The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-5818-1 advisory.

    It was discovered that PHP incorrectly handled certain inputs. An attacker could possibly use this issue     to cause a crash or execute arbitrary code.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2023:2903 advisory.

    * XKCP: buffer overflow in the SHA-3 reference implementation (CVE-2022-37454)

    * php: standard insecure cookie could be treated as a '__Host-' or '__Secure-' cookie by PHP applications     (CVE-2022-31629)

    * php: OOB read due to insufficient input validation in imageloadfont() (CVE-2022-31630)

    * php: PDO::quote() may return unquoted string due to an integer overflow (CVE-2022-31631)

    * php: phar: infinite loop when decompressing quine gzip file (CVE-2022-31628)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of PHP installed on the remote host is prior to 8.0.27. It is, therefore, affected by a vulnerability as referenced in the Version 8.0.27 advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of PHP installed on the remote host is prior to 8.1.14. It is, therefore, affected by a vulnerability as referenced in the Version 8.1.14 advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of php installed on the remote host is prior to 7.4.33 / 8.0.27 / 8.1.14. It is, therefore, affected by a vulnerability as referenced in the SSA:2023-006-02 advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of PHP installed on the remote host is prior to 8.2.1. It is, therefore, affected by a vulnerability as referenced in the Version 8.2.1 advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-5732365005 advisory.

    **PHP version 8.1.14** (05 Jan 2023)

    **Core:**

    * Fixed bug [GH-9905](https://github.com/php/php-src/issues/9905) (constant() behaves inconsistent when     class is undefined). (cmb)
    * Fixed bug [GH-9918](https://github.com/php/php-src/issues/9918) (License information for xxHash is not     included in README.REDIST.BINS file). (Akama Hitoshi)
    * Fixed bug [GH-9650](https://github.com/php/php-src/issues/9650) (Can't initialize heap: [0x000001e7]).
    (Michael Voek)
    * Fixed potentially undefined behavior in Windows ftok(3) emulation. (cmb)

    **Date:**

    * Fixed bug [GH-9699](https://github.com/php/php-src/issues/9699) (DateTimeImmutable::diff differences in     8.1.10 onwards - timezone related). (Derick)
    * Fixed bug [GH-9700](https://github.com/php/php-src/issues/9700) (DateTime::createFromFormat: Parsing     TZID string is too greedy). (Derick)
    * Fixed bug [GH-9866](https://github.com/php/php-src/issues/9866) (Time zone bug with     \DateTimeInterface::diff()). (Derick)
    * Fixed bug [GH-9880](https://github.com/php/php-src/issues/9880) (DateTime diff returns wrong sign on day     count when using a timezone). (Derick)

    **FPM:**

    * Fixed bug [GH-9959](https://github.com/php/php-src/issues/9959) (Solaris port event mechanism is still     broken after bug php#66694). (Petr Sumbera)
    * Fixed bug php#68207 (Setting fastcgi.error_header can result in a WARNING). (Jakub Zelenka)
    * Fixed bug [GH-8517](https://github.com/php/php-src/issues/8517) (Random crash of FPM master process in     fpm_stdio_child_said). (Jakub Zelenka)

    **MBString:**

    * Fixed bug [GH-9535](https://github.com/php/php-src/issues/9535) (The behavior of mb_strcut in mbstring     has been changed in PHP8.1). (Nathan Freeman)

    **Opcache:**

    * Fixed bug [GH-9968](https://github.com/php/php-src/issues/9968) (Segmentation Fault during OPCache     Preload). (Arnaud, michdingpayc)

    **OpenSSL:**

    * Fixed bug [GH-9064](https://github.com/php/php-src/issues/9064) (PHP fails to build if openssl was built     with --no-ec). (Jakub Zelenka)
    * Fixed bug [GH-10000](https://github.com/php/php-src/issues/10000) (OpenSSL test failures when OpenSSL     compiled with no-dsa). (Jakub Zelenka)

    **Pcntl:**

    * Fixed bug [GH-9298](https://github.com/php/php-src/issues/9298) (Signal handler called after rshutdown     leads to crash). (Erki Aring)

    **PDO_Firebird:**

    * Fixed bug [GH-9971](https://github.com/php/php-src/issues/9971) (Incorrect NUMERIC value returned from     PDO_Firebird). (cmb)

    **PDO/SQLite:**

    * Fixed bug php#81740 (PDO::quote() may return unquoted string). (**CVE-2022-31631**) (cmb)

    **Session:**

    * Fixed [GH-9932](https://github.com/php/php-src/issues/9932) (session name silently fails with . and [).
    (David Carlier)

    **SPL:**

    * Fixed [GH-9883](https://github.com/php/php-src/issues/9883) (SplFileObject::__toString() reads next     line). (Girgias)
    * Fixed [GH-10011](https://github.com/php/php-src/issues/10011) (Trampoline autoloader will get     reregistered and cannot be unregistered). (Girgias)

    **SQLite3:**

    * Fixed bug php#81742 (open_basedir bypass in SQLite3 by using file URI). (cmb)


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2023:2903 advisory.

    * XKCP: buffer overflow in the SHA-3 reference implementation (CVE-2022-37454)
    * php: standard insecure cookie could be treated as a '__Host-' or '__Secure-' cookie by PHP applications     (CVE-2022-31629)
    * php: OOB read due to insufficient input validation in imageloadfont() (CVE-2022-31630)
    * php: PDO::quote() may return unquoted string due to an integer overflow (CVE-2022-31631)
    * php: phar: infinite loop when decompressing quine gzip file (CVE-2022-31628)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2023:0965 advisory.

  - In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the phar uncompressor code would recursively uncompress     quines gzip files, resulting in an infinite loop. (CVE-2022-31628)

  - In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the vulnerability enables network and same-site     attackers to set a standard insecure cookie in the victim's browser which is treated as a `__Host-` or     `__Secure-` cookie by PHP applications. (CVE-2022-31629)

  - In PHP versions prior to 7.4.33, 8.0.25 and 8.2.12, when using imageloadfont() function in gd extension,     it is possible to supply a specially crafted font file, such as if the loaded font is used with     imagechar() function, the read outside allocated buffer will be used. This can lead to crashes or     disclosure of confidential information. (CVE-2022-31630)

  - The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer     overflow that allows attackers to execute arbitrary code or eliminate expected cryptographic properties.
    This occurs in the sponge function interface. (CVE-2022-37454)

  - php: PDO::quote() may return unquoted string due to an integer overflow (CVE-2022-31631)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2023:0848 advisory.

  - In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the phar uncompressor code would recursively uncompress     quines gzip files, resulting in an infinite loop. (CVE-2022-31628)

  - In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the vulnerability enables network and same-site     attackers to set a standard insecure cookie in the victim's browser which is treated as a `__Host-` or     `__Secure-` cookie by PHP applications. (CVE-2022-31629)

  - In PHP versions prior to 7.4.33, 8.0.25 and 8.2.12, when using imageloadfont() function in gd extension,     it is possible to supply a specially crafted font file, such as if the loaded font is used with     imagechar() function, the read outside allocated buffer will be used. This can lead to crashes or     disclosure of confidential information. (CVE-2022-31630)

  - A flaw was found in PHP. This issue occurs due to an uncaught integer overflow in PDO::quote() of     PDO_SQLite returning an improperly quoted string. With the implementation of sqlite3_snprintf(), it is     possible to force the function to return a single apostrophe if the function is called on user-supplied     input without any length restrictions in place. (CVE-2022-31631) (CVE-2022-31631)

  - The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer     overflow that allows attackers to execute arbitrary code or eliminate expected cryptographic properties.
    This occurs in the sponge function interface. (CVE-2022-37454)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-2417 advisory.

    php-pecl-apcu     [5.1.21-1]
    - update to 5.1.21 for PHP 8.1 #2070040

    php-pecl-rrd     [2.0.3-4]
    - build for PHP 8.1 #2070040

    php-pecl-xdebug3     [3.1.4-1]
    - update to 3.1.4 for PHP 8.1 #2070040

    php-pecl-zip     [1.20.1-1]
    - update to 1.20.1 for PHP 8.1 #2070040

    php     [8.1.14-1]
    - rebase to 8.1.14

    [8.1.8-1]
    - update to 8.1.8 #2070040

    [8.1.7-2]
    - clean unneeded dependency on useradd command

    [8.1.7-1]
    - update to 8.1.7 #2070040

    [8.1.6-2]
    - add upstream patch to initialize pcre before mbstring
    - add upstream patch to use more sha256 in openssl tests

    [8.1.6-1]
    - update to 8.1.6 #2070040

    [8.0.13-1]
    - rebase to 8.0.13 #2032429
    - refresh configuration files from upstream

    [8.0.12-1]
    - rebase to 8.0.12 #2017111 #1981423
    - build using system libxcrypt #2015903

    [8.0.10-1]
    - rebase to 8.0.10 #1992513
    - compatibility with OpenSSL 3.0 #1992492
    - snmp:  add sha256 / sha512 security protocol #1936635
    - phar: implement openssl_256 and openssl_512 for phar signatures
    - phar: use sha256 signature by default

    [8.0.6-9]
    - Rebuilt for libffi 3.4.2 SONAME transition.
      Related: rhbz#1891914

    [8.0.6-8]
    - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags       Related: rhbz#1991688

    [8.0.6-7]
    - Rebuild to pick up new build flags from redhat-rpm-config (#1984652)

    [8.0.6-6]
    - Rebuilt for RHEL 9 BETA for openssl 3.0       Related: rhbz#1971065

    [8.0.6-5]
    - fix build with net-snmp without DES #1953492

    [8.0.6-4]
    - fix build with openssl 3.0 #1953492

    [8.0.6-3]
    - get rid of inet_addr and gethostbyaddr calls

    [8.0.6-2]
    - get rid of inet_ntoa and inet_aton calls

    [8.0.6-1]
    - Update to 8.0.6 - http://www.php.net/releases/8_0_6.php

    [8.0.5-1]
    - Update to 8.0.5 - http://www.php.net/releases/8_0_5.php

    [8.0.5~RC1-1]
    - update to 8.0.5RC1

    [8.0.4~RC1-2]
    - make libdb usage conditional       default: on for Fedora, off for RHEL

    [8.0.4~RC1-1]
    - update to 8.0.4RC1

    [8.0.3-2]
    - clean conditions

    [8.0.3-1]
    - Update to 8.0.3 - http://www.php.net/releases/8_0_3.php
    - see https://fedoraproject.org/wiki/Changes/php80
    - drop xmlrpc extension
    - drop json subpackage, extension always there
    - enchant: use libenchant-2 instead of libenchant

    [7.4.16-1]
    - Update to 7.4.16 - http://www.php.net/releases/7_4_16.php

    [7.4.15-3]
    - drop php-imap, fix #1929640

    [7.4.15-2]
    - rebuild for libpq ABI fix rhbz#1908268

    [7.4.15-1]
    - Update to 7.4.15 - http://www.php.net/releases/7_4_15.php
    - add upstream patch for https://bugs.php.net/80682       fix opcache doesn't honour pcre.jit option

    [7.4.15~RC2-2]
    - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild

    [7.4.15~RC2-1]
    - update to 7.4.15RC2

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-2903 advisory.

    - CVE-2015-2331: integer overflow when processing ZIP archives (#1204676,#1204677)
    - fixes for CVE-2012-1162 and CVE-2012-1163
    - fix: due to an integer overflow PDO::quote() may return unquoted string       CVE-2022-31631
    - fix password of excessive length triggers buffer overflow leading to RCE       CVE-2022-31626
    - fix SSRF bypass in FILTER_VALIDATE_URL       CVE-2021-21705
    - fix Local privilege escalation via PHP-FPM       CVE-2021-21703
    - fix underflow in env_path_info in fpm_main.c CVE-2019-11043
    - php-fpm: change default unix socket permission CVE-2014-0185
    - update to 5.5.7, fix for CVE-2013-6420
    - update to 5.5.2, fixes for CVE-2011-4718 + CVE-2013-4248
    - add security fix for CVE-2013-4113
    - security fix for CVE-2013-1643
    - security fix for CVE-2013-1635
    - update to 5.4.4 (CVE-2012-2143, CVE-2012-2386)
    - update to 5.4.3 (CVE-2012-2311, CVE-2012-2329)
    - update to 5.4.2 (CVE-2012-1823)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:2903 advisory.

    PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

    The following packages have been upgraded to a later upstream version: php (7.4.33).

    Security Fix(es):

    * XKCP: buffer overflow in the SHA-3 reference implementation (CVE-2022-37454)

    * php: standard insecure cookie could be treated as a '__Host-' or '__Secure-' cookie by PHP applications     (CVE-2022-31629)

    * php: OOB read due to insufficient input validation in imageloadfont() (CVE-2022-31630)

    * php: PDO::quote() may return unquoted string due to an integer overflow (CVE-2022-31631)

    * php: phar: infinite loop when decompressing quine gzip file (CVE-2022-31628)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.8 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2025:0005 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2022-31630:
    In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the phar uncompressor code would recursively uncompress     quines gzip files, resulting in an infinite loop.

    CVE-2022-31629:
    In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the vulnerability enables network and same-site     attackers to set a standard insecure cookie in the victim/'s browser which is treated as a `__Host-` or     `__Secure-` cookie by PHP applications.

    CVE-2022-31628:
    In PHP versions prior to 7.4.33, 8.0.25 and 8.2.12, when using imageloadfont() function in gd extension,     it is possible to supply a specially crafted font file, such as if the loaded font is used with     imagechar() function, the read outside allocated buffer will be used. This can lead to crashes or     disclosure of confidential information.

    CVE-2022-31631:
    A flaw was found in PHP. This issue occurs due to an uncaught integer overflow in PDO::quote() of     PDO_SQLite returning an improperly quoted string. With the implementation of sqlite3_snprintf(), it is     possible to force the function to return a single apostrophe if the function is called on user-supplied     input without any length restrictions in place.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
170413	Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS : PHP vulnerability (USN-5818-1)	Nessus	Ubuntu Local Security Checks	1/23/2023	2/13/2025	critical
280097	RockyLinux 8 : php:7.4 (RLSA-2023:2903)	Nessus	Rocky Linux Local Security Checks	12/27/2025	12/27/2025	critical
169630	PHP 8.0.x < 8.0.27	Nessus	CGI abuses	1/6/2023	5/26/2025	critical
169631	PHP 8.1.x < 8.1.14	Nessus	CGI abuses	1/6/2023	5/26/2025	critical
169687	Slackware Linux 15.0 / current php Vulnerability (SSA:2023-006-02)	Nessus	Slackware Local Security Checks	1/7/2023	2/16/2023	critical
169976	PHP 8.2.x < 8.2.1	Nessus	CGI abuses	1/12/2023	5/26/2025	critical
194718	Fedora 37 : php (2023-5732365005)	Nessus	Fedora Local Security Checks	4/29/2024	2/13/2025	critical
176126	AlmaLinux 8 : php:7.4 (ALSA-2023:2903)	Nessus	Alma Linux Local Security Checks	5/19/2023	1/13/2025	critical
172004	AlmaLinux 9 : php (ALSA-2023:0965)	Nessus	Alma Linux Local Security Checks	2/28/2023	10/18/2023	critical
171698	CentOS 8 : php:8.0 (CESA-2023:0848)	Nessus	CentOS Local Security Checks	2/21/2023	2/8/2024	critical
175729	Oracle Linux 9 : 8.1 (ELSA-2023-2417)	Nessus	Oracle Linux Local Security Checks	5/15/2023	10/23/2024	critical
176318	Oracle Linux 8 : php:7.4 (ELSA-2023-2903)	Nessus	Oracle Linux Local Security Checks	5/24/2023	11/2/2024	critical
175863	RHEL 8 : php:7.4 (RHSA-2023:2903)	Nessus	Red Hat Local Security Checks	5/16/2023	8/15/2025	critical
239618	TencentOS Server 4: php (TSSA-2025:0005)	Nessus	Tencent Local Security Checks	6/16/2025	11/20/2025	high

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

high