The version of php installed on the remote host is prior to 8.0.24-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2PHP8.0-2023-005 advisory.

    In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the phar uncompressor code would recursively uncompress     quines gzip files, resulting in an infinite loop. (CVE-2022-31628)

    In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the vulnerability enables network and same-site     attackers to set a standard insecure cookie in the victim's browser which is treated as a  or  cookie by     PHP applications. (CVE-2022-31629)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2023:0088 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2022-31628:
    In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the phar uncompressor code would recursively uncompress     quines gzip files, resulting in an infinite loop.

    CVE-2022-31629:
    In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the vulnerability enables network and same-site     attackers to set a standard insecure cookie in the victim's browser which is treated as a `__Host-` or     `__Secure-` cookie by PHP applications.

    CVE-2022-31630:
    In PHP versions prior to 7.4.33, 8.0.25 and 8.2.12, when using imageloadfont() function in gd extension,     it is possible to supply a specially crafted font file, such as if the loaded font is used with     imagechar() function, the read outside allocated buffer will be used. This can lead to crashes or     disclosure of confidential information.

    CVE-2022-31631:
    A flaw was found in PHP. This issue occurs due to an uncaught integer overflow in PDO::quote() of     PDO_SQLite returning an improperly quoted string. With the implementation of sqlite3_snprintf(), it is     possible to force the function to return a single apostrophe if the function is called on user-supplied     input without any length restrictions in place.

    CVE-2022-37454:
    The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer     overflow that allows attackers to execute arbitrary code or eliminate expected cryptographic properties.
    This occurs in the sponge function interface.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2023:0117 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:
      CVE-2022-31628:
      A vulnerability was found in PHP due to an infinite loop within the phar uncompressor code when     processing quines gzip files. This vulnerability allows a remote attacker to pass a specially crafted     archive to the application, and consume all available system resources, causing a denial of service     condition.
      CVE-2022-31629:
      A vulnerability was found in PHP due to the way PHP handles HTTP variable names. It interferes with HTTP     variable names that clash with ones that have a specific semantic meaning. This vulnerability allows     network and same-site attackers to set a standard insecure cookie in the victim's browser, which is     treated as a __Host- or __Secure- cookie by PHP applications, posing a threat to data integrity.
      CVE-2022-31630:
      An out-of-bounds read flaw was found in PHP due to insufficient input validation in the imageloadfont()     function. This flaw allows a remote attacker to pass specially crafted data to the web application,     trigger an out-of-bounds read error, and read the contents of memory on the system.
      CVE-2022-31631:
      A flaw was found in PHP. This issue occurs due to an uncaught integer overflow in PDO::quote() of     PDO_SQLite returning an improperly quoted string. With the implementation of sqlite3_snprintf(), it is     possible to force the function to return a single apostrophe if the function is called on user-supplied     input without any length restrictions in place.
      CVE-2022-37454:
      A flaw was found in the Keccak XKCP SHA-3 reference implementation. The sponge function interface allows     partial input data to be processed, and partial output to be produced. When at least one of these has a     length of 4294967096 bytes or more, it can result in elimination of cryptographic properties, execution of     arbitrary code, or a denial of service.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3997-1 advisory.

  - In PHP versions 7.3.x below 7.3.33, 7.4.x below 7.4.26 and 8.0.x below 8.0.13, certain XML parsing     functions, like simplexml_load_file(), URL-decode the filename passed to them. If that filename contains     URL-encoded NUL character, this may cause the function to interpret this as the end of the filename, thus     interpreting the filename differently from what the user intended, which may lead it to reading a     different file than intended. (CVE-2021-21707)

  - In PHP versions 7.4.x below 7.4.28, 8.0.x below 8.0.16, and 8.1.x below 8.1.3, when using filter functions     with FILTER_VALIDATE_FLOAT filter and min/max limits, if the filter fails, there is a possibility to     trigger use of allocated memory after free, which can result it crashes, and potentially in overwrite of     other memory chunks and RCE. This issue affects: code that uses FILTER_VALIDATE_FLOAT with min/max limits.
    (CVE-2021-21708)

  - In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when using Postgres     database extension, supplying invalid parameters to the parametrized query may lead to PHP attempting to     free memory using uninitialized data as pointers. This could lead to RCE vulnerability or denial of     service. (CVE-2022-31625)

  - In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when pdo_mysql extension     with mysqlnd driver, if the third party is allowed to supply host to connect to and the password for the     connection, password of excessive length can trigger a buffer overflow in PHP, which can lead to a remote     code execution vulnerability. (CVE-2022-31626)

  - In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the phar uncompressor code would recursively uncompress     quines gzip files, resulting in an infinite loop. (CVE-2022-31628)

  - In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the vulnerability enables network and same-site     attackers to set a standard insecure cookie in the victim's browser which is treated as a `__Host-` or     `__Secure-` cookie by PHP applications. (CVE-2022-31629)

  - In PHP versions prior to 7.4.33, 8.0.25 and 8.2.12, when using imageloadfont() function in gd extension,     it is possible to supply a specially crafted font file, such as if the loaded font is used with     imagechar() function, the read outside allocated buffer will be used. This can lead to crashes or     disclosure of confidential information. (CVE-2022-31630)

  - The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer     overflow that allows attackers to execute arbitrary code or eliminate expected cryptographic properties.
    This occurs in the sponge function interface. (CVE-2022-37454)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of PHP installed on the remote host is prior to 8.1.28. It is, therefore, affected by multiple vulnerabilities as referenced in the Version 8.1.28 advisory.

  - In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the vulnerability enables network and same-site     attackers to set a standard insecure cookie in the victim's browser which is treated as a `__Host-` or     `__Secure-` cookie by PHP applications. (CVE-2022-31629)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-b46619f761 advisory.

    **PHP version 8.2.18** (11 Apr 2024)

    **Core:**

    * Fixed bug [GH-13612](https://github.com/php/php-src/issues/13612) (Corrupted memory in destructor with     weak references). (nielsdos)
    * Fixed bug [GH-13784](https://github.com/php/php-src/issues/13784) (AX_GCC_FUNC_ATTRIBUTE failure).
    (Remi)
    * Fixed bug [GH-13670](https://github.com/php/php-src/issues/13670) (GC does not scale well with a lot of     objects created in destructor). (Arnaud)

    **DOM:**

    * Add some missing ZPP checks. (nielsdos)
    * Fix potential memory leak in XPath evaluation results. (nielsdos)
    * Fix phpdoc for DOMDocument load methods. (VincentLanglet)

    **FPM**

    * Fix incorrect check in fpm_shm_free(). (nielsdos)

    **GD:**

    * Fixed bug [GH-12019](https://github.com/php/php-src/issues/12019) (add GDLIB_CFLAGS in feature tests).
    (Michael Orlitzky)

    **Gettext:**

    * Fixed sigabrt raised with dcgettext/dcngettext calls with gettext 0.22.5 with category set to LC_ALL.
    (David Carlier)

    **MySQLnd:**

    * Fix [GH-13452](https://github.com/php/php-src/issues/13452) (Fixed handshake response [mysqlnd]). (Saki     Takamachi)
    * Fix incorrect charset length in check_mb_eucjpms(). (nielsdos)

    **Opcache:**

    * Fixed [GH-13508](https://github.com/php/php-src/issues/13508) (JITed QM_ASSIGN may be optimized out when     op1 is null). (Arnaud, Dmitry)
    * Fixed [GH-13712](https://github.com/php/php-src/issues/13712) (Segmentation fault for enabled observers     when calling trait method of internal trait when opcache is loaded). (Bob)

    **PDO:**

    * Fix various PDORow bugs. (Girgias)

    **Random:**

    * Fixed bug [GH-13544](https://github.com/php/php-src/issues/13544) (Pre-PHP 8.2 compatibility for     mt_srand with unknown modes). (timwolla)
    * Fixed bug [GH-13690](https://github.com/php/php-src/issues/13690) (Global Mt19937 is not properly reset     in-between requests when MT_RAND_PHP is used). (timwolla)

    **Session:**

    * Fixed bug [GH-13680](https://github.com/php/php-src/issues/13680) (Segfault with session_decode and     compilation error). (nielsdos)

    **Sockets:**

    * Fixed bug [GH-13604](https://github.com/php/php-src/issues/13604) (socket_getsockname returns random     characters in the end of the socket name). (David Carlier)

    **SPL:**

    * Fixed bug [GH-13531](https://github.com/php/php-src/issues/13531) (Unable to resize SplfixedArray after     being unserialized in PHP 8.2.15). (nielsdos)
    * Fixed bug [GH-13685](https://github.com/php/php-src/issues/13685) (Unexpected null pointer in     zend_string.h). (nielsdos)

    **Standard:**

    * Fixed bug [GH-11808](https://github.com/php/php-src/issues/11808) (Live filesystem modified by tests).
    (nielsdos)
    * Fixed [GH-13402](https://github.com/php/php-src/issues/13402) (Added validation of `\n` in     $additional_headers of mail()). (SakiTakamachi)
    * Fixed bug [GH-13203](https://github.com/php/php-src/issues/13203) (file_put_contents fail on strings     over 4GB on Windows). (divinity76)
    * Fixed bug [GHSA-pc52-254m-w9w7](https://github.com/php/php-src/security/advisories/GHSA-pc52-254m-w9w7)     (Command injection via array-ish $command parameter of proc_open). (CVE-2024-1874) (Jakub Zelenka)
    * Fixed bug [GHSA-wpj3-hf5j-x4v4](https://github.com/php/php-src/security/advisories/GHSA-wpj3-hf5j-x4v4)     (__Host-/__Secure- cookie bypass due to partial CVE-2022-31629 fix). (**CVE-2024-2756**) (nielsdos)
    * Fixed bug [GHSA-h746-cjrr-wfmr](https://github.com/php/php-src/security/advisories/GHSA-h746-cjrr-wfmr)     (password_verify can erroneously return true, opening ATO risk). (**CVE-2024-3096**) (Jakub Zelenka)

    **XML:**

    * Fixed bug [GH-13517](https://github.com/php/php-src/issues/13517) (Multiple test failures when building     with --with-expat). (nielsdos)


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
181387	Amazon Linux 2 : php (ALASPHP8.0-2023-005)	Nessus	Amazon Linux Local Security Checks	9/13/2023	12/11/2024	medium
236216	Alibaba Cloud Linux 3 : 0088: php:7.4 (ALINUX3-SA-2023:0088)	Nessus	Alibaba Cloud Linux Local Security Checks	5/14/2025	5/14/2025	critical
238777	TencentOS Server 3: php (TSSA-2023:0117)	Nessus	Tencent Local Security Checks	6/16/2025	11/20/2025	critical
167650	SUSE SLED15 / SLES15 Security Update : php7 (SUSE-SU-2022:3997-1)	Nessus	SuSE Local Security Checks	11/16/2022	10/18/2023	critical
193283	PHP 8.1.x < 8.1.28 Multiple Vulnerabilities	Nessus	CGI abuses	4/12/2024	5/26/2025	medium
193549	Fedora 39 : php (2024-b46619f761)	Nessus	Fedora Local Security Checks	4/19/2024	11/14/2024	medium

Detections

Analytics

Plugins Search

medium

critical

critical

critical

medium

medium