PatchFirst · Latest vulnerabilities
Vulnerabilities published for php8-fpm in the last 30 days: 0. Listed in the KEV catalogue: 0.
Vulnerabilities: 6
This update for php8 fixes the following issues: - CVE-2024-11233: buffer overread when processing input with the convert.quoted-printable-decode filter. (bsc#1233702) - CVE-2024-11234: possible CRLF injection in URIs when a proxy is configured in a stream context. (bsc#1233703) - CVE-2024-8929: data exposure on MySQL clients due to heap buffer overread in mysqlnd. (bsc#1233651)
This update for php8 fixes the following issues: - CVE-2024-8925: Fixed erroneous parsing of multipart form data in HTTP POST requests leads to legitimate data not being processed (bsc#1231360) - CVE-2024-8927: Fixed cgi.force_redirect configuration is bypassable due to an environment variable collision (bsc#1231358) - CVE-2024-9026: Fixed pollution of worker output logs in PHP-FPM (bsc#1231382)
This update for php8 fixes the following issues: - CVE-2024-5458: Fixed an issue that allows to bypass filters in filter_var FILTER_VALIDATE_URL. (bsc#1226073)
This update for php8 fixes the following issues: - CVE-2024-2756: Fixed bypass of security fix applied for CVE-2022-31629 that lead PHP to consider not secure cookies as secure (bsc#1222857) - CVE-2024-3096: Fixed bypass on null byte leading passwords checked via password_verify (bsc#1222858)
This update for php7 fixes the following issues: - CVE-2023-3823: Fixed an issue with external entity loading in XML without enabling it. (bsc#1214106) - CVE-2023-3824: Fixed a buffer overflow in phar_dir_read(). (bsc#1214103)
This update for php8 fixes the following issues: - CVE-2023-3247: Fixed missing error check and insufficient random bytes in HTTP Digest authentication for SOAP (bsc#1212349).
Check your installed stack and versions against the current vulnerability feeds.