Detections
Analytics

Alpine: php7: security update to 7.3.12-r1 (deprecated)

medium Tenable Cloud Security Plugin ID 400466

Description

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

 - In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0, PHP DirectoryIterator class accepts
 filenames with embedded \0 byte and treats them as terminating at that byte. This could lead to security
 vulnerabilities, e.g. in applications checking paths that the code is allowed to access. (CVE-2019-11045)

 - When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in
 PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0 it is possible to supply it with data what
 will cause it to read past the allocated buffer. This may lead to information disclosure or crash.
 (CVE-2019-11047, CVE-2019-11050)

See Also

https://git.alpinelinux.org/aports/commit/?id=3c23ef02cdf8ad9e4ea8e955536826328bf034ee

https://git.alpinelinux.org/aports/commit/?id=89bf7fcf675ffb9138a3afe613cb1f7c918b57ac

Plugin Details

Severity: Medium

ID: 400466

Version: Revision 1.22

Type: Local

Published: 8/16/2023

Updated: 1/17/2024

Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.1

Percentile: 53.29

CVSS v2

Risk Factor: Medium

Base Score: 6.4

Temporal Score: 5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:P

CVSS Score Source: CVE-2019-11050

CVSS v3

Risk Factor: Medium

Base Score: 6.5

Temporal Score: 5.9

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 12/19/2019

Vulnerability Publication Date: 12/17/2019

Reference Information

CVE: CVE-2019-11045, CVE-2019-11047, CVE-2019-11050

IAVA: 2020-A-0006-S