Anfälligkeitssuche        Suche in 219043 CVE Beschreibungen
und 99761 Test Beschreibungen,
Zugriff auf 10,000+ Quellverweise.
Tests   CVE   Alle  

Test Kennung:1.3.6.1.4.1.25623.1.1.2.2020.2316
Kategorie:Huawei EulerOS Local Security Checks
Titel:Huawei EulerOS: Security Advisory for php (EulerOS-SA-2020-2316)
Zusammenfassung:The remote host is missing an update for the Huawei EulerOS 'php' package(s) announced via the EulerOS-SA-2020-2316 advisory.
Beschreibung:Summary:
The remote host is missing an update for the Huawei EulerOS 'php' package(s) announced via the EulerOS-SA-2020-2316 advisory.

Vulnerability Insight:
In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when PHP is processing incoming HTTP cookie values, the cookie names are url-decoded. This may lead to cookies with prefixes like __Host confused with cookies that decode to such prefix, thus leading to an attacker being able to forge cookie which is supposed to be secure. See also CVE-2020-8184 for more information.(CVE-2020-7070)

In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when AES-CCM mode is used with openssl_encrypt() function with 12 bytes IV, only first 7 bytes of the IV is actually used. This can lead to both decreased security and incorrect encryption data.(CVE-2020-7069)

In PHP versions 7.2.x below 7.2.23, 7.3.x below 7.3.21 and 7.4.x below 7.4.9, while processing PHAR files using phar extension, phar_parse_zipfile could be tricked into accessing freed memory, which could lead to a crash or information disclosure.(CVE-2020-7068)

Affected Software/OS:
'php' package(s) on Huawei EulerOS V2.0SP8.

Solution:
Please install the updated package(s).

CVSS Score:
6.4

CVSS Vector:
AV:N/AC:L/Au:N/C:P/I:P/A:N

Querverweis: Common Vulnerability Exposure (CVE) ID: CVE-2020-7068
https://security.netapp.com/advisory/ntap-20200918-0005/
Debian Security Information: DSA-4856 (Google Search)
https://www.debian.org/security/2021/dsa-4856
https://security.gentoo.org/glsa/202009-10
https://bugs.php.net/bug.php?id=79797
Common Vulnerability Exposure (CVE) ID: CVE-2020-7069
https://security.netapp.com/advisory/ntap-20201016-0001/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RRU57N3OSYZPOMFWPRDNVH7EMYOTSZ66/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7EVDN7D3IB4EAI4D3ZOM2OJKQ5SD7K4E/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P2J3ZZDHCSX65T5QWV4AHBN7MOJXBEKG/
https://security.gentoo.org/glsa/202012-16
https://bugs.php.net/bug.php?id=79601
https://www.oracle.com/security-alerts/cpuApr2021.html
SuSE Security Announcement: openSUSE-SU-2020:1703 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00045.html
SuSE Security Announcement: openSUSE-SU-2020:1767 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00067.html
https://usn.ubuntu.com/4583-1/
Common Vulnerability Exposure (CVE) ID: CVE-2020-7070
http://cve.circl.lu/cve/CVE-2020-8184
https://bugs.php.net/bug.php?id=79699
https://hackerone.com/reports/895727
https://lists.debian.org/debian-lts-announce/2020/10/msg00008.html
CopyrightCopyright (C) 2020 Greenbone Networks GmbH

Dies ist nur einer von 99761 Anfälligkeitstests in unserem Testpaket. Finden Sie mehr über unsere vollständigen Sicherheitsüberprüfungen heraus.

Um einen gratis Test für diese Anfälligkeit auf Ihrem System durchlaufen zu lassen, registrieren Sie sich bitte unten.




© 1998-2021 E-Soft Inc. Alle Rechte vorbehalten.