Most recent entries from all

ALSA-2022:7628 — Moderate: php:7.4 security, bug fix, and enhancement update

Affected: AlmaLinux:8: apcu-panel, AlmaLinux:8: libzip, AlmaLinux:8: libzip-devel, AlmaLinux:8: libzip-tools, AlmaLinux:8: php, AlmaLinux:8: php-bcmath, AlmaLinux:8: php-cli, AlmaLinux:8: php-common, AlmaLinux:8: php-dba, AlmaLinux:8: php-dbg and 27 more

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

The following packages have been upgraded to a later upstream version: php (7.4.30), php-pear (1.10.13). (BZ#2055422)

Security Fix(es):

* php: Special character breaks path in xml parsing (CVE-2021-21707) * php: Use after free due to php_filter_float() failing for ints (CVE-2021-21708) * php-pear: Directory traversal vulnerability (CVE-2021-32610)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

bdu:2021-05771

certfr-2021-avi-564 — Une vulnérabilité a été découverte dans Drupal core. Elle permet à un attaquant de provoquer une exécution de code arbi…

certfr-2021-avi-564

CLEANSTART-2024-PW74857 — In Archive_Tar before 1

Affected: CleanStart: drupal7

Security vulnerability affects the drupal7 package. In Archive_Tar before 1.

EUVD-2026-27973

fkie_cve-2021-32610

In Archive_Tar before 1.4.14, symlinks can refer to targets outside of the extracted archive, a different vulnerability than CVE-2020-36193.

GHSA-p8q8-jfcv-g2h2 — Directory Traversal in Archive_Tar

Affected: Packagist: pear/archive_tar

In Archive_Tar before 1.4.14, symlinks can refer to targets outside of the extracted archive, a different vulnerability than CVE-2020-36193.

gsd-2021-32610

openSUSE-SU-2024:11168-1 — php7-pear-1.10.21-1.2 on GA media

php7-pear-1.10.21-1.2 on GA media

SUSE-SU-2022:3198-2 — Security update for php8-pear

Security update for php8-pear

UBUNTU-CVE-2021-32610

Affected: Ubuntu:Pro:14.04:LTS: drupal7, Ubuntu:Pro:16.04:LTS: drupal7, Ubuntu:Pro:16.04:LTS: php-pear, Ubuntu:18.04:LTS: php-pear, Ubuntu:20.04:LTS: php-pear, Ubuntu:22.04:LTS: php-pear

In Archive_Tar before 1.4.14, symlinks can refer to targets outside of the extracted archive, a different vulnerability than CVE-2020-36193.