The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4602-1 advisory.

    - CVE-2025-1218: php: php: Denial of Service via out-of-bounds read in mysqlnd wire protocol parser     (bsc#1282981).
    - CVE-2025-14181: Integer overflow to buffer overflow in soap HTTP parsing (bsc#1283216).
    - CVE-2026-6103: Archive entry injection via integer overflow in TAR parser (bsc#1282980).
    - CVE-2026-91765: Denial of Service via unbounded recursion in SOAP parser (bsc#1282875).
    - CVE-2026-91766: Credential disclosure via cross-origin HTTP redirects (bsc#1282876).
    - CVE-2026-91767: Information disclosure via crafted TLS server certificate (bsc#1282877).
    - CVE-2026-91768: Access control bypass via partial IPv6 address comparison (bsc#1282878).
    - CVE-2026-91769: OpenSSL stream peer verification falls back to the Common Name whenever no     `subjectAltName` matches,       allowing trusted certificate impersonation (bsc#1283044).
    - CVE-2026-92842: Information disclosure via out-of-bounds read in stream filters (bsc#1282985).
    - CVE-2026-93682: Out-of-bounds read via empty HTTP redirect Location header (bsc#1282986).

    Changes for php8:

    - Updated to version 8.3.35

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

SUSE SLES15: apache2-mod_php8 / php8 / php8-bcmath / php8-bz2 / php8-calendar / etc (SUSE-SU-2026:4602-1)

medium Nessus Plugin ID 369274

Version 1.2

Version 1.1

Version 1.2 Oct 22, 2026, 10:08 AM CVSS metrics ("CVSSv2 score" set to 6.1) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:A/AC:L/Au:N/C:C/I:N/A:N") CVSSv2 score source (changed from "CVE-2026-91769" to "CVE-2026-91768") CVSSv2 severity (based on CVE-2026-91768, severity decreased from "High" to "Medium") CVSSv3 score source (changed from "CVE-2026-91768" to none) Plugin Feed: 202610221008
Version 1.1 Oct 22, 2026, 12:02 AM New Plugin Feed: 202610220002