In PHP versions 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, when using proc_open() command with array syntax, due to insufficient escaping, if the arguments of the executed command are controlled by a malicious user, the user can supply arguments that would execute arbitrary commands in Windows shell.

The version of php installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-1874 advisory.

  - In PHP versions 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, when using proc_open()     command with array syntax, due to insufficient escaping, if the arguments of the executed command are     controlled by a malicious user, the user can supply arguments that would execute arbitrary commands in     Windows shell. (CVE-2024-1874)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-52c23ef1ec advisory.

    **PHP version 8.2.20** (06 Jun 2024)

    **CGI:**

    * Fixed buffer limit on Windows, replacing read call usage by _read. (David Carlier)
    * Fixed bug [GHSA-3qgc-jrrr-25jv](https://github.com/php/php-src/security/advisories/GHSA-3qgc-jrrr-25jv)     (Bypass of CVE-2012-1823, Argument Injection in PHP-CGI). (CVE-2024-4577) (nielsdos)

    **CLI:**

    * Fixed bug [GH-14189](https://github.com/php/php-src/issues/14189) (PHP Interactive shell input state     incorrectly handles quoted heredoc literals.). (nielsdos)

    **Core:**

    * Fixed bug [GH-13970](https://github.com/php/php-src/issues/13970) (Incorrect validation of #[Attribute]     flags type for non-compile-time expressions). (ilutov)
    * Fixed bug [GH-14140](https://github.com/php/php-src/issues/14140) (Floating point bug in range operation     on Apple Silicon hardware). (Derick, Saki)

    **DOM:**

    * Fix crashes when entity declaration is removed while still having entity references. (nielsdos)
    * Fix references not handled correctly in C14N. (nielsdos)
    * Fix crash when calling childNodes next() when iterator is exhausted. (nielsdos)
    * Fix crash in ParentNode::append() when dealing with a fragment containing text nodes. (nielsdos)

    **FFI:**

    * Fixed bug [GH-14215](https://github.com/php/php-src/issues/14215) (Cannot use FFI::load on CRLF header     file with apache2handler). (nielsdos)

    **Filter:**

    * Fixed bug [GHSA-w8qr-v226-r27w](https://github.com/php/php-src/security/advisories/GHSA-w8qr-v226-r27w)     (Filter bypass in filter_var FILTER_VALIDATE_URL). (**CVE-2024-5458**) (nielsdos)

    **FPM:**

    * Fix bug [GH-14175](https://github.com/php/php-src/issues/14175) (Show decimal number instead of     scientific notation in systemd status). (Benjamin Cremer)

    **Hash:**

    * ext/hash: Swap the checking order of `__has_builtin` and `__GNUC__` (Saki Takamachi)

    **Intl:**

    * Fixed build regression on systems without C++17 compilers. (Calvin Buckley, Peter Kokot)

    **Ini:**

    * Fixed bug [GH-14100](https://github.com/php/php-src/issues/14100) (Corrected spelling mistake in php.ini     files). (Marcus Xavier)

    **MySQLnd:**

    * Fix bug [GH-14255](https://github.com/php/php-src/issues/14255) (mysqli_fetch_assoc reports error from     nested query). (Kamil Tekiela)

    **Opcache:**

    * Fixed bug [GH-14109](https://github.com/php/php-src/issues/14109) (Fix accidental persisting of internal     class constant in shm). (ilutov)

    **OpenSSL:**

    * The openssl_private_decrypt function in PHP, when using PKCS1 padding (OPENSSL_PKCS1_PADDING, which is     the default), is vulnerable to the Marvin Attack unless it is used with an OpenSSL version that includes     the changes from this pull request: https://github.com/openssl/openssl/pull/13817     (rsa_pkcs1_implicit_rejection). These changes are part of OpenSSL 3.2 and have also been backported to     stable versions of various Linux distributions, as well as to the PHP builds provided for Windows since     the previous release. All distributors and builders should ensure that this version is used to prevent PHP     from being vulnerable. (**CVE-2024-2408**)

    **Standard:**

    * Fixed bug [GHSA-9fcc-425m-g385](https://github.com/php/php-src/security/advisories/GHSA-9fcc-425m-g385)     (Bypass of CVE-2024-1874). (CVE-2024-5585) (nielsdos)

    **XML:**

    * Fixed bug [GH-14124](https://github.com/php/php-src/issues/14124) (Segmentation fault with XML extension     under certain memory limit). (nielsdos)

    **XMLReader:**

    * Fixed bug [GH-14183](https://github.com/php/php-src/issues/14183) (XMLReader::open() can't be     overridden). (nielsdos)



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-49aba7b305 advisory.

    **PHP version 8.3.8** (06 Jun 2024)

    **CGI:**

    * Fixed buffer limit on Windows, replacing read call usage by _read. (David Carlier)
    * Fixed bug [GHSA-3qgc-jrrr-25jv](https://github.com/php/php-src/security/advisories/GHSA-3qgc-jrrr-25jv)     (Bypass of CVE-2012-1823, Argument Injection in PHP-CGI). (CVE-2024-4577) (nielsdos)

    **CLI:**

    * Fixed bug [GH-14189](https://github.com/php/php-src/issues/14189) (PHP Interactive shell input state     incorrectly handles quoted heredoc literals.). (nielsdos)

    **Core:**

    * Fixed bug [GH-13970](https://github.com/php/php-src/issues/13970) (Incorrect validation of #[Attribute]     flags type for non-compile-time expressions). (ilutov)

    **DOM:**

    * Fix crashes when entity declaration is removed while still having entity references. (nielsdos)
    * Fix references not handled correctly in C14N. (nielsdos)
    * Fix crash when calling childNodes next() when iterator is exhausted. (nielsdos)
    * Fix crash in ParentNode::append() when dealing with a fragment containing text nodes. (nielsdos)

    **Filter:**

    * Fixed bug [GHSA-w8qr-v226-r27w](https://github.com/php/php-src/security/advisories/GHSA-w8qr-v226-r27w)     (Filter bypass in filter_var FILTER_VALIDATE_URL). (**CVE-2024-5458**) (nielsdos)

    **FPM:**

    * Fix bug [GH-14175](https://github.com/php/php-src/issues/14175) (Show decimal number instead of     scientific notation in systemd status). (Benjamin Cremer)

    **Hash:**

    * ext/hash: Swap the checking order of `__has_builtin` and `__GNUC__` (Saki Takamachi)

    **Intl:**

    * Fixed build regression on systems without C++17 compilers. (Calvin Buckley, Peter Kokot)

    **MySQLnd:**

    * Fix bug [GH-14255](https://github.com/php/php-src/issues/14255) (mysqli_fetch_assoc reports error from     nested query). (Kamil Tekiela)

    **Opcache:**

    * Fixed bug [GH-14109](https://github.com/php/php-src/issues/14109) (Fix accidental persisting of internal     class constant in shm). (ilutov)

    **OpenSSL:**

    * The openssl_private_decrypt function in PHP, when using PKCS1 padding (OPENSSL_PKCS1_PADDING, which is     the default), is vulnerable to the Marvin Attack unless it is used with an OpenSSL version that includes     the changes from this pull request: https://github.com/openssl/openssl/pull/13817     (rsa_pkcs1_implicit_rejection). These changes are part of OpenSSL 3.2 and have also been backported to     stable versions of various Linux distributions, as well as to the PHP builds provided for Windows since     the previous release. All distributors and builders should ensure that this version is used to prevent PHP     from being vulnerable. (**CVE-2024-2408**)

    **Standard:**

    * Fixed bug [GHSA-9fcc-425m-g385](https://github.com/php/php-src/security/advisories/GHSA-9fcc-425m-g385)     (Bypass of CVE-2024-1874). (CVE-2024-5585) (nielsdos)

    **XML:**

    * Fixed bug [GH-14124](https://github.com/php/php-src/issues/14124) (Segmentation fault with XML extension     under certain memory limit). (nielsdos)

    **XMLReader:**

    * Fixed bug [GH-14183](https://github.com/php/php-src/issues/14183) (XMLReader::open() can't be     overridden). (nielsdos)


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version, the Tenable Security Center running on the remote host is prior to 6.4.0. It is, therefore, affected by multiple vulnerabilities as referenced in the TNS-2024-10 advisory.

  - Security Center leverages third-party software to help provide underlying functionality. Several of the     third-party components (Apache, PHP) were found to contain vulnerabilities, and updated versions have been     made available by the providers.Out of caution and in line with best practice, Tenable has opted to     upgrade these components to address the potential impact of the issues. Security Center 6.4.0 updates     Apache to version 2.4.59 and PHP to version 8.2.13 to address the identified vulnerabilities.Additionally,     two separate vulnerabilities were discovered, reported and fixed:A stored cross site scripting     vulnerability exists in Tenable Security Center where an authenticated, remote attacker could inject HTML     code into a web application scan result page. - CVE-2024-1891An improper privilege management     vulnerability exists in Tenable Security Center where an authenticated, remote attacker could view     unauthorized objects and launch scans without having the required privileges. - CVE-2024-5759 Tenable has     released Security Center 6.4.0 to address these issues. The installation files can be obtained from the     Tenable Downloads Portal: https://www.tenable.com/downloads/security-center (CVE-2023-38709,     CVE-2024-1874, CVE-2024-1891, CVE-2024-24795, CVE-2024-27316, CVE-2024-3096, CVE-2024-5759)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the version of PHP installed on the remote host is 8.1.x prior to 8.1.29, 8.2.x prior to 8.2.20, or 8.3.x prior to 8.3.8. It is, therefore, affected by multiple vulnerabilities:

 - An argument Injection in PHP-CGI with a bypass of CVE-2012-1823. (CVE-2024-4577)

 - A filter bypass in filter_var FILTER_VALIDATE_URL. (CVE-2024-5458)

 - A bypass of CVE-2024-1874. (CVE-2024-5585)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of php81 installed on the remote host is prior to 8.1.29 / 8.3.8. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2024-158-01 advisory.

    New php packages are available for Slackware 15.0 and -current to fix security issues.

Tenable has extracted the preceding description block directly from the php81 security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of PHP installed on the remote host is prior to 8.1.29. It is, therefore, affected by multiple vulnerabilities as referenced in the Version 8.1.29 advisory.

  - sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-     cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote     attackers to execute arbitrary code by placing command-line options in the query string, related to lack     of skipping a certain php_getopt for the 'd' case. (CVE-2012-1823)

  - In PHP versions 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, when using proc_open()     command with array syntax, due to insufficient escaping, if the arguments of the executed command are     controlled by a malicious user, the user can supply arguments that would execute arbitrary commands in     Windows shell. (CVE-2024-1874)

  - In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-     CGI on Windows, if the system is set up to use certain code pages, Windows may use Best-Fit behavior to     replace characters in command line given to Win32 API functions. PHP CGI module may misinterpret those     characters as PHP options, which may allow a malicious user to pass options to PHP binary being run, and     thus reveal the source code of scripts, run arbitrary PHP code on the server, etc. (CVE-2024-4577)

  - In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, due to a code logic error,     filtering functions such as filter_var when validating URLs (FILTER_VALIDATE_URL) for certain types of     URLs the function will result in invalid user information (username + password part of URLs) being treated     as valid user information. This may lead to the downstream code accepting invalid URLs as valid and     parsing them incorrectly. (CVE-2024-5458)

  - In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, the fix for CVE-2024-1874     does not work if the command name includes trailing spaces. Original issue: when using proc_open() command     with array syntax, due to insufficient escaping, if the arguments of the executed command are controlled     by a malicious user, the user can supply arguments that would execute arbitrary commands in Windows shell.
    (CVE-2024-5585)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of PHP installed on the remote host is prior to 8.3.8. It is, therefore, affected by multiple vulnerabilities as referenced in the Version 8.3.8 advisory.

  - sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-     cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote     attackers to execute arbitrary code by placing command-line options in the query string, related to lack     of skipping a certain php_getopt for the 'd' case. (CVE-2012-1823)

  - In PHP versions 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, when using proc_open()     command with array syntax, due to insufficient escaping, if the arguments of the executed command are     controlled by a malicious user, the user can supply arguments that would execute arbitrary commands in     Windows shell. (CVE-2024-1874)

  - In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-     CGI on Windows, if the system is set up to use certain code pages, Windows may use Best-Fit behavior to     replace characters in command line given to Win32 API functions. PHP CGI module may misinterpret those     characters as PHP options, which may allow a malicious user to pass options to PHP binary being run, and     thus reveal the source code of scripts, run arbitrary PHP code on the server, etc. (CVE-2024-4577)

  - In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, due to a code logic error,     filtering functions such as filter_var when validating URLs (FILTER_VALIDATE_URL) for certain types of     URLs the function will result in invalid user information (username + password part of URLs) being treated     as valid user information. This may lead to the downstream code accepting invalid URLs as valid and     parsing them incorrectly. (CVE-2024-5458)

  - In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, the fix for CVE-2024-1874     does not work if the command name includes trailing spaces. Original issue: when using proc_open() command     with array syntax, due to insufficient escaping, if the arguments of the executed command are controlled     by a malicious user, the user can supply arguments that would execute arbitrary commands in Windows shell.
    (CVE-2024-5585)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-5e8ae0def0 advisory.

    **PHP version 8.3.6** (11 Apr 2024)

    **Core:**

    * Fixed [GH-13569](https://github.com/php/php-src/issues/13569) (GC buffer unnecessarily grows up to     GC_MAX_BUF_SIZE when scanning WeakMaps). (Arnaud)
    * Fixed bug [GH-13612](https://github.com/php/php-src/issues/13612) (Corrupted memory in destructor with     weak references). (nielsdos)
    * Fixed bug [GH-13446](https://github.com/php/php-src/issues/13446) (Restore exception handler after it     finishes). (ilutov)
    * Fixed bug [GH-13784](https://github.com/php/php-src/issues/13784) (AX_GCC_FUNC_ATTRIBUTE failure).
    (Remi)
    * Fixed bug [GH-13670](https://github.com/php/php-src/issues/13670) (GC does not scale well with a lot of     objects created in destructor). (Arnaud)

    **DOM:**

    * Add some missing ZPP checks. (nielsdos)
    * Fix potential memory leak in XPath evaluation results. (nielsdos)

    **FPM:**

    * Fixed [GH-11086](https://github.com/php/php-src/issues/11086) (FPM: config test runs twice in daemonised     mode). (Jakub Zelenka)
    * Fix incorrect check in fpm_shm_free(). (nielsdos)

    **GD:**

    * Fixed bug [GH-12019](https://github.com/php/php-src/issues/12019) (add GDLIB_CFLAGS in feature tests).
    (Michael Orlitzky)

    **Gettext:**

    * Fixed sigabrt raised with dcgettext/dcngettext calls with gettext 0.22.5 with category set to LC_ALL.
    (David Carlier)

    **MySQLnd:**

    * Fix [GH-13452](https://github.com/php/php-src/issues/13452) (Fixed handshake response [mysqlnd]). (Saki     Takamachi)
    * Fix incorrect charset length in check_mb_eucjpms(). (nielsdos)

    **Opcache:**

    * Fixed [GH-13508](https://github.com/php/php-src/issues/13508) (JITed QM_ASSIGN may be optimized out when     op1 is null). (Arnaud, Dmitry)
    * Fixed [GH-13712](https://github.com/php/php-src/issues/13712) (Segmentation fault for enabled observers     when calling trait method of internal trait when opcache is loaded). (Bob)

    **Random:**

    * Fixed bug [GH-13544](https://github.com/php/php-src/issues/13544) (Pre-PHP 8.2 compatibility for     mt_srand with unknown modes). (timwolla)
    * Fixed bug [GH-13690](https://github.com/php/php-src/issues/13690) (Global Mt19937 is not properly reset     in-between requests when MT_RAND_PHP is used). (timwolla)

    **Session:**

    * Fixed bug [GH-13680](https://github.com/php/php-src/issues/13680) (Segfault with session_decode and     compilation error). (nielsdos)

    **SPL:**

    * Fixed bug [GH-13685](https://github.com/php/php-src/issues/13685) (Unexpected null pointer in     zend_string.h). (nielsdos)

    **Standard:**

    * Fixed bug [GH-11808](https://github.com/php/php-src/issues/11808) (Live filesystem modified by tests).
    (nielsdos)
    * Fixed [GH-13402](https://github.com/php/php-src/issues/13402) (Added validation of `\n` in     $additional_headers of mail()). (SakiTakamachi)
    * Fixed bug [GH-13203](https://github.com/php/php-src/issues/13203) (file_put_contents fail on strings     over 4GB on Windows). (divinity76)
    * Fixed bug [GHSA-pc52-254m-w9w7](https://github.com/php/php-src/security/advisories/GHSA-pc52-254m-w9w7)     (Command injection via array-ish $command parameter of proc_open). (CVE-2024-1874) (Jakub Zelenka)
    * Fixed bug [GHSA-wpj3-hf5j-x4v4](https://github.com/php/php-src/security/advisories/GHSA-wpj3-hf5j-x4v4)     (__Host-/__Secure- cookie bypass due to partial CVE-2022-31629 fix). (**CVE-2024-2756**) (nielsdos)
    * Fixed bug [GHSA-h746-cjrr-wfmr](https://github.com/php/php-src/security/advisories/GHSA-h746-cjrr-wfmr)     (password_verify can erroneously return true, opening ATO risk). (**CVE-2024-3096**) (Jakub Zelenka) Fixed     bug [GHSA-fjp9-9hwx-59fq](https://github.com/php/php-src/security/advisories/GHSA-fjp9-9hwx-59fq)     (mb_encode_mimeheader runs endlessly for some inputs). (**CVE-2024-2757**) (Alex Dowad)
    * Fix bug [GH-13932](https://github.com/php/php-src/issues/13932) (Attempt to fix mbstring on windows     build) (msvc). (David Carlier)




Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the version of PHP installed on the remote host is 8.1.x prior to 8.1.28, 8.2.x prior to 8.2.18, or 8.3.x prior to 8.3.6. It is, therefore, affected by multiple vulnerabilities:

 - A command injection via array-ish $command parameter of proc_open. (CVE-2024-1874)

 - __Host-/__Secure- cookie bypass due to partial CVE-2022-31629 fix. (CVE-2024-2756)

 - password_verify can erroneously return true, opening ATO risk. (CVE-2024-3096)

 - mb_encode_mimeheader runs endlessly for some inputs. (CVE-2024-2757)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-39d50cc975 advisory.

    **PHP version 8.2.18** (11 Apr 2024)

    **Core:**

    * Fixed bug [GH-13612](https://github.com/php/php-src/issues/13612) (Corrupted memory in destructor with     weak references). (nielsdos)
    * Fixed bug [GH-13784](https://github.com/php/php-src/issues/13784) (AX_GCC_FUNC_ATTRIBUTE failure).
    (Remi)
    * Fixed bug [GH-13670](https://github.com/php/php-src/issues/13670) (GC does not scale well with a lot of     objects created in destructor). (Arnaud)

    **DOM:**

    * Add some missing ZPP checks. (nielsdos)
    * Fix potential memory leak in XPath evaluation results. (nielsdos)
    * Fix phpdoc for DOMDocument load methods. (VincentLanglet)

    **FPM**

    * Fix incorrect check in fpm_shm_free(). (nielsdos)

    **GD:**

    * Fixed bug [GH-12019](https://github.com/php/php-src/issues/12019) (add GDLIB_CFLAGS in feature tests).
    (Michael Orlitzky)

    **Gettext:**

    * Fixed sigabrt raised with dcgettext/dcngettext calls with gettext 0.22.5 with category set to LC_ALL.
    (David Carlier)

    **MySQLnd:**

    * Fix [GH-13452](https://github.com/php/php-src/issues/13452) (Fixed handshake response [mysqlnd]). (Saki     Takamachi)
    * Fix incorrect charset length in check_mb_eucjpms(). (nielsdos)

    **Opcache:**

    * Fixed [GH-13508](https://github.com/php/php-src/issues/13508) (JITed QM_ASSIGN may be optimized out when     op1 is null). (Arnaud, Dmitry)
    * Fixed [GH-13712](https://github.com/php/php-src/issues/13712) (Segmentation fault for enabled observers     when calling trait method of internal trait when opcache is loaded). (Bob)

    **PDO:**

    * Fix various PDORow bugs. (Girgias)

    **Random:**

    * Fixed bug [GH-13544](https://github.com/php/php-src/issues/13544) (Pre-PHP 8.2 compatibility for     mt_srand with unknown modes). (timwolla)
    * Fixed bug [GH-13690](https://github.com/php/php-src/issues/13690) (Global Mt19937 is not properly reset     in-between requests when MT_RAND_PHP is used). (timwolla)

    **Session:**

    * Fixed bug [GH-13680](https://github.com/php/php-src/issues/13680) (Segfault with session_decode and     compilation error). (nielsdos)

    **Sockets:**

    * Fixed bug [GH-13604](https://github.com/php/php-src/issues/13604) (socket_getsockname returns random     characters in the end of the socket name). (David Carlier)

    **SPL:**

    * Fixed bug [GH-13531](https://github.com/php/php-src/issues/13531) (Unable to resize SplfixedArray after     being unserialized in PHP 8.2.15). (nielsdos)
    * Fixed bug [GH-13685](https://github.com/php/php-src/issues/13685) (Unexpected null pointer in     zend_string.h). (nielsdos)

    **Standard:**

    * Fixed bug [GH-11808](https://github.com/php/php-src/issues/11808) (Live filesystem modified by tests).
    (nielsdos)
    * Fixed [GH-13402](https://github.com/php/php-src/issues/13402) (Added validation of `\n` in     $additional_headers of mail()). (SakiTakamachi)
    * Fixed bug [GH-13203](https://github.com/php/php-src/issues/13203) (file_put_contents fail on strings     over 4GB on Windows). (divinity76)
    * Fixed bug [GHSA-pc52-254m-w9w7](https://github.com/php/php-src/security/advisories/GHSA-pc52-254m-w9w7)     (Command injection via array-ish $command parameter of proc_open). (CVE-2024-1874) (Jakub Zelenka)
    * Fixed bug [GHSA-wpj3-hf5j-x4v4](https://github.com/php/php-src/security/advisories/GHSA-wpj3-hf5j-x4v4)     (__Host-/__Secure- cookie bypass due to partial CVE-2022-31629 fix). (**CVE-2024-2756**) (nielsdos)
    * Fixed bug [GHSA-h746-cjrr-wfmr](https://github.com/php/php-src/security/advisories/GHSA-h746-cjrr-wfmr)     (password_verify can erroneously return true, opening ATO risk). (**CVE-2024-3096**) (Jakub Zelenka)

    **XML:**

    * Fixed bug [GH-13517](https://github.com/php/php-src/issues/13517) (Multiple test failures when building     with --with-expat). (nielsdos)


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-b46619f761 advisory.

    **PHP version 8.2.18** (11 Apr 2024)

    **Core:**

    * Fixed bug [GH-13612](https://github.com/php/php-src/issues/13612) (Corrupted memory in destructor with     weak references). (nielsdos)
    * Fixed bug [GH-13784](https://github.com/php/php-src/issues/13784) (AX_GCC_FUNC_ATTRIBUTE failure).
    (Remi)
    * Fixed bug [GH-13670](https://github.com/php/php-src/issues/13670) (GC does not scale well with a lot of     objects created in destructor). (Arnaud)

    **DOM:**

    * Add some missing ZPP checks. (nielsdos)
    * Fix potential memory leak in XPath evaluation results. (nielsdos)
    * Fix phpdoc for DOMDocument load methods. (VincentLanglet)

    **FPM**

    * Fix incorrect check in fpm_shm_free(). (nielsdos)

    **GD:**

    * Fixed bug [GH-12019](https://github.com/php/php-src/issues/12019) (add GDLIB_CFLAGS in feature tests).
    (Michael Orlitzky)

    **Gettext:**

    * Fixed sigabrt raised with dcgettext/dcngettext calls with gettext 0.22.5 with category set to LC_ALL.
    (David Carlier)

    **MySQLnd:**

    * Fix [GH-13452](https://github.com/php/php-src/issues/13452) (Fixed handshake response [mysqlnd]). (Saki     Takamachi)
    * Fix incorrect charset length in check_mb_eucjpms(). (nielsdos)

    **Opcache:**

    * Fixed [GH-13508](https://github.com/php/php-src/issues/13508) (JITed QM_ASSIGN may be optimized out when     op1 is null). (Arnaud, Dmitry)
    * Fixed [GH-13712](https://github.com/php/php-src/issues/13712) (Segmentation fault for enabled observers     when calling trait method of internal trait when opcache is loaded). (Bob)

    **PDO:**

    * Fix various PDORow bugs. (Girgias)

    **Random:**

    * Fixed bug [GH-13544](https://github.com/php/php-src/issues/13544) (Pre-PHP 8.2 compatibility for     mt_srand with unknown modes). (timwolla)
    * Fixed bug [GH-13690](https://github.com/php/php-src/issues/13690) (Global Mt19937 is not properly reset     in-between requests when MT_RAND_PHP is used). (timwolla)

    **Session:**

    * Fixed bug [GH-13680](https://github.com/php/php-src/issues/13680) (Segfault with session_decode and     compilation error). (nielsdos)

    **Sockets:**

    * Fixed bug [GH-13604](https://github.com/php/php-src/issues/13604) (socket_getsockname returns random     characters in the end of the socket name). (David Carlier)

    **SPL:**

    * Fixed bug [GH-13531](https://github.com/php/php-src/issues/13531) (Unable to resize SplfixedArray after     being unserialized in PHP 8.2.15). (nielsdos)
    * Fixed bug [GH-13685](https://github.com/php/php-src/issues/13685) (Unexpected null pointer in     zend_string.h). (nielsdos)

    **Standard:**

    * Fixed bug [GH-11808](https://github.com/php/php-src/issues/11808) (Live filesystem modified by tests).
    (nielsdos)
    * Fixed [GH-13402](https://github.com/php/php-src/issues/13402) (Added validation of `\n` in     $additional_headers of mail()). (SakiTakamachi)
    * Fixed bug [GH-13203](https://github.com/php/php-src/issues/13203) (file_put_contents fail on strings     over 4GB on Windows). (divinity76)
    * Fixed bug [GHSA-pc52-254m-w9w7](https://github.com/php/php-src/security/advisories/GHSA-pc52-254m-w9w7)     (Command injection via array-ish $command parameter of proc_open). (CVE-2024-1874) (Jakub Zelenka)
    * Fixed bug [GHSA-wpj3-hf5j-x4v4](https://github.com/php/php-src/security/advisories/GHSA-wpj3-hf5j-x4v4)     (__Host-/__Secure- cookie bypass due to partial CVE-2022-31629 fix). (**CVE-2024-2756**) (nielsdos)
    * Fixed bug [GHSA-h746-cjrr-wfmr](https://github.com/php/php-src/security/advisories/GHSA-h746-cjrr-wfmr)     (password_verify can erroneously return true, opening ATO risk). (**CVE-2024-3096**) (Jakub Zelenka)

    **XML:**

    * Fixed bug [GH-13517](https://github.com/php/php-src/issues/13517) (Multiple test failures when building     with --with-expat). (nielsdos)


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 6d82c5e9-fc24-11ee-a689-04421a1baf97 advisory.

  - This update includes 3 security fixes: (CVE-2024-1874, CVE-2024-2756, CVE-2024-2757, CVE-2024-3096)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of php81 installed on the remote host is prior to 8.1.28 / 8.3.6. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2024-103-01 advisory.

  - In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the vulnerability enables network and same-site     attackers to set a standard insecure cookie in the victim's browser which is treated as a `__Host-` or     `__Secure-` cookie by PHP applications. (CVE-2022-31629)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of PHP installed on the remote host is prior to 8.1.28. It is, therefore, affected by multiple vulnerabilities as referenced in the Version 8.1.28 advisory.

  - In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the vulnerability enables network and same-site     attackers to set a standard insecure cookie in the victim's browser which is treated as a `__Host-` or     `__Secure-` cookie by PHP applications. (CVE-2022-31629)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of PHP installed on the remote host is prior to 8.3.6. It is, therefore, affected by multiple vulnerabilities as referenced in the Version 8.3.6 advisory.

  - In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the vulnerability enables network and same-site     attackers to set a standard insecure cookie in the victim's browser which is treated as a `__Host-` or     `__Secure-` cookie by PHP applications. (CVE-2022-31629)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of PHP installed on the remote host is prior to 8.2.18. It is, therefore, affected by multiple vulnerabilities as referenced in the Version 8.2.18 advisory.

  - In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the vulnerability enables network and same-site     attackers to set a standard insecure cookie in the victim's browser which is treated as a `__Host-` or     `__Secure-` cookie by PHP applications. (CVE-2022-31629)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
201258	CBL Mariner 2.0 Security Update: php (CVE-2024-1874)	Nessus	MarinerOS Local Security Checks	critical
200458	Fedora 39 : php (2024-52c23ef1ec)	Nessus	Fedora Local Security Checks	critical
200375	Fedora 40 : php (2024-49aba7b305)	Nessus	Fedora Local Security Checks	critical
200260	Tenable Security Center < 6.4.0 Multiple Vulnerabilities (TNS-2024-10)	Nessus	Misc.	medium
114298	PHP 8.1.x < 8.1.29 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
114297	PHP 8.2.x < 8.2.20 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
114296	PHP 8.3.x < 8.3.8 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
200177	Slackware Linux 15.0 / current php81 Multiple Vulnerabilities (SSA:2024-158-01)	Nessus	Slackware Local Security Checks	critical
200170	PHP 8.1.x < 8.1.29 Multiple Vulnerabilities	Nessus	CGI abuses	critical
200161	PHP 8.3.x < 8.3.8 Multiple Vulnerabilities	Nessus	CGI abuses	critical
194645	Fedora 40 : php (2024-5e8ae0def0)	Nessus	Fedora Local Security Checks	medium
114272	PHP 8.1.x < 8.1.28 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
114271	PHP 8.2.x < 8.2.18 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
114270	PHP 8.3.x < 8.3.6 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
193553	Fedora 38 : php (2024-39d50cc975)	Nessus	Fedora Local Security Checks	medium
193549	Fedora 39 : php (2024-b46619f761)	Nessus	Fedora Local Security Checks	medium
193406	FreeBSD : php -- Multiple vulnerabilities (6d82c5e9-fc24-11ee-a689-04421a1baf97)	Nessus	FreeBSD Local Security Checks	critical
193284	Slackware Linux 15.0 / current php81 Multiple Vulnerabilities (SSA:2024-103-01)	Nessus	Slackware Local Security Checks	medium
193283	PHP 8.1.x < 8.1.28 Multiple Vulnerabilities	Nessus	CGI abuses	medium
193201	PHP 8.3.x < 8.3.6 Multiple Vulnerabilities	Nessus	CGI abuses	medium
193191	PHP 8.2.x < 8.2.18 Multiple Vulnerabilities	Nessus	CGI abuses	medium

Detections

Analytics

CVE-2024-1874

critical

Tenable Plugins

critical

critical

critical

medium

critical

critical

critical

critical

critical

critical

medium

critical

critical

critical

medium

medium

critical

medium

medium

medium

medium