**PHP version 7.3.11** (24 Oct 2019)

**Core:**

  - Fixed bug php#78535 (auto_detect_line_endings value not     parsed as bool). (bugreportuser)

  - Fixed bug php#78620 (Out of memory error). (cmb, Nikita)

**Exif :**

  - Fixed bug php#78442 ('Illegal component' on     exif_read_data since PHP7) (Kalle)

**FPM:**

  - Fixed bug php#78599 (env_path_info underflow in     fpm_main.c can lead to RCE). (**CVE-2019-11043**) (Jakub     Zelenka)

  - Fixed bug php#78413 (request_terminate_timeout does not     take effect after fastcgi_finish_request). (Sergei     Turchanov)

**MBString:**

  - Fixed bug php#78579 (mb_decode_numericentity: args     number inconsistency). (cmb)

  - Fixed bug php#78609 (mb_check_encoding() no longer     supports stringable objects). (cmb)

**MySQLi:**

  - Fixed bug php#76809 (SSL settings aren't respected when     persistent connections are used). (fabiomsouto)

**Mysqlnd:**

  - Fixed bug php#78525 (Memory leak in pdo when reusing     native prepared statements). (Nikita)

**PCRE:**

  - Fixed bug php#78272 (calling preg_match() before     pcntl_fork() will freeze child process). (Nikita)

**PDO_MySQL:**

  - Fixed bug php#78623 (Regression caused by 'SP call     yields additional empty result set'). (cmb)

**Session:**

  - Fixed bug php#78624 (session_gc return value for user     defined session handlers). (bshaffer)

**Standard:**

  - Fixed bug php#76342 (file_get_contents waits twice     specified timeout). (Thomas Calvet)

  - Fixed bug php#78612 (strtr leaks memory when integer     keys are used and the subject string shorter). (Nikita)

  - Fixed bug php#76859 (stream_get_line skips data if used     with data-generating filter). (kkopachev)

**Zip:**

  - Fixed bug php#78641 (addGlob can modify given     remove_path value). (cmb)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the php packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24     and 7.3.x below 7.3.11 in certain configurations of FPM     setup it is possible to cause FPM module to write past     allocated buffers into the space reserved for FCGI     protocol data, thus opening the possibility of remote     code execution.(CVE-2019-11043)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is running a version of macOS / Mac OS X that is 10.15.x prior to 10.15.3, 10.13.x prior to 10.13.6, 10.14.x prior to 10.14.6. It is, therefore, affected by multiple vulnerabilities:

  - In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24     and 7.3.x below 7.3.11 in certain configurations of FPM     setup it is possible to cause FPM module to write past     allocated buffers into the space reserved for FCGI     protocol data, thus opening the possibility of remote     code execution. (CVE-2019-11043)

  - An arbitrary code exution vulnerability exists      due to a misconfiguration. An authenticated, local attacker     can exploit this to execute arbitrary code on the remote host.
    (CVE-2019-18634)

  - An arbitrary code exution vulnerability exists      due to the ability to process a maliciously crafted image.     An unauthenticated, remote attacker can exploit this to     execute arbitrary code on the remote host.
    (CVE-2020-3826 CVE-2020-3827 CVE-2020-3870 CVE-2020-3878)

  - A privilege escalation vulnerability exists in due to an out-of-bounds read issue.     An unauthenticated, remote attacker can exploit this, to gain elevated     access to the system. (CVE-2020-3829)

  - An arbitrary file write vulnerability exists in the handling of symlinks.     A malicious program crafted by an attacker can exploit this to overwrite arbitrary files on the remote host.
    (CVE-2020-3830 CVE-2020-3835 CVE-2020-3855)

  - An information disclosure vulnerability exists in the access control handling of applications.     A malicious application crafted by attacker can exploit this to disclose the kernel memory layout.
    (CVE-2020-3836)

  - An arbitrary code exution vulnerability exists      due to a memory corruption issue. A malicious application     crafted by a remote attacker may be able to execute arbitrary code     with kernel privileges on the remote host.
    (CVE-2020-3837  CVE-2020-3842 CVE-2020-3871)

  - An arbitrary code exution vulnerability exists      due to a permissions logic flaw.  A malicious application     crafted by a remote attacker may be able to execute arbitrary code     with system privileges on the remote host.
    (CVE-2019-18634 CVE-2020-3854 CVE-2020-3845 CVE-2020-3853 CVE-2020-3857)

  - An information disclosure vulnerability exists in the input sanitization logic.     A malicious application crafted by attacker can exploit this to read restricted memory.
    (CVE-2020-3839 CVE-2020-3847)

  - An arbitrary code exution vulnerability exists      due to the loading of a maliciously crafted racoon configuration file.     An authenticated, local attacker can exploit this to execute arbitrary code on the remote host.
    (CVE-2020-3840)

  - A denial of service (DoS) vulnerability exists due to a memory corruption issue. An     unauthenticated, remote attacker can exploit this issue, via malicious input, to cause the     system to crash, stop responding, or corrupt the kernel memory. (CVE-2020-3843)

  - An arbitrary code exution vulnerability exists      due to either a buffer overflow or out-of-bounds read issue. An authenticated, local attacker     can exploit this to execute arbitrary code on the remote host or     cause an unexpected application to terminate.
    (CVE-2020-3846 CVE-2020-3848 CVE-2020-3849 CVE-2020-3850 CVE-2020-3877)

  - A memory corruption vulnerability exists due to a malicious crafted string. An     unauthenticated, remote attacker can exploit this issue, via malicious input, to cause the     corruption of the heap memory. (CVE-2020-3856)

  - An security bypass vulnerability exists in the handling of files from an attacker controlled NFS mount.     A remote attacker with local access could search for and open a file from an attacker controlled NFS mount     and bypass Gatekeeper Security features. (CVE-2020-3866)

  - An information disclosure vulnerability exists where an application     can read restricted memory.  A local, authorized attacker can exploit this to read restricted memory.
    (CVE-2020-3872 CVE-2020-3875)

Note that Nessus has not tested for this issue but has instead relied only on the operating system's self-reported version number.

This update for php7 fixes the following issues :

Security issue fixed :

  - CVE-2019-11043: Fixed possible remote code execution via     env_path_info underflow in fpm_main.c (bsc#1154999).

This update was imported from the SUSE:SLE-15:Update update project.

The version of PHP installed on the remote web server is affected by a remote code execution vulnerability in env_path_info in fpm_main.c due to insufficient validation of user input. An unauthenticated, remote attacker can exploit this, via a specially crafted request to execute arbitrary code.

According to its banner, the version of PHP running on the remote web server is prior to 7.1.33, 7.2.x prior to 7.2.24, or 7.3.x prior to 7.3.11. It is, therefore, affected by a remote code execution vulnerability due to insufficient validation of user input. An unauthenticated, remote attacker can exploit this, by sending a specially crafted request, to cause the execution of arbitrary code by breaking the fastcgi_split_path_info directive.

ID	Name	Product	Family	Published	Updated	Severity
130482	Fedora 30 : php (2019-7bb07c3b02)	Nessus	Fedora Local Security Checks	11/4/2019	12/6/2022	critical
131361	EulerOS 2.0 SP8 : php (EulerOS-SA-2019-2295)	Nessus	Huawei Local Security Checks	11/27/2019	4/25/2023	critical
133531	macOS 10.15.x < 10.15.3 / 10.14.x < 10.14.6 / 10.13.x < 10.13.6	Nessus	MacOS X Local Security Checks	2/7/2020	12/6/2022	critical
130888	openSUSE Security Update : php7 (openSUSE-2019-2457)	Nessus	SuSE Local Security Checks	11/12/2019	4/12/2024	critical
136744	PHP Remote Code Execution Vulnerability (CVE-2019-11043).	Nessus	CGI abuses	5/21/2020	4/15/2024	critical
701235	PHP < 7.1.33 / 7.2.x < 7.2.24 / 7.3.x < 7.3.11 Remote Code Execution	Nessus Network Monitor	Web Servers	11/12/2019	11/12/2019	high

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical

high