted system, to disclose sensitive information.
  (CVE-2019-9021)

  - Multiple heap-based buffer over-read instances exist in mbstring   regular expression functions due to improper implementation of   memory operations. An unauthenticated, remote attacker can exploit   this by sending a specially crafted regular expression that contains   multibyte sequences, to cause a condition that could allow the   attacker to completely compromise the target system.
  (CVE-2019-9023)

  - An out-of-bounds read error exists in the xmlrpc_decode function   due to improper implementation of memory operations. An   unauthenticated, remote attacker can exploit this, via a hostile   XMLRPC server to cause PHP to read from memory outside of allocated   areas.
  (CVE-2019-9024)

  - An out-of-bounds read and write error exists in the mb_split   function due to improper implementation of memory operations. An   unauthenticated, remote attacker can exploit this by causing PHP to   execute the memcpy function with a negative argument, to cause   buffer over-read and over-write conditions which could allow the   attacker to completely compromise the system.
  (CVE-2019-9025)

ID	Name	Product	Family	Severity
140983	EulerOS Virtualization for ARM 64 3.0.6.0 : php (EulerOS-SA-2020-2035)	Nessus	Huawei Local Security Checks	critical
139977	EulerOS 2.0 SP8 : php (EulerOS-SA-2020-1874)	Nessus	Huawei Local Security Checks	critical
98245	PHP 5.6.x < 5.6.40 Multiple vulnerabilities	Web App Scanning	Component Vulnerability	critical
98244	PHP 7.1.x < 7.1.26 Multiple vulnerabilities	Web App Scanning	Component Vulnerability	critical
98243	PHP 7.2.x < 7.2.14 Multiple vulnerabilities	Web App Scanning	Component Vulnerability	critical
98242	PHP 7.3.x < 7.3.1 Multiple vulnerabilities	Web App Scanning	Component Vulnerability	critical
121475	PHP 7.3.x < 7.3.1 Multiple vulnerabilities.	Nessus	CGI abuses	critical

Detections

Analytics

CVE-2019-9025

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical