PHP 7.1.x < 7.1.30, 7.2.x < 7.2.19, 7.3.x < 7.3.6 Multiple Vulnerabilities - Windows

# SPDX-FileCopyrightText: 2021 Greenbone AG
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-only

CPE = "cpe:/a:php:php";

if (description)
{
  script_oid("1.3.6.1.4.1.25623.1.0.117751");
  script_version("2025-09-24T05:39:03+0000");
  script_tag(name:"last_modification", value:"2025-09-24 05:39:03 +0000 (Wed, 24 Sep 2025)");
  script_tag(name:"creation_date", value:"2021-10-25 10:37:23 +0000 (Mon, 25 Oct 2021)");
  script_tag(name:"cvss_base", value:"6.4");
  script_tag(name:"cvss_base_vector", value:"AV:N/AC:L/Au:N/C:P/I:N/A:P");
  script_tag(name:"severity_vector", value:"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H");
  script_tag(name:"severity_origin", value:"NVD");
  script_tag(name:"severity_date", value:"2020-10-16 12:57:00 +0000 (Fri, 16 Oct 2020)");

  script_cve_id("CVE-2019-11038", "CVE-2019-11039", "CVE-2019-11040");

  script_tag(name:"qod_type", value:"remote_banner");

  script_tag(name:"solution_type", value:"VendorFix");

  script_name("PHP 7.1.x < 7.1.30, 7.2.x < 7.2.19, 7.3.x < 7.3.6 Multiple Vulnerabilities - Windows");

  script_category(ACT_GATHER_INFO);

  script_copyright("Copyright (C) 2021 Greenbone AG");
  script_family("Web application abuses");
  script_dependencies("gb_php_consolidation.nasl", "os_detection.nasl");
  script_mandatory_keys("php/detected", "Host/runs_windows");

  script_tag(name:"summary", value:"PHP is prone to multiple vulnerabilities.");

  script_tag(name:"vuldetect", value:"Checks if a vulnerable version is present on the target host.");

  script_tag(name:"insight", value:"The following flaws exist:

  - CVE-2019-11038: When using the gdImageCreateFromXbm() function in the GD Graphics Library (aka
  LibGD) 2.2.5, as used in the PHP GD extension it is possible to supply data that will cause the
  function to use the value of uninitialized variable. This may lead to disclosing contents of the
  stack that has been left there by previous code.

  - CVE-2019-11039: Function iconv_mime_decode_headers() may perform out-of-buffer read due to
  integer overflow when parsing MIME headers. This may lead to information disclosure or crash.

  - CVE-2019-11040: When PHP EXIF extension is parsing EXIF information from an image, e.g. via
  exif_read_data() function it is possible to supply it with data what will cause it to read past
  the allocated buffer. This may lead to information disclosure or crash.");

  script_tag(name:"affected", value:"PHP versions 7.1.x prior to 7.1.30, 7.2.x prior to 7.2.19 and
  7.3.x prior to 7.3.6.");

  script_tag(name:"solution", value:"Update to version 7.1.30, 7.2.19, 7.3.6 or later.");

  script_xref(name:"URL", value:"https://www.php.net/ChangeLog-7.php#7.3.6");
  script_xref(name:"URL", value:"https://www.php.net/ChangeLog-7.php#7.2.19");
  script_xref(name:"URL", value:"https://www.php.net/ChangeLog-7.php#7.1.30");

  exit(0);
}

include("host_details.inc");
include("version_func.inc");

if (isnull(port = get_app_port(cpe: CPE)))
  exit(0);

if (!infos = get_app_version_and_location(cpe: CPE, port: port, exit_no_version: TRUE))
  exit(0);

version = infos["version"];
location = infos["location"];

if (version_in_range(version: version, test_version: "7.1", test_version2: "7.1.29")) {
  report = report_fixed_ver(installed_version: version, fixed_version: "7.1.30", install_path: location);
  security_message(port: port, data: report);
  exit(0);
}

if (version_in_range(version: version, test_version: "7.2", test_version2: "7.2.18")) {
  report = report_fixed_ver(installed_version: version, fixed_version: "7.2.19", install_path: location);
  security_message(port: port, data: report);
  exit(0);
}

if (version_in_range(version: version, test_version: "7.3", test_version2: "7.3.5")) {
  report = report_fixed_ver(installed_version: version, fixed_version: "7.3.6", install_path: location);
  security_message(port: port, data: report);
  exit(0);
}

exit(99);