|Category:||Huawei EulerOS Local Security Checks|
|Title:||Huawei EulerOS: Security Advisory for php (EulerOS-SA-2020-2316)|
|Summary:||The remote host is missing an update for the Huawei EulerOS 'php' package(s) announced via the EulerOS-SA-2020-2316 advisory.|
The remote host is missing an update for the Huawei EulerOS 'php' package(s) announced via the EulerOS-SA-2020-2316 advisory.
In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when PHP is processing incoming HTTP cookie values, the cookie names are url-decoded. This may lead to cookies with prefixes like __Host confused with cookies that decode to such prefix, thus leading to an attacker being able to forge cookie which is supposed to be secure. See also CVE-2020-8184 for more information.(CVE-2020-7070)
In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when AES-CCM mode is used with openssl_encrypt() function with 12 bytes IV, only first 7 bytes of the IV is actually used. This can lead to both decreased security and incorrect encryption data.(CVE-2020-7069)
In PHP versions 7.2.x below 7.2.23, 7.3.x below 7.3.21 and 7.4.x below 7.4.9, while processing PHAR files using phar extension, phar_parse_zipfile could be tricked into accessing freed memory, which could lead to a crash or information disclosure.(CVE-2020-7068)
'php' package(s) on Huawei EulerOS V2.0SP8.
Please install the updated package(s).
Common Vulnerability Exposure (CVE) ID: CVE-2020-7068|
Debian Security Information: DSA-4856 (Google Search)
Common Vulnerability Exposure (CVE) ID: CVE-2020-7069
SuSE Security Announcement: openSUSE-SU-2020:1703 (Google Search)
SuSE Security Announcement: openSUSE-SU-2020:1767 (Google Search)
Common Vulnerability Exposure (CVE) ID: CVE-2020-7070
|Copyright||Copyright (C) 2020 Greenbone Networks GmbH|
|This is only one of 99761 vulnerability tests in our test suite. Find out more about running a complete security audit.|
To run a free test of this vulnerability against your system, register below.