Most recent entries from all

ALSA-2022:6158 — Moderate: php:7.4 security update

Affected: AlmaLinux:8: apcu-panel, AlmaLinux:8: libzip, AlmaLinux:8: libzip-devel, AlmaLinux:8: libzip-tools, AlmaLinux:8: php, AlmaLinux:8: php-bcmath, AlmaLinux:8: php-cli, AlmaLinux:8: php-common, AlmaLinux:8: php-dba, AlmaLinux:8: php-dbg and 27 more

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fix(es): * php: uninitialized array in pg_query_params() leading to RCE (CVE-2022-31625) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2022-05351

Withdrawn: BELL-CVE-2022-31625 — CVE-2022-31625 does not affect BellSoft software

Withdrawn by the publisher.

BIT-libphp-2022-31625 — Freeing unallocated memory in php_pgsql_free_params()

Affected: Bitnami: libphp

In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when using Postgres database extension, supplying invalid parameters to the parametrized query may lead to PHP attempting to free memory using uninitialized data as pointers. This could lead to RCE vulnerability or denial of service.

certfr-2022-avi-534 — De multiples vulnérabilités ont été découvertes dans PHP . Elles permettent à un attaquant de provoquer une exécution d…

certfr-2022-avi-534

EUVD-2026-168249

fkie_cve-2022-31625

FSA-202302 — Festo: Several vulnerabilities in FactoryViews

FactoryViews bundles many third-party applications which are used in background processes to provide the software's features. From time to time, vulnerabilities in these bundled applications are discovered. These are typically fixed in newer versions of FactoryViews by updating the bundled applications.

FactoryViews versions up to and including 1.5.2 contain around 200 such vulnerabilities listed in this advisory.Version 1.6.0 is a security rollup release which includes updates to all bundled applications and fixes these vulnerabilities.

At this time, FactoryViews Lite cannot be updated beyond version 1.1. FactoryViews 1.7 unifies the non-Lite and Lite versions and fixes these vulnerabilities for users of FactoryViews Lite.

GHSA-wg63-8xjw-5wvx

gsd-2022-31625

ICSA-26-027-02 — Festo Didactic SE MES PC

MES PCs shipped with Windows 10 come pre-installed with XAMPP. XAMPP is a bundle of third-party open-source applications including the Apache HTTP Server, the MariaDB database and more. From time to time, vulnerabilities in these applications are discovered. These are fixed in newer versions of XAMPP by updating the bundled applications.

MES PCs shipped with Windows 10 include a copy of XAMPP which contains around 140 such vulnerabilities listed in this advisory. They can be fixed by replacing XAMPP with Festo Didactic's Factory Control Panel application.

msrc_CVE-2022-31625 — Freeing unallocated memory in php_pgsql_free_params()

msrc_CVE-2022-31625

OESA-2022-1721 — php security update

Affected: openEuler:20.03-LTS-SP1: php, openEuler:20.03-LTS-SP3: php, openEuler:22.03-LTS: php

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts. The php package contains the module (often referred to as mod_php) which adds support for the PHP language to Apache HTTP Server. Security Fix(es): In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when pdo_mysql extension with mysqlnd driver, if the third party is allowed to supply host to connect to and the password for the connection, password of excessive length can trigger a buffer overflow in PHP, which can lead to a remote code execution vulnerability.(CVE-2022-31626) In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when using Postgres database extension, supplying invalid parameters to the parametrized query may lead to PHP attempting to free memory using uninitialized data as pointers. This could lead to RCE vulnerability or denial of service.(CVE-2022-31625)

openSUSE-SU-2024:13267-1 — php8-8.2.10-3.1 on GA media

php8-8.2.10-3.1 on GA media

RHSA-2022:5491 — Red Hat Security Advisory: rh-php73-php security and bug fix update

php: Local privilege escalation via PHP-FPM php: Special character breaks path in xml parsing php: Uninitialized array in pg_query_params() leading to RCE php: password of excessive length triggers buffer overflow leading to RCE

SUSE-SU-2022:2161-1 — Security update for php74

Security update for php74

UBUNTU-CVE-2022-31625

Affected: Ubuntu:Pro:14.04:LTS: php5, Ubuntu:Pro:16.04:LTS: php7.0, Ubuntu:18.04:LTS: php7.2, Ubuntu:20.04:LTS: php7.4, Ubuntu:22.04:LTS: php8.1

WID-SEC-W-2022-0255 — PHP: Mehrere Schwachstellen ermöglichen Codeausführung

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in PHP ausnutzen, um beliebigen Programmcode auszuführen oder einen Denial of Service Zustand herbeizuführen.