The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-2417 advisory.

    php-pecl-apcu     [5.1.21-1]
    - update to 5.1.21 for PHP 8.1 #2070040

    php-pecl-rrd     [2.0.3-4]
    - build for PHP 8.1 #2070040

    php-pecl-xdebug3     [3.1.4-1]
    - update to 3.1.4 for PHP 8.1 #2070040

    php-pecl-zip     [1.20.1-1]
    - update to 1.20.1 for PHP 8.1 #2070040

    php     [8.1.14-1]
    - rebase to 8.1.14

    [8.1.8-1]
    - update to 8.1.8 #2070040

    [8.1.7-2]
    - clean unneeded dependency on useradd command

    [8.1.7-1]
    - update to 8.1.7 #2070040

    [8.1.6-2]
    - add upstream patch to initialize pcre before mbstring
    - add upstream patch to use more sha256 in openssl tests

    [8.1.6-1]
    - update to 8.1.6 #2070040

    [8.0.13-1]
    - rebase to 8.0.13 #2032429
    - refresh configuration files from upstream

    [8.0.12-1]
    - rebase to 8.0.12 #2017111 #1981423
    - build using system libxcrypt #2015903

    [8.0.10-1]
    - rebase to 8.0.10 #1992513
    - compatibility with OpenSSL 3.0 #1992492
    - snmp:  add sha256 / sha512 security protocol #1936635
    - phar: implement openssl_256 and openssl_512 for phar signatures
    - phar: use sha256 signature by default

    [8.0.6-9]
    - Rebuilt for libffi 3.4.2 SONAME transition.
      Related: rhbz#1891914

    [8.0.6-8]
    - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags       Related: rhbz#1991688

    [8.0.6-7]
    - Rebuild to pick up new build flags from redhat-rpm-config (#1984652)

    [8.0.6-6]
    - Rebuilt for RHEL 9 BETA for openssl 3.0       Related: rhbz#1971065

    [8.0.6-5]
    - fix build with net-snmp without DES #1953492

    [8.0.6-4]
    - fix build with openssl 3.0 #1953492

    [8.0.6-3]
    - get rid of inet_addr and gethostbyaddr calls

    [8.0.6-2]
    - get rid of inet_ntoa and inet_aton calls

    [8.0.6-1]
    - Update to 8.0.6 - http://www.php.net/releases/8_0_6.php

    [8.0.5-1]
    - Update to 8.0.5 - http://www.php.net/releases/8_0_5.php

    [8.0.5~RC1-1]
    - update to 8.0.5RC1

    [8.0.4~RC1-2]
    - make libdb usage conditional       default: on for Fedora, off for RHEL

    [8.0.4~RC1-1]
    - update to 8.0.4RC1

    [8.0.3-2]
    - clean conditions

    [8.0.3-1]
    - Update to 8.0.3 - http://www.php.net/releases/8_0_3.php
    - see https://fedoraproject.org/wiki/Changes/php80
    - drop xmlrpc extension
    - drop json subpackage, extension always there
    - enchant: use libenchant-2 instead of libenchant

    [7.4.16-1]
    - Update to 7.4.16 - http://www.php.net/releases/7_4_16.php

    [7.4.15-3]
    - drop php-imap, fix #1929640

    [7.4.15-2]
    - rebuild for libpq ABI fix rhbz#1908268

    [7.4.15-1]
    - Update to 7.4.15 - http://www.php.net/releases/7_4_15.php
    - add upstream patch for https://bugs.php.net/80682       fix opcache doesn't honour pcre.jit option

    [7.4.15~RC2-2]
    - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild

    [7.4.15~RC2-1]
    - update to 7.4.15RC2

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:2903 advisory.

    PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

    The following packages have been upgraded to a later upstream version: php (7.4.33).

    Security Fix(es):

    * XKCP: buffer overflow in the SHA-3 reference implementation (CVE-2022-37454)

    * php: standard insecure cookie could be treated as a '__Host-' or '__Secure-' cookie by PHP applications     (CVE-2022-31629)

    * php: OOB read due to insufficient input validation in imageloadfont() (CVE-2022-31630)

    * php: PDO::quote() may return unquoted string due to an integer overflow (CVE-2022-31631)

    * php: phar: infinite loop when decompressing quine gzip file (CVE-2022-31628)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.8 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2023:2903 advisory.

    * XKCP: buffer overflow in the SHA-3 reference implementation (CVE-2022-37454)
    * php: standard insecure cookie could be treated as a '__Host-' or '__Secure-' cookie by PHP applications     (CVE-2022-31629)
    * php: OOB read due to insufficient input validation in imageloadfont() (CVE-2022-31630)
    * php: PDO::quote() may return unquoted string due to an integer overflow (CVE-2022-31631)
    * php: phar: infinite loop when decompressing quine gzip file (CVE-2022-31628)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-2903 advisory.

    - CVE-2015-2331: integer overflow when processing ZIP archives (#1204676,#1204677)
    - fixes for CVE-2012-1162 and CVE-2012-1163
    - fix: due to an integer overflow PDO::quote() may return unquoted string       CVE-2022-31631
    - fix password of excessive length triggers buffer overflow leading to RCE       CVE-2022-31626
    - fix SSRF bypass in FILTER_VALIDATE_URL       CVE-2021-21705
    - fix Local privilege escalation via PHP-FPM       CVE-2021-21703
    - fix underflow in env_path_info in fpm_main.c CVE-2019-11043
    - php-fpm: change default unix socket permission CVE-2014-0185
    - update to 5.5.7, fix for CVE-2013-6420
    - update to 5.5.2, fixes for CVE-2011-4718 + CVE-2013-4248
    - add security fix for CVE-2013-4113
    - security fix for CVE-2013-1643
    - security fix for CVE-2013-1635
    - update to 5.4.4 (CVE-2012-2143, CVE-2012-2386)
    - update to 5.4.3 (CVE-2012-2311, CVE-2012-2329)
    - update to 5.4.2 (CVE-2012-1823)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of PHP installed on the remote host is prior to 8.0.27. It is, therefore, affected by a vulnerability as referenced in the Version 8.0.27 advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of PHP installed on the remote host is prior to 8.1.14. It is, therefore, affected by a vulnerability as referenced in the Version 8.1.14 advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of php installed on the remote host is prior to 7.4.33 / 8.0.27 / 8.1.14. It is, therefore, affected by a vulnerability as referenced in the SSA:2023-006-02 advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of PHP installed on the remote host is prior to 8.2.1. It is, therefore, affected by a vulnerability as referenced in the Version 8.2.1 advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
175729	Oracle Linux 9 : 8.1 (ELSA-2023-2417)	Nessus	Oracle Linux Local Security Checks	5/15/2023	10/23/2024	critical
175863	RHEL 8 : php:7.4 (RHSA-2023:2903)	Nessus	Red Hat Local Security Checks	5/16/2023	8/15/2025	critical
176126	AlmaLinux 8 : php:7.4 (ALSA-2023:2903)	Nessus	Alma Linux Local Security Checks	5/19/2023	1/13/2025	critical
176318	Oracle Linux 8 : php:7.4 (ELSA-2023-2903)	Nessus	Oracle Linux Local Security Checks	5/24/2023	11/2/2024	critical
169630	PHP 8.0.x < 8.0.27	Nessus	CGI abuses	1/6/2023	5/26/2025	critical
169631	PHP 8.1.x < 8.1.14	Nessus	CGI abuses	1/6/2023	5/26/2025	critical
169687	Slackware Linux 15.0 / current php Vulnerability (SSA:2023-006-02)	Nessus	Slackware Local Security Checks	1/7/2023	2/16/2023	critical
169976	PHP 8.2.x < 8.2.1	Nessus	CGI abuses	1/12/2023	5/26/2025	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical

critical

critical

critical