PHP < 8.2.35 / 8.3.x < 8.3.36 / 8.4.x < 8.4.27 / 8.5.x < 8.5.12 Multiple Vulnerabilities

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(369483);
  script_version("1.4");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/22");

  script_cve_id("CVE-2026-109618", "CVE-2026-109619");

  script_name(english:"PHP < 8.2.35 / 8.3.x < 8.3.36 / 8.4.x < 8.4.27 / 8.5.x < 8.5.12 Multiple Vulnerabilities");

  script_set_attribute(attribute:"synopsis", value:
"The version of PHP installed on the remote host is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of PHP installed on the remote host is prior to 8.2.35, 8.3.x prior to 8.3.36, 8.4.x prior to
8.4.27, or 8.5.x prior to 8.5.12. It is, therefore, affected by multiple remote code execution vulnerabilities as
referenced in the 21 October 2026 PHP security advisory.

  - PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request.
    Some contexts may not properly account for this scenario and leave request memory in an uninitialized state
    before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory.
    Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).
    (CVE-2026-109618)

  - PHP has various global state that temporarily points into request memory. In some scenarios, global state may
    not be correctly reset, or may be repopulated after being reset. The global state may then refer to request
    memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is
    fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).
    (CVE-2026-109619)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported
version number.");
  # https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?417dfc63");
  # https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?a70a97d7");
  script_set_attribute(attribute:"see_also", value:"https://www.php.net/archive/2026.php#2026-10-21-5");
  script_set_attribute(attribute:"solution", value:
"Upgrade to PHP version 8.2.35, 8.3.36, 8.4.27, 8.5.12 or later.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:U");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-109619");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(416, 755, 824, 1325, 1419);

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/10/21");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/10/21");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/21");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:php:php");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CGI abuses");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("php_version.nasl", "php_win_installed.nbin", "php_nix_installed.nbin");
  script_require_keys("installed_sw/PHP");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'checks': [
    {
      'product': {'name': 'PHP', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints': [
        { 'fixed_version' : '8.2.35' },
        { 'min_version' : '8.3.0alpha1', 'fixed_version' : '8.3.36' },
        { 'min_version' : '8.4.0alpha1', 'fixed_version' : '8.4.27' },
        { 'min_version' : '8.5.0alpha1', 'fixed_version' : '8.5.12' }
      ]
    }
  ]
};

var result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_HOLE);
vdf::handle_check_and_report_errors(vdf_result:result);