|Category:||Huawei EulerOS Local Security Checks|
|Title:||Huawei EulerOS: Security Advisory for php (EulerOS-SA-2021-1566)|
|Summary:||The remote host is missing an update for the Huawei EulerOS 'php' package(s) announced via the EulerOS-SA-2021-1566 advisory.|
The remote host is missing an update for the Huawei EulerOS 'php' package(s) announced via the EulerOS-SA-2021-1566 advisory.
In PHP versions 7.2.x below 7.2.33, 7.3.x below 7.3.21 and 7.4.x below 7.4.9, while processing PHAR files using phar extension, phar_parse_zipfile could be tricked into accessing freed memory, which could lead to a crash or information disclosure.(CVE-2020-7068)
In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when PHP is processing incoming HTTP cookie values, the cookie names are url-decoded. This may lead to cookies with prefixes like __Host confused with cookies that decode to such prefix, thus leading to an attacker being able to forge cookie which is supposed to be secure. See also CVE-2020-8184 for more information.(CVE-2020-7070)
In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when AES-CCM mode is used with openssl_encrypt() function with 12 bytes IV, only first 7 bytes of the IV is actually used. This can lead to both decreased security and incorrect encryption data.(CVE-2020-7069)
In PHP versions 7.3.x below 7.3.26, 7.4.x below 7.4.14 and 8.0.0, when validating URL with functions like filter_var($url, FILTER_VALIDATE_URL), PHP will accept an URL with invalid password as valid URL. This may lead to functions that rely on URL being valid to mis-parse the URL and produce wrong data as components of the URL.(CVE-2020-7071)
'php' package(s) on Huawei EulerOS Virtualization for ARM 64 22.214.171.124.
Please install the updated package(s).
Common Vulnerability Exposure (CVE) ID: CVE-2020-7068|
Debian Security Information: DSA-4856 (Google Search)
Common Vulnerability Exposure (CVE) ID: CVE-2020-7069
SuSE Security Announcement: openSUSE-SU-2020:1703 (Google Search)
SuSE Security Announcement: openSUSE-SU-2020:1767 (Google Search)
Common Vulnerability Exposure (CVE) ID: CVE-2020-7070
Common Vulnerability Exposure (CVE) ID: CVE-2020-7071
|Copyright||Copyright (C) 2021 Greenbone Networks GmbH|
|This is only one of 99761 vulnerability tests in our test suite. Find out more about running a complete security audit.|
To run a free test of this vulnerability against your system, register below.