An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A heap out-of-bounds write or read occurs in next_state_val() during regular expression compilation. Octal numbers larger than 0xff are not handled correctly in fetch_token() and fetch_token_in_cc(). A malformed regular expression containing an octal number in the form of '\700' would produce an invalid code point value larger than 0xff in next_state_val(), resulting in an out-of-bounds write memory corruption. (CVE-2017-9226)

An issue was discovered in Oniguruma 6.x before 6.9.4_rc2. In the function gb18030_mbc_enc_len in file gb18030.c, a UChar pointer is dereferenced without checking if it passed the end of the matched string. This leads to a heap-based buffer over-read. (CVE-2019-19203)

A flaw was found in PHP. This issue occurs due to an uncaught integer overflow in PDO::quote() of PDO_SQLite returning an improperly quoted string. With the implementation of sqlite3_snprintf(), it is possible to force the function to return a single apostrophe if the function is called on user-supplied input without any length restrictions in place. (CVE-2022-31631)

In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, core path resolution function allocate buffer one byte too small. When resolving paths with lengths close to system MAXPATHLEN setting, this may lead to the byte after the allocated buffer being overwritten with NUL value, which might lead to unauthorized data access or modification. (CVE-2023-0568)

In PHP version 8.0.* before 8.0.30,  8.1.* before 8.1.22, and 8.2.* before 8.2.8, when loading phar file, while reading PHAR directory entries, insufficient length checking may lead to a stack buffer overflow, leading potentially to memory corruption or RCE. (CVE-2023-3824)

Erroneous parsing of multipart form data

NOTE: Fixed in 8.3.12, 8.2.24NOTE: https://github.com/php/php-src/security/advisories/GHSA-9pqp-7h25-4f32NOTE: https://github.com/php/php-src/commit/19b49258d0c5a61398d395d8afde1123e8d161e0 (PHP-8.2.24) (CVE-2024-8925)

php: Erroneous parsing of multipart form data (CVE-2024-8928)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-872 advisory.

    The upstream advisory describes this issue as follows:

    A memory-related vulnerability in PHP's filter handling system, particularly when processing input with     convert.quoted-printable-decode filters, leads to a segmentation fault. This vulnerability is triggered     through specific sequences of input data, causing PHP to crash. When exploited, it allows an attacker to     extract a single byte of data from the heap or cause a DoS. (CVE-2024-11233)

    The upstream advisory describes this issue as follows:

    Configuring a proxy in a stream context might allow for CRLF injection in URIs, resulting in HTTP request     smuggling attacks. (CVE-2024-11234)

    Erroneous parsing of multipart form data

    NOTE: Fixed in 8.3.12, 8.2.24NOTE: https://github.com/php/php-     src/security/advisories/GHSA-9pqp-7h25-4f32NOTE: https://github.com/php/php-     src/commit/19b49258d0c5a61398d395d8afde1123e8d161e0 (PHP-8.2.24) (CVE-2024-8925)

    cgi.force_redirect configuration is byppassible due to the environment variable collision

    NOTE: Fixed in 8.3.12, 8.2.24NOTE: https://github.com/php/php-     src/security/advisories/GHSA-94p6-54jq-9mwpNOTE: https://github.com/php/php-     src/commit/48808d98f4fc2a05193cdcc1aedd6c66816450f1 (PHP-8.2.24) (CVE-2024-8927)

    php: Erroneous parsing of multipart form data (CVE-2024-8928)

    The upstream advisory describes this issue as follows:

    By connecting to a fake MySQL server or tampering with network packets and initiating a SQL Query, it is     possible to abuse the function static enum_func_status php_mysqlnd_rset_field_read when parsing MySQL     fields packets in order to include the rest of the heap content starting from the address of the cursor of     the currently read buffer.

    Using PHP-FPM which stays alive between request, and between two different SQL query requests, as the     previous buffer used to store received data from MySQL is not emptied and malloc allocates a memory region     which is very near the previous one, one is able to extract the response content of the previous MySQL     request from the PHP-FPM worker. (CVE-2024-8929)

    The upstream advisory describes this issue as follows:

    Uncontrolled long string inputs to ldap_escape on 32-bit systems can cause an integer overflow, resulting     in an out-of-bounds write. (CVE-2024-8932)

    Logs from childrens may be altered

    NOTE: Fixed in 8.3.12, 8.2.24NOTE: https://github.com/php/php-     src/security/advisories/GHSA-865w-9rf3-2wh5NOTE: https://github.com/php/php-     src/commit/1f8e16172c7961045c2b0f34ba7613e3f21cdee8 (PHP-8.2.24) (CVE-2024-9026)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-873 advisory.

    The upstream advisory describes this issue as follows:

    A memory-related vulnerability in PHP's filter handling system, particularly when processing input with     convert.quoted-printable-decode filters, leads to a segmentation fault. This vulnerability is triggered     through specific sequences of input data, causing PHP to crash. When exploited, it allows an attacker to     extract a single byte of data from the heap or cause a DoS. (CVE-2024-11233)

    The upstream advisory describes this issue as follows:

    Configuring a proxy in a stream context might allow for CRLF injection in URIs, resulting in HTTP request     smuggling attacks. (CVE-2024-11234)

    Erroneous parsing of multipart form data

    NOTE: Fixed in 8.3.12, 8.2.24NOTE: https://github.com/php/php-     src/security/advisories/GHSA-9pqp-7h25-4f32NOTE: https://github.com/php/php-     src/commit/19b49258d0c5a61398d395d8afde1123e8d161e0 (PHP-8.2.24) (CVE-2024-8925)

    cgi.force_redirect configuration is byppassible due to the environment variable collision

    NOTE: Fixed in 8.3.12, 8.2.24NOTE: https://github.com/php/php-     src/security/advisories/GHSA-94p6-54jq-9mwpNOTE: https://github.com/php/php-     src/commit/48808d98f4fc2a05193cdcc1aedd6c66816450f1 (PHP-8.2.24) (CVE-2024-8927)

    php: Erroneous parsing of multipart form data (CVE-2024-8928)

    The upstream advisory describes this issue as follows:

    By connecting to a fake MySQL server or tampering with network packets and initiating a SQL Query, it is     possible to abuse the function static enum_func_status php_mysqlnd_rset_field_read when parsing MySQL     fields packets in order to include the rest of the heap content starting from the address of the cursor of     the currently read buffer.

    Using PHP-FPM which stays alive between request, and between two different SQL query requests, as the     previous buffer used to store received data from MySQL is not emptied and malloc allocates a memory region     which is very near the previous one, one is able to extract the response content of the previous MySQL     request from the PHP-FPM worker. (CVE-2024-8929)

    The upstream advisory describes this issue as follows:

    Uncontrolled long string inputs to ldap_escape on 32-bit systems can cause an integer overflow, resulting     in an out-of-bounds write. (CVE-2024-8932)

    Logs from childrens may be altered

    NOTE: Fixed in 8.3.12, 8.2.24NOTE: https://github.com/php/php-     src/security/advisories/GHSA-865w-9rf3-2wh5NOTE: https://github.com/php/php-     src/commit/1f8e16172c7961045c2b0f34ba7613e3f21cdee8 (PHP-8.2.24) (CVE-2024-9026)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of php installed on the remote host is prior to 5.4.16-46. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-2832 advisory.

    An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in     PHP through 7.1.5. A heap out-of-bounds write or read occurs in next_state_val() during regular expression     compilation. Octal numbers larger than 0xff are not handled correctly in fetch_token() and     fetch_token_in_cc(). A malformed regular expression containing an octal number in the form of '\700' would     produce an invalid code point value larger than 0xff in next_state_val(), resulting in an out-of-bounds     write memory corruption. (CVE-2017-9226)

    An issue was discovered in Oniguruma 6.x before 6.9.4_rc2. In the function gb18030_mbc_enc_len in file     gb18030.c, a UChar pointer is dereferenced without checking if it passed the end of the matched string.
    This leads to a heap-based buffer over-read. (CVE-2019-19203)

    A flaw was found in PHP. This issue occurs due to an uncaught integer overflow in PDO::quote() of     PDO_SQLite returning an improperly quoted string. With the implementation of sqlite3_snprintf(), it is     possible to force the function to return a single apostrophe if the function is called on user-supplied     input without any length restrictions in place. (CVE-2022-31631)

    In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, core path resolution function     allocate buffer one byte too small. When resolving paths with lengths close to system MAXPATHLEN setting,     this may lead to the byte after the allocated buffer being overwritten with NUL value, which might lead to     unauthorized data access or modification. (CVE-2023-0568)

    In PHP version 8.0.* before 8.0.30,  8.1.* before 8.1.22, and 8.2.* before 8.2.8, when loading phar file,     while reading PHAR directory entries, insufficient length checking may lead to a stack buffer overflow,     leading potentially to memory corruption or RCE. (CVE-2023-3824)

    Erroneous parsing of multipart form data

    NOTE: Fixed in 8.3.12, 8.2.24NOTE: https://github.com/php/php-     src/security/advisories/GHSA-9pqp-7h25-4f32NOTE: https://github.com/php/php-     src/commit/19b49258d0c5a61398d395d8afde1123e8d161e0 (PHP-8.2.24) (CVE-2024-8925)

    php: Erroneous parsing of multipart form data (CVE-2024-8928)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-845 advisory.

    The upstream advisory describes this issue as follows:

    A memory-related vulnerability in PHP's filter handling system, particularly when processing input with     convert.quoted-printable-decode filters, leads to a segmentation fault. This vulnerability is triggered     through specific sequences of input data, causing PHP to crash. When exploited, it allows an attacker to     extract a single byte of data from the heap or cause a DoS. (CVE-2024-11233)

    The upstream advisory describes this issue as follows:

    Configuring a proxy in a stream context might allow for CRLF injection in URIs, resulting in HTTP request     smuggling attacks. (CVE-2024-11234)

    Erroneous parsing of multipart form data

    NOTE: Fixed in 8.3.12, 8.2.24NOTE: https://github.com/php/php-     src/security/advisories/GHSA-9pqp-7h25-4f32NOTE: https://github.com/php/php-     src/commit/19b49258d0c5a61398d395d8afde1123e8d161e0 (PHP-8.2.24) (CVE-2024-8925)

    cgi.force_redirect configuration is byppassible due to the environment variable collision

    NOTE: Fixed in 8.3.12, 8.2.24NOTE: https://github.com/php/php-     src/security/advisories/GHSA-94p6-54jq-9mwpNOTE: https://github.com/php/php-     src/commit/48808d98f4fc2a05193cdcc1aedd6c66816450f1 (PHP-8.2.24) (CVE-2024-8927)

    php: Erroneous parsing of multipart form data (CVE-2024-8928)

    The upstream advisory describes this issue as follows:

    By connecting to a fake MySQL server or tampering with network packets and initiating a SQL Query, it is     possible to abuse the function static enum_func_status php_mysqlnd_rset_field_read when parsing MySQL     fields packets in order to include the rest of the heap content starting from the address of the cursor of     the currently read buffer.

    Using PHP-FPM which stays alive between request, and between two different SQL query requests, as the     previous buffer used to store received data from MySQL is not emptied and malloc allocates a memory region     which is very near the previous one, one is able to extract the response content of the previous MySQL     request from the PHP-FPM worker. (CVE-2024-8929)

    The upstream advisory describes this issue as follows:

    Uncontrolled long string inputs to ldap_escape on 32-bit systems can cause an integer overflow, resulting     in an out-of-bounds write. (CVE-2024-8932)

    Logs from childrens may be altered

    NOTE: Fixed in 8.3.12, 8.2.24NOTE: https://github.com/php/php-     src/security/advisories/GHSA-865w-9rf3-2wh5NOTE: https://github.com/php/php-     src/commit/1f8e16172c7961045c2b0f34ba7613e3f21cdee8 (PHP-8.2.24) (CVE-2024-9026)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of php installed on the remote host is prior to 8.1.31-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2PHP8.1-2025-006 advisory.

    The upstream advisory describes this issue as follows:

    A memory-related vulnerability in PHP's filter handling system, particularly when processing input with     convert.quoted-printable-decode filters, leads to a segmentation fault. This vulnerability is triggered     through specific sequences of input data, causing PHP to crash. When exploited, it allows an attacker to     extract a single byte of data from the heap or cause a DoS. (CVE-2024-11233)

    The upstream advisory describes this issue as follows:

    Configuring a proxy in a stream context might allow for CRLF injection in URIs, resulting in HTTP request     smuggling attacks. (CVE-2024-11234)

    Erroneous parsing of multipart form data

    NOTE: Fixed in 8.3.12, 8.2.24NOTE: https://github.com/php/php-     src/security/advisories/GHSA-9pqp-7h25-4f32NOTE: https://github.com/php/php-     src/commit/19b49258d0c5a61398d395d8afde1123e8d161e0 (PHP-8.2.24) (CVE-2024-8925)

    cgi.force_redirect configuration is byppassible due to the environment variable collision

    NOTE: Fixed in 8.3.12, 8.2.24NOTE: https://github.com/php/php-     src/security/advisories/GHSA-94p6-54jq-9mwpNOTE: https://github.com/php/php-     src/commit/48808d98f4fc2a05193cdcc1aedd6c66816450f1 (PHP-8.2.24) (CVE-2024-8927)

    php: Erroneous parsing of multipart form data (CVE-2024-8928)

    The upstream advisory describes this issue as follows:

    By connecting to a fake MySQL server or tampering with network packets and initiating a SQL Query, it is     possible to abuse the function static enum_func_status php_mysqlnd_rset_field_read when parsing MySQL     fields packets in order to include the rest of the heap content starting from the address of the cursor of     the currently read buffer.

    Using PHP-FPM which stays alive between request, and between two different SQL query requests, as the     previous buffer used to store received data from MySQL is not emptied and malloc allocates a memory region     which is very near the previous one, one is able to extract the response content of the previous MySQL     request from the PHP-FPM worker. (CVE-2024-8929)

    The upstream advisory describes this issue as follows:

    Uncontrolled long string inputs to ldap_escape on 32-bit systems can cause an integer overflow, resulting     in an out-of-bounds write. (CVE-2024-8932)

    Logs from childrens may be altered

    NOTE: Fixed in 8.3.12, 8.2.24NOTE: https://github.com/php/php-     src/security/advisories/GHSA-865w-9rf3-2wh5NOTE: https://github.com/php/php-     src/commit/1f8e16172c7961045c2b0f34ba7613e3f21cdee8 (PHP-8.2.24) (CVE-2024-9026)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of php installed on the remote host is prior to 8.2.27-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2PHP8.2-2025-006 advisory.

    The upstream advisory describes this issue as follows:

    A memory-related vulnerability in PHP's filter handling system, particularly when processing input with     convert.quoted-printable-decode filters, leads to a segmentation fault. This vulnerability is triggered     through specific sequences of input data, causing PHP to crash. When exploited, it allows an attacker to     extract a single byte of data from the heap or cause a DoS. (CVE-2024-11233)

    The upstream advisory describes this issue as follows:

    Configuring a proxy in a stream context might allow for CRLF injection in URIs, resulting in HTTP request     smuggling attacks. (CVE-2024-11234)

    Erroneous parsing of multipart form data

    NOTE: Fixed in 8.3.12, 8.2.24NOTE: https://github.com/php/php-     src/security/advisories/GHSA-9pqp-7h25-4f32NOTE: https://github.com/php/php-     src/commit/19b49258d0c5a61398d395d8afde1123e8d161e0 (PHP-8.2.24) (CVE-2024-8925)

    cgi.force_redirect configuration is byppassible due to the environment variable collision

    NOTE: Fixed in 8.3.12, 8.2.24NOTE: https://github.com/php/php-     src/security/advisories/GHSA-94p6-54jq-9mwpNOTE: https://github.com/php/php-     src/commit/48808d98f4fc2a05193cdcc1aedd6c66816450f1 (PHP-8.2.24) (CVE-2024-8927)

    php: Erroneous parsing of multipart form data (CVE-2024-8928)

    The upstream advisory describes this issue as follows:

    By connecting to a fake MySQL server or tampering with network packets and initiating a SQL Query, it is     possible to abuse the function static enum_func_status php_mysqlnd_rset_field_read when parsing MySQL     fields packets in order to include the rest of the heap content starting from the address of the cursor of     the currently read buffer.

    Using PHP-FPM which stays alive between request, and between two different SQL query requests, as the     previous buffer used to store received data from MySQL is not emptied and malloc allocates a memory region     which is very near the previous one, one is able to extract the response content of the previous MySQL     request from the PHP-FPM worker. (CVE-2024-8929)

    The upstream advisory describes this issue as follows:

    Uncontrolled long string inputs to ldap_escape on 32-bit systems can cause an integer overflow, resulting     in an out-of-bounds write. (CVE-2024-8932)

    Logs from childrens may be altered

    NOTE: Fixed in 8.3.12, 8.2.24NOTE: https://github.com/php/php-     src/security/advisories/GHSA-865w-9rf3-2wh5NOTE: https://github.com/php/php-     src/commit/1f8e16172c7961045c2b0f34ba7613e3f21cdee8 (PHP-8.2.24) (CVE-2024-9026)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
281610	Amazon Linux 2023 : php8.2, php8.2-bcmath, php8.2-cli (ALAS2023-2025-872)	Nessus	Amazon Linux Local Security Checks	high
281609	Amazon Linux 2023 : php8.3, php8.3-bcmath, php8.3-cli (ALAS2023-2025-873)	Nessus	Amazon Linux Local Security Checks	high
234513	Amazon Linux 2 : php, --advisory ALAS2-2025-2832 (ALAS-2025-2832)	Nessus	Amazon Linux Local Security Checks	critical
216823	Amazon Linux 2023 : php8.1, php8.1-bcmath, php8.1-cli (ALAS2023-2025-845)	Nessus	Amazon Linux Local Security Checks	high
216808	Amazon Linux 2 : php, --advisory ALAS2PHP8.1-2025-006 (ALASPHP8.1-2025-006)	Nessus	Amazon Linux Local Security Checks	high
216801	Amazon Linux 2 : php, --advisory ALAS2PHP8.2-2025-006 (ALASPHP8.2-2025-006)	Nessus	Amazon Linux Local Security Checks	high

Detections

Analytics

CVE-2024-8928

critical

Tenable Plugins

high

high

critical

high

high

high