9.1 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
7.6 High
AI Score
Confidence
Low
6.4 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:N/A:P
0.007 Low
EPSS
Percentile
80.1%
PHP is prone to multiple vulnerabilities.
# Copyright (C) 2021 Greenbone Networks GmbH
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-or-later
#
# This program is free software; you can redistribute it and/or
# modify it under the terms of the GNU General Public License
# as published by the Free Software Foundation; either version 2
# of the License, or (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
CPE = "cpe:/a:php:php";
if (description)
{
script_oid("1.3.6.1.4.1.25623.1.0.117751");
script_version("2021-10-25T12:03:22+0000");
script_tag(name:"last_modification", value:"2021-10-25 12:03:22 +0000 (Mon, 25 Oct 2021)");
script_tag(name:"creation_date", value:"2021-10-25 10:37:23 +0000 (Mon, 25 Oct 2021)");
script_tag(name:"cvss_base", value:"6.4");
script_tag(name:"cvss_base_vector", value:"AV:N/AC:L/Au:N/C:P/I:N/A:P");
script_tag(name:"severity_vector", value:"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H");
script_tag(name:"severity_origin", value:"NVD");
script_tag(name:"severity_date", value:"2020-10-16 12:57:00 +0000 (Fri, 16 Oct 2020)");
script_cve_id("CVE-2019-11038", "CVE-2019-11039", "CVE-2019-11040");
script_tag(name:"qod_type", value:"remote_banner");
script_tag(name:"solution_type", value:"VendorFix");
script_name("PHP 7.1.x < 7.1.30, 7.2.x < 7.2.19, 7.3.x < 7.3.6 Multiple Vulnerabilities - Windows");
script_category(ACT_GATHER_INFO);
script_copyright("Copyright (C) 2021 Greenbone Networks GmbH");
script_family("Web application abuses");
script_dependencies("secpod_php_smb_login_detect.nasl", "gb_php_http_detect.nasl", "os_detection.nasl");
script_mandatory_keys("php/detected", "Host/runs_windows");
script_tag(name:"summary", value:"PHP is prone to multiple vulnerabilities.");
script_tag(name:"vuldetect", value:"Checks if a vulnerable version is present on the target host.");
script_tag(name:"insight", value:"The following flaws exist:
- CVE-2019-11038: When using the gdImageCreateFromXbm() function in the GD Graphics Library (aka
LibGD) 2.2.5, as used in the PHP GD extension it is possible to supply data that will cause the
function to use the value of uninitialized variable. This may lead to disclosing contents of the
stack that has been left there by previous code.
- CVE-2019-11039: Function iconv_mime_decode_headers() may perform out-of-buffer read due to
integer overflow when parsing MIME headers. This may lead to information disclosure or crash.
- CVE-2019-11040: When PHP EXIF extension is parsing EXIF information from an image, e.g. via
exif_read_data() function it is possible to supply it with data what will cause it to read past
the allocated buffer. This may lead to information disclosure or crash.");
script_tag(name:"affected", value:"PHP versions 7.1.x prior to 7.1.30, 7.2.x prior to 7.2.19 and
7.3.x prior to 7.3.6.");
script_tag(name:"solution", value:"Update to version 7.1.30, 7.2.19, 7.3.6 or later.");
script_xref(name:"URL", value:"https://www.php.net/ChangeLog-7.php#7.3.6");
script_xref(name:"URL", value:"https://www.php.net/ChangeLog-7.php#7.2.19");
script_xref(name:"URL", value:"https://www.php.net/ChangeLog-7.php#7.1.30");
exit(0);
}
include("host_details.inc");
include("version_func.inc");
if (isnull(port = get_app_port(cpe: CPE)))
exit(0);
if (!infos = get_app_version_and_location(cpe: CPE, port: port, exit_no_version: TRUE))
exit(0);
version = infos["version"];
location = infos["location"];
if (version_in_range(version: version, test_version: "7.1", test_version2: "7.1.29")) {
report = report_fixed_ver(installed_version: version, fixed_version: "7.1.30", install_path: location);
security_message(port: port, data: report);
exit(0);
}
if (version_in_range(version: version, test_version: "7.2", test_version2: "7.2.18")) {
report = report_fixed_ver(installed_version: version, fixed_version: "7.2.19", install_path: location);
security_message(port: port, data: report);
exit(0);
}
if (version_in_range(version: version, test_version: "7.3", test_version2: "7.3.5")) {
report = report_fixed_ver(installed_version: version, fixed_version: "7.3.6", install_path: location);
security_message(port: port, data: report);
exit(0);
}
exit(99);
9.1 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
7.6 High
AI Score
Confidence
Low
6.4 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:N/A:P
0.007 Low
EPSS
Percentile
80.1%