Most recent entries from all

ALSA-2022:1935 — Moderate: php:7.4 security update

Affected: AlmaLinux:8: apcu-panel, AlmaLinux:8: libzip, AlmaLinux:8: libzip-devel, AlmaLinux:8: libzip-tools, AlmaLinux:8: php, AlmaLinux:8: php-bcmath, AlmaLinux:8: php-cli, AlmaLinux:8: php-common, AlmaLinux:8: php-dba, AlmaLinux:8: php-dbg and 27 more

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fix(es): * php: Local privilege escalation via PHP-FPM (CVE-2021-21703) * php: SSRF bypass in FILTER_VALIDATE_URL (CVE-2021-21705) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

bdu:2021-05228

Withdrawn: BELL-CVE-2021-21703 — CVE-2021-21703 does not affect BellSoft software

Withdrawn by the publisher.

BIT-libphp-2021-21703 — PHP-FPM memory access in root process leading to privilege escalation

Affected: Bitnami: libphp

In PHP versions 7.3.x up to and including 7.3.31, 7.4.x below 7.4.25 and 8.0.x below 8.0.12, when running PHP FPM SAPI with main FPM daemon process running as root and child worker processes running as lower-privileged users, it is possible for the child processes to access memory shared with the main process and write to it, modifying it in a way that would cause the root process to conduct invalid memory reads and writes, which can be used to escalate privileges from local unprivileged user to the root user.

certfr-2021-avi-815 — Une vulnérabilité a été découverte dans PHP 8. Elle permet à un attaquant de provoquer une élévation de privilèges.

certfr-2021-avi-815

EUVD-2026-183087

fkie_cve-2021-21703

FSA-202302 — Festo: Several vulnerabilities in FactoryViews

FactoryViews bundles many third-party applications which are used in background processes to provide the software's features. From time to time, vulnerabilities in these bundled applications are discovered. These are typically fixed in newer versions of FactoryViews by updating the bundled applications.

FactoryViews versions up to and including 1.5.2 contain around 200 such vulnerabilities listed in this advisory.Version 1.6.0 is a security rollup release which includes updates to all bundled applications and fixes these vulnerabilities.

At this time, FactoryViews Lite cannot be updated beyond version 1.1. FactoryViews 1.7 unifies the non-Lite and Lite versions and fixes these vulnerabilities for users of FactoryViews Lite.

GHSA-h8qx-36w6-3rc4

gsd-2021-21703

ICSA-26-027-02 — Festo Didactic SE MES PC

MES PCs shipped with Windows 10 come pre-installed with XAMPP. XAMPP is a bundle of third-party open-source applications including the Apache HTTP Server, the MariaDB database and more. From time to time, vulnerabilities in these applications are discovered. These are fixed in newer versions of XAMPP by updating the bundled applications.

MES PCs shipped with Windows 10 include a copy of XAMPP which contains around 140 such vulnerabilities listed in this advisory. They can be fixed by replacing XAMPP with Festo Didactic's Factory Control Panel application.

msrc_CVE-2021-21703 — PHP-FPM memory access in root process leading to privilege escalation

msrc_CVE-2021-21703

OESA-2021-1430 — php security update

Affected: openEuler:20.03-LTS-SP1: php, openEuler:20.03-LTS-SP2: php

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts. The php package contains the module (often referred to as mod_php) which adds support for the PHP language to Apache HTTP Server. Security Fix(es): In PHP versions 7.3.x up to and including 7.3.31, 7.4.x below 7.4.25 and 8.0.x below 8.0.12, when running PHP FPM SAPI with main FPM daemon process running as root and child worker processes running as lower-privileged users, it is possible for the child processes to access memory shared with the main process and write to it, modifying it in a way that would cause the root process to conduct invalid memory reads and writes, which can be used to escalate privileges from local unprivileged user to the root user.(CVE-2021-21703)

openSUSE-SU-2021:1570-1 — Recommended update for php7

Recommended update for php7

RHSA-2022:5491 — Red Hat Security Advisory: rh-php73-php security and bug fix update

php: Local privilege escalation via PHP-FPM php: Special character breaks path in xml parsing php: Uninitialized array in pg_query_params() leading to RCE php: password of excessive length triggers buffer overflow leading to RCE

SUSE-SU-2021:3726-1 — Security update for php74

Security update for php74

UBUNTU-CVE-2021-21703

Affected: Ubuntu:Pro:14.04:LTS: php5, Ubuntu:Pro:16.04:LTS: php7.0, Ubuntu:18.04:LTS: php7.2, Ubuntu:20.04:LTS: php7.4

WID-SEC-W-2022-0586 — PHP: Schwachstelle ermöglicht Privilegieneskalation

Ein lokaler Angreifer kann eine Schwachstelle in PHP ausnutzen, um seine Privilegien zu erhöhen.