Alpine: php7: security update to 7.2.17-r0

critical Tenable Self-Hosted Container Security Plugin ID 406321

Description

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

- An issue was discovered in the EXIF component in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before
7.3.3. There is an uninitialized read in exif_process_IFD_in_TIFF. (CVE-2019-9641)

- An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before
7.3.1. Invalid input to the function xmlrpc_decode() can lead to an invalid memory access (heap out of
bounds read or read after free). This is related to xml_elem_parse_buf in
ext/xmlrpc/libxmlrpc/xml_element.c. (CVE-2019-9020)

- An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before
7.3.1. A heap-based buffer over-read in PHAR reading functions in the PHAR extension may allow an attacker
to read allocated or unallocated memory past the actual data when trying to parse the file name, a
different vulnerability than CVE-2018-20783. This is related to phar_detect_phar_fname_ext in
ext/phar/phar.c. (CVE-2019-9021)

- An issue was discovered in PHP 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.2.
dns_get_record misparses a DNS response, which can allow a hostile DNS server to cause PHP to misuse
memcpy, leading to read operations going past the buffer allocated for DNS data. This affects php_parserr
in ext/standard/dns.c for DNS_CAA and DNS_ANY queries. (CVE-2019-9022)

- An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before
7.3.1. A number of heap-based buffer over-read instances are present in mbstring regular expression
functions when supplied with invalid multibyte data. These occur in ext/mbstring/oniguruma/regcomp.c,
ext/mbstring/oniguruma/regexec.c, ext/mbstring/oniguruma/regparse.c, ext/mbstring/oniguruma/enc/unicode.c,
and ext/mbstring/oniguruma/src/utf32_be.c when a multibyte regular expression pattern contains invalid
multibyte sequences. (CVE-2019-9023)

Plugin Details

Severity: Critical

ID: 406321

Version: Revision 1.25

Type: Local

Family: Alpine Linux Local Security Checks

Published: 10/31/2023

Updated: 7/2/2026

Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 6.3

Percentile: 97.05

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 5.9

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2019-9641

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Vulnerability Publication Date: 12/29/2018

Reference Information

CVE: CVE-2019-11034, CVE-2019-11035, CVE-2019-9020, CVE-2019-9021, CVE-2019-9022, CVE-2019-9023, CVE-2019-9024, CVE-2019-9637, CVE-2019-9638, CVE-2019-9639, CVE-2019-9640, CVE-2019-9641

BID: 107154, 107156, 107379, 107794

IAVB: 2019-B-0020-S, 2019-B-0030-S

Detections

Analytics