Most recent entries from all

ALSA-2024:10949 — Moderate: php:8.2 security update

Affected: AlmaLinux:9: apcu-panel, AlmaLinux:9: php, AlmaLinux:9: php-bcmath, AlmaLinux:9: php-cli, AlmaLinux:9: php-common, AlmaLinux:9: php-dba, AlmaLinux:9: php-dbg, AlmaLinux:9: php-devel, AlmaLinux:9: php-embedded, AlmaLinux:9: php-enchant and 21 more

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

Security Fix(es):

* php: host/secure cookie bypass due to partial CVE-2022-31629 fix (CVE-2024-2756) * php: password_verify can erroneously return true, opening ATO risk (CVE-2024-3096) * php: Filter bypass in filter_var (FILTER_VALIDATE_URL) (CVE-2024-5458) * php: Erroneous parsing of multipart form data (CVE-2024-8925) * php: cgi.force_redirect configuration is bypassable due to the environment variable collision (CVE-2024-8927) * php: PHP-FPM Log Manipulation Vulnerability (CVE-2024-9026)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2024-07679

BELL-CVE-2024-8927

Affected: Alpaquita:23: php81, Alpaquita:stream: php83

BIT-libphp-2024-8927 — cgi.force_redirect configuration is bypassable due to the environment variable collision

Affected: Bitnami: libphp

In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, HTTP_REDIRECT_STATUS variable is used to check whether or not CGI binary is being run by the HTTP server. However, in certain scenarios, the content of this variable can be controlled by the request submitter via HTTP headers, which can lead to cgi.force_redirect option not being correctly applied. In certain configurations this may lead to arbitrary file inclusion in PHP.

certfr-2024-avi-0818 — De multiples vulnérabilités ont été découvertes dans PHP. Certaines d'entre elles permettent à un attaquant de provoque…

certfr-2024-avi-0818

EUVD-2026-258729

fkie_cve-2024-8927

msrc_CVE-2024-8927 — cgi.force_redirect configuration is bypassable due to the environment variable collision

msrc_CVE-2024-8927

OESA-2024-2248 — php security update

Affected: openEuler:20.03-LTS-SP4: php, openEuler:22.03-LTS-SP1: php, openEuler:24.03-LTS: php, openEuler:22.03-LTS-SP4: php, openEuler:22.03-LTS-SP3: php

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts. %if 1 The php package contains the module (often referred to as mod_php) which adds support for the PHP language to Apache HTTP Server when running in prefork mode. This module is deprecated. %endif Security Fix(es):PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts. The php package contains the module (often referred to as mod_php) which adds support for the PHP language to Apache HTTP Server. Security Fix(es): In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, erroneous parsing of multipart form data contained in an HTTP POST request could lead to legitimate data not being processed. This could lead to malicious attacker able to control part of the submitted data being able to exclude portion of other data, potentially…

openSUSE-SU-2024:14376-1 — php8-8.3.12-1.1 on GA media

php8-8.3.12-1.1 on GA media

SUSE-SU-2024:3664-1 — Security update for php8

Security update for php8

UBUNTU-CVE-2024-8927

Affected: Ubuntu:Pro:14.04:LTS: php5, Ubuntu:Pro:16.04:LTS: php7.0, Ubuntu:Pro:18.04:LTS: php7.2, Ubuntu:20.04:LTS: php7.4, Ubuntu:22.04:LTS: php8.1, Ubuntu:24.04:LTS: php8.3

WID-SEC-W-2024-2230 — PHP: Mehrere Schwachstellen

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in PHP ausnutzen, um beliebigen Programmcode auszuführen, Informationen preiszugeben und andere nicht spezifizierte Angriffe durchzuführen.