Most recent entries from all

ALSA-2023:5926 — Important: php security update

Affected: AlmaLinux:9: php, AlmaLinux:9: php-bcmath, AlmaLinux:9: php-cli, AlmaLinux:9: php-common, AlmaLinux:9: php-dba, AlmaLinux:9: php-dbg, AlmaLinux:9: php-devel, AlmaLinux:9: php-embedded, AlmaLinux:9: php-enchant, AlmaLinux:9: php-ffi and 15 more

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

Security Fix(es):

* php: XML loading external entity without being enabled (CVE-2023-3823) * php: phar Buffer mismanagement (CVE-2023-3824) * php: 1-byte array overrun in common path resolve code (CVE-2023-0568) * php: DoS vulnerability when parsing multipart request body (CVE-2023-0662) * php: Missing error check and insufficient random bytes in HTTP Digest authentication for SOAP (CVE-2023-3247) * php: Password_verify() always return true with some hash (CVE-2023-0567)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2023-06657

Withdrawn: BELL-CVE-2023-3824 — CVE-2023-3824 does not affect BellSoft software

Withdrawn by the publisher.

BIT-libphp-2023-3824 — Buffer overflow and overread in phar_dir_read()

Affected: Bitnami: libphp

In PHP version 8.0.* before 8.0.30, 8.1.* before 8.1.22, and 8.2.* before 8.2.8, when loading phar file, while reading PHAR directory entries, insufficient length checking may lead to a stack buffer overflow, leading potentially to memory corruption or RCE.

certfr-2023-avi-0621 — De multiples vulnérabilités ont été découvertes dans PHP. Elles permettent à un attaquant de provoquer un problème de s…

certfr-2023-avi-0621

cnvd-2023-64640

EUVD-2026-216653

fkie_cve-2023-3824

gsd-2023-3824

msrc_CVE-2023-3824 — Buffer overflow and overread in phar_dir_read()

msrc_CVE-2023-3824

OESA-2023-1619 — php security update

Affected: openEuler:20.03-LTS-SP1: php

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts. The php package contains the module (often referred to as mod_php) which adds support for the PHP language to Apache HTTP Server. Security Fix(es): A flaw was found in PHP. This issue occurs due to an uncaught integer overflow in PDO::quote() of PDO_SQLite returning an improperly quoted string. With the implementation of sqlite3_snprintf(), it is possible to force the function to return a single apostrophe if the function is called on user-supplied input without any length restrictions in place.(CVE-2022-31631) In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, password_verify() function may accept some invalid Blowfish hashes as valid. If such invalid hash ever ends up in the password database, it may lead to an application allowing any password for this entry as valid.(CVE-2023-0567) In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, core path resolution function allocate buffer one byte too small. When resolving paths with lengths close to system MAXPATHLEN setting, this may lead to the byte after the allocated buffer being overwritte…

openSUSE-SU-2024:13153-1 — php8-8.2.9-1.1 on GA media

php8-8.2.9-1.1 on GA media

SUSE-SU-2023:3445-1 — Security update for php7

Security update for php7

UBUNTU-CVE-2023-3824

Affected: Ubuntu:Pro:14.04:LTS: php5, Ubuntu:Pro:16.04:LTS: php7.0, Ubuntu:Pro:18.04:LTS: php7.2, Ubuntu:20.04:LTS: php7.4, Ubuntu:22.04:LTS: php8.1

WID-SEC-W-2023-1970 — PHP: Mehrere Schwachstellen

Ein entfernter anonymer Angreifer kann mehrere Schwachstellen in PHP ausnutzen, um Informationen offenzulegen oder beliebigen Code auszuführen.