Búsqueda de    
Vulnerabilidad   
    Buscar 219043 Descripciones CVE y
99761 Descripciones de Pruebas,
accesos 10,000+ referencias cruzadas.
Pruebas   CVE   Todos  

ID de Prueba:1.3.6.1.4.1.25623.1.1.2.2020.2316
Categoría:Huawei EulerOS Local Security Checks
Título:Huawei EulerOS: Security Advisory for php (EulerOS-SA-2020-2316)
Resumen:The remote host is missing an update for the Huawei EulerOS 'php' package(s) announced via the EulerOS-SA-2020-2316 advisory.
Descripción:Summary:
The remote host is missing an update for the Huawei EulerOS 'php' package(s) announced via the EulerOS-SA-2020-2316 advisory.

Vulnerability Insight:
In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when PHP is processing incoming HTTP cookie values, the cookie names are url-decoded. This may lead to cookies with prefixes like __Host confused with cookies that decode to such prefix, thus leading to an attacker being able to forge cookie which is supposed to be secure. See also CVE-2020-8184 for more information.(CVE-2020-7070)

In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when AES-CCM mode is used with openssl_encrypt() function with 12 bytes IV, only first 7 bytes of the IV is actually used. This can lead to both decreased security and incorrect encryption data.(CVE-2020-7069)

In PHP versions 7.2.x below 7.2.23, 7.3.x below 7.3.21 and 7.4.x below 7.4.9, while processing PHAR files using phar extension, phar_parse_zipfile could be tricked into accessing freed memory, which could lead to a crash or information disclosure.(CVE-2020-7068)

Affected Software/OS:
'php' package(s) on Huawei EulerOS V2.0SP8.

Solution:
Please install the updated package(s).

CVSS Score:
6.4

CVSS Vector:
AV:N/AC:L/Au:N/C:P/I:P/A:N

Referencia Cruzada: Common Vulnerability Exposure (CVE) ID: CVE-2020-7068
https://security.netapp.com/advisory/ntap-20200918-0005/
Debian Security Information: DSA-4856 (Google Search)
https://www.debian.org/security/2021/dsa-4856
https://security.gentoo.org/glsa/202009-10
https://bugs.php.net/bug.php?id=79797
Common Vulnerability Exposure (CVE) ID: CVE-2020-7069
https://security.netapp.com/advisory/ntap-20201016-0001/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RRU57N3OSYZPOMFWPRDNVH7EMYOTSZ66/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7EVDN7D3IB4EAI4D3ZOM2OJKQ5SD7K4E/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P2J3ZZDHCSX65T5QWV4AHBN7MOJXBEKG/
https://security.gentoo.org/glsa/202012-16
https://bugs.php.net/bug.php?id=79601
https://www.oracle.com/security-alerts/cpuApr2021.html
SuSE Security Announcement: openSUSE-SU-2020:1703 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00045.html
SuSE Security Announcement: openSUSE-SU-2020:1767 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00067.html
https://usn.ubuntu.com/4583-1/
Common Vulnerability Exposure (CVE) ID: CVE-2020-7070
http://cve.circl.lu/cve/CVE-2020-8184
https://bugs.php.net/bug.php?id=79699
https://hackerone.com/reports/895727
https://lists.debian.org/debian-lts-announce/2020/10/msg00008.html
CopyrightCopyright (C) 2020 Greenbone Networks GmbH

Esta es sólo una de 99761 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa.

Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.




© 1998-2021 E-Soft Inc. Todos los derechos reservados.