PatchFirst · Latest vulnerabilities
Vulnerabilities published for php7-fastcgi in the last 30 days: 0. Listed in the KEV catalogue: 0.
Vulnerabilities: 6
This update for php7 fixes the following issues: Security fixes: - CVE-2025-14178: heap buffer overflow occurs in array_merge() when the total element count of packed arrays exceeds 32-bit limits or HT_MAX_SIZE (bsc#1255711). Other fixes: - Add all php7 packages to PackageHUB (unsupported), no source changes. (bsc#1251932)
This update for php7 fixes the following issues: - CVE-2025-1220: Fixed null byte termination in hostnames (bsc#1246167) - CVE-2025-1735: Fixed pgsql extension does not check for errors during escaping (bsc#1246146) - CVE-2025-6491: Fixed NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix (bsc#1246148)
This update for php7 fixes the following issues: - CVE-2024-11235: Fixed reference counting in php_request_shutdown causing Use-After-Free (bsc#1239666) - CVE-2025-1217: Fixed header parser of http stream wrapper not handling folded headers (bsc#1239664) - CVE-2025-1219: Fixed libxml streams using wrong content-type header when requesting a redirected resource (bsc#1239667) - CVE-2025-1734: Fixed streams HTTP wrapper not failing for headers with invalid name and no colon (bsc#1239668) - CVE-2025-1736: Fixed stream HTTP wrapper header check might omitting basic auth header (bsc#1239670) - CVE-2025-1861: Fixed stream HTTP wrapper truncate redi
This update for php7 fixes the following issues: - CVE-2024-11233: Single byte overread with convert.quoted-printable-decode filter (bsc#1233702). - CVE-2024-11234: Configuring a proxy in a stream context might allow for CRLF injection in URIs (bsc#1233703). - CVE-2024-8929: Leak partial content of the heap through heap buffer over-read (bsc#1233651).
This update for php7 fixes the following issues: - CVE-2024-8925: Fixed erroneous parsing of multipart form data in HTTP POST requests leads to legitimate data not being processed (bsc#1231360) - CVE-2024-8927: Fixed cgi.force_redirect configuration is bypassable due to an environment variable collision (bsc#1231358) - CVE-2024-9026: Fixed pollution of worker output logs in PHP-FPM (bsc#1231382)
This update for php8 fixes the following issues: - CVE-2024-5458: Fixed an issue that allows to bypass filters in filter_var FILTER_VALIDATE_URL. (bsc#1226073)
Check your installed stack and versions against the current vulnerability feeds.