Fedora 42 : php (2025-ce8a4096e7)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##
# The descriptive text and package checks in this plugin were
# extracted from Fedora Security Advisory FEDORA-2025-ce8a4096e7
#

include('compat.inc');

if (description)
{
  script_id(279350);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/02/23");

  script_cve_id("CVE-2025-14177", "CVE-2025-14178", "CVE-2025-14180");
  script_xref(name:"FEDORA", value:"2025-ce8a4096e7");
  script_xref(name:"IAVA", value:"2026-A-0020");

  script_name(english:"Fedora 42 : php (2025-ce8a4096e7)");

  script_set_attribute(attribute:"synopsis", value:
"The remote Fedora host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the
FEDORA-2025-ce8a4096e7 advisory.

    **PHP version 8.4.16** (18 Dec 2025)

    **Core:**

    * Sync all boost.context files with release 1.86.0. (mvorisek)
    * Fixed bug [GH-20435](https://github.com/php/php-src/issues/20435) (SensitiveParameter doesn't work for
    named argument passing to variadic parameter). (ndossche)
    * Fixed bug [GH-20286](https://github.com/php/php-src/issues/20286) (use-after-destroy during userland
    stream_close()). (ndossche, David Carlier)

    **Bz2:**

    * Fix assertion failures resulting in crashes with stream filter object parameters. (ndossche)

    **Date:**

    * Fix crashes when trying to instantiate uninstantiable classes via date static constructors. (ndossche)

    **DOM:**

    * Fix memory leak when edge case is hit when registering xpath callback. (ndossche)
    * Fixed bug [GH-20395](https://github.com/php/php-src/issues/20395) (querySelector and querySelectorAll
    requires elements in $selectors to be lowercase). (ndossche)
    * Fix missing NUL byte check on C14NFile(). (ndossche)

    **Fibers:**

    * Fixed bug [GH-20483](https://github.com/php/php-src/issues/20483) (ASAN stack overflow with
    fiber.stack_size INI small value). (David Carlier)

    **FTP:**

    * Fixed bug [GH-20601](https://github.com/php/php-src/issues/20601) (ftp_connect overflow on timeout).
    (David Carlier)

    **GD:**

    * Fixed bug [GH-20511](https://github.com/php/php-src/issues/20511) (imagegammacorrect out of range
    input/output values). (David Carlier)
    * Fixed bug [GH-20602](https://github.com/php/php-src/issues/20602) (imagescale overflow with large height
    values). (David Carlier)

    **Intl:**

    * Fixed bug [GH-20426](https://github.com/php/php-src/issues/20426) (Spoofchecker::setRestrictionLevel()
    error message suggests missing constants). (DanielEScherzer)

    **LibXML:**

    * Fix some deprecations on newer libxml versions regarding input buffer/parser handling. (ndossche)

    **MbString:**

    * Fixed bug [GH-20491](https://github.com/php/php-src/issues/20491) (SLES15 compile error with mbstring
    oniguruma). (ndossche)
    * Fixed bug [GH-20492](https://github.com/php/php-src/issues/20492) (mbstring compile warning due to non-
    strings). (ndossche)

    **MySQLnd:**

    * Fixed bug [GH-20528](https://github.com/php/php-src/issues/20528) (Regression breaks mysql connexion
    using an IPv6 address enclosed in square brackets). (Remi)

    **Opcache:**

    * Fixed bug [GH-20329](https://github.com/php/php-src/issues/20329) (opcache.file_cache broken with full
    interned string buffer). (Arnaud)

    **PDO:**

    * Fixed [GHSA-8xr5-qppj-gvwj](https://github.com/php/php-src/security/advisories/GHSA-8xr5-qppj-gvwj) (PDO
    quoting result null deref). (**CVE-2025-14180**) (Jakub Zelenka)

    **Phar:**

    * Fixed bug [GH-20442](https://github.com/php/php-src/issues/20442) (Phar does not respect case-
    insensitiveness of __halt_compiler() when reading stub). (ndossche, TimWolla)
    * Fix broken return value of fflush() for phar file entries. (ndossche)
    * Fix assertion failure when fseeking a phar file out of bounds. (ndossche)

    **PHPDBG:**

    * Fixed ZPP type violation in phpdbg_get_executable() and phpdbg_end_oplog(). (Girgias)

    **SPL:**

    * Fixed bug [GH-20614](https://github.com/php/php-src/issues/20614) (SplFixedArray incorrectly handles
    references in deserialization). (ndossche)

    **Standard:**

    * Fix memory leak in array_diff() with custom type checks. (ndossche)
    * Fixed bug [GH-20583](https://github.com/php/php-src/issues/20583) (Stack overflow in http_build_query
    via deep structures). (ndossche)
    * Fixed [GHSA-www2-q4fc-65wf](https://github.com/php/php-src/security/advisories/GHSA-www2-q4fc-65wf)
    (Null byte termination in dns_get_record()). (ndossche)
    * Fixed [GHSA-h96m-rvf9-jgm2](https://github.com/php/php-src/security/advisories/GHSA-h96m-rvf9-jgm2)
    (Heap buffer overflow in array_merge()). (**CVE-2025-14178**) (ndossche)
    * Fixed [GHSA-3237-qqm7-mfv7](https://github.com/php/php-src/security/advisories/GHSA-3237-qqm7-mfv7)
    (Information Leak of Memory in getimagesize). (**CVE-2025-14177**) (ndossche)

    **Tidy:**

    * Fixed bug [GH-20374](https://github.com/php/php-src/issues/20374) (PHP with tidy and custom-tags).
    (ndossche)

    **XML:**

    * Fixed bug [GH-20439](https://github.com/php/php-src/issues/20439) (xml_set_default_handler() does not
    properly handle special characters in attributes when passing data to callback). (ndossche)

    **Zlib:**

    * Fix assertion failures resulting in crashes with stream filter object parameters. (ndossche)


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://bodhi.fedoraproject.org/updates/FEDORA-2025-ce8a4096e7");
  script_set_attribute(attribute:"solution", value:
"Update the affected php package.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:P");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-14178");
  script_set_attribute(attribute:"cvss4_score_source", value:"CVE-2025-14180");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/12/17");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/12/17");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/12/19");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora:42");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:php");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Fedora Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2025-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list");

  exit(0);
}


include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'Fedora' >!< os_product) audit(AUDIT_OS_NOT, 'Fedora');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'Fedora');
if (! preg(pattern:"^42([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'Fedora 42', 'Fedora ' + os_version);

if (!get_kb_item('Host/RedHat/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Fedora', cpu);

var constraints = [
  {
    'release': '42',
    'pkgs': [
      {'reference':'php-8.4.16-1.fc42', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}

if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'php');
}