PHP 5

Tenable plugin 105771 is flagging upstream PHP versions earlier than 5.6.33, which fixed two issues in this release train: CVE-2018-5711, an infinite-loop bug in GD image parsing when an application feeds attacker-controlled GIF data into functions like imagecreatefromgif(), and CVE-2018-5712, a reflected XSS on the PHAR 404 error page when a request for a .phar file is reflected back to a user. Upstream affected ranges were 5.6.x < 5.6.33, 7.0.x < 7.0.27, 7.1.x < 7.1.13, and 7.2.x < 7.2.1.

The vendor's MEDIUM label is fair in a vacuum, but reality is narrower. The higher-scored issue is *user-interaction-dependent reflected XSS*; the other is an *application-mediated DoS* that only matters if your app accepts attacker-controlled GIFs and routes them through GD. Add Tenable's own warning that detection is based only on the server banner, plus the very real chance of distro backports, and this drops into backlog-hygiene territory for most enterprises.

Why this verdict

• Down from the vendor baseline because the top-scored branch is click-dependent. CVE-2018-5712 is UI:R, so it is not a one-packet server compromise; it needs a user to follow a crafted URL.
• Down again because the vulnerable feature exposure is narrow. The XSS needs PHAR 404 behavior to be reachable through real app routing, and the DoS needs an application to parse attacker-controlled GIF data with GD.
• Down again because blast radius is modest. The reviewed sources support reflected XSS or localized availability impact, not unauthenticated server-side RCE or durable host takeover.
• Down again because scanner certainty is limited. Tenable says the plugin relies on self-reported version banners and does not actually test the flaw, which matters a lot on distro-packaged PHP with backports.
• Not ignored because it is still remotely triggerable in the right app shape. If you do expose .phar request handling or parse untrusted GIFs at scale, there is real exploitability at the application tier.

Why not higher?

There is no reviewed evidence of active exploitation, KEV inclusion, or a practical unauthenticated RCE path. Every meaningful branch needs extra conditions that sharply narrow who can reach it and what they get out of it.

Why not lower?

This is still a genuine security fix in a widely deployed runtime, and the XSS issue is remote and unauthenticated if the endpoint is reachable. If a business-critical admin user can be lured to the crafted PHAR path, the result can still be session abuse in the application.

1. Block direct .phar web requests — Deny or reroute requests for .phar paths at the reverse proxy or web server so the PHAR 404 reflection path never reaches users. For a LOW verdict there is no SLA; treat this as backlog hygiene and deploy during routine hardening.
2. Enforce CSP and cookie hardening — Use a restrictive Content-Security-Policy, plus HttpOnly, Secure, and SameSite session cookies, to shrink what any reflected XSS can steal or execute. For a LOW verdict there is no SLA; fold it into your normal web-security baseline work.
3. Sanitize image ingestion — Validate, transcode, or sandbox untrusted GIF uploads before PHP/GD processes them so malformed images never hit the vulnerable parser path. For a LOW verdict there is no SLA; schedule it as application hardening.
4. Verify package provenance before escalating — Because the Nessus plugin is banner-based, confirm whether the host is running upstream PHP or a distro-backported build before burning change windows. For a LOW verdict there is no SLA; do this during normal triage.

Run this on the target host, container, or build artifact that actually provides the PHP runtime. Invoke it as python3 check_php_2018_571x.py /usr/bin/php or just python3 check_php_2018_571x.py if php is on PATH; no elevated privileges are required unless the PHP binary is restricted. This checks the local runtime version against the upstream fixed ranges and returns UNKNOWN when distro packaging may be masking backports.

#!/usr/bin/env python3
# check_php_2018_571x.py
# Verifies whether the local PHP runtime falls into the upstream-affected
# ranges for CVE-2018-5711 / CVE-2018-5712.
# Exit codes:
#   0 = PATCHED
#   1 = VULNERABLE
#   2 = UNKNOWN

import os
import re
import sys
import shutil
import subprocess

EXIT_PATCHED = 0
EXIT_VULNERABLE = 1
EXIT_UNKNOWN = 2

AFFECTED = {
    (5, 6): (5, 6, 33),
    (7, 0): (7, 0, 27),
    (7, 1): (7, 1, 13),
    (7, 2): (7, 2, 1),
}

DISTRO_HINTS = ("ubuntu", "deb", "el", "fc", "amzn", "suse", "alpine")


def find_php(argv_path=None):
    if argv_path:
        return argv_path
    php = shutil.which("php")
    return php


def get_php_version(php_bin):
    try:
        out = subprocess.check_output(
            [php_bin, "-r", "echo PHP_VERSION;"],
            stderr=subprocess.STDOUT,
            text=True,
            timeout=10,
        ).strip()
        return out
    except Exception:
        return None


def parse_version(raw):
    if not raw:
        return None
    m = re.search(r"(\d+)\.(\d+)\.(\d+)", raw)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def has_distro_suffix(raw):
    lower = raw.lower()
    if "-" in raw:
        return True
    return any(h in lower for h in DISTRO_HINTS)


def main():
    php_bin = find_php(sys.argv[1] if len(sys.argv) > 1 else None)
    if not php_bin or not os.path.exists(php_bin):
        print("UNKNOWN: php binary not found")
        sys.exit(EXIT_UNKNOWN)

    raw = get_php_version(php_bin)
    parsed = parse_version(raw)

    if not raw or not parsed:
        print("UNKNOWN: unable to determine PHP version")
        sys.exit(EXIT_UNKNOWN)

    major_minor = parsed[:2]

    # Versions newer than the affected upstream trains are considered patched
    # for these specific CVEs.
    if major_minor not in AFFECTED:
        if parsed >= (7, 3, 0):
            print(f"PATCHED: PHP {raw} is outside the affected release trains")
            sys.exit(EXIT_PATCHED)
        else:
            print(f"UNKNOWN: PHP {raw} is outside this script's direct comparison scope")
            sys.exit(EXIT_UNKNOWN)

    fixed = AFFECTED[major_minor]

    # If a distro-style suffix is present on an apparently vulnerable version,
    # treat as UNKNOWN because backports may exist even when the upstream
    # semantic version looks old.
    if parsed < fixed and has_distro_suffix(raw):
        print(
            f"UNKNOWN: PHP {raw} appears older than upstream fix {fixed[0]}.{fixed[1]}.{fixed[2]}, "
            "but distro/backport packaging may apply"
        )
        sys.exit(EXIT_UNKNOWN)

    if parsed < fixed:
        print(
            f"VULNERABLE: PHP {raw} is in an upstream-affected range; fixed at {fixed[0]}.{fixed[1]}.{fixed[2]}"
        )
        sys.exit(EXIT_VULNERABLE)

    print(f"PATCHED: PHP {raw} meets or exceeds upstream fix level {fixed[0]}.{fixed[1]}.{fixed[2]}")
    sys.exit(EXIT_PATCHED)


if __name__ == "__main__":
    main()

Sources

1. Tenable plugin 105771
2. PHP 5.6.33 release announcement
3. PHP 5 changelog entry for 5.6.33
4. NVD CVE-2018-5711
5. NVD CVE-2018-5712
6. Ubuntu USN-3566-1
7. Red Hat RHSA-2018:1296
8. PHP unsupported branches / EOL dates