PatchFirst · Latest vulnerabilities
Vulnerabilities published for php74 in the last 30 days: 0. Listed in the KEV catalogue: 0.
Vulnerabilities: 20
This update for php74 fixes the following issues: - CVE-2024-8925: Fixed erroneous parsing of multipart form data in HTTP POST requests leads to legitimate data not being processed (bsc#1231360) - CVE-2024-8927: Fixed cgi.force_redirect configuration is bypassable due to an environment variable collision (bsc#1231358) - CVE-2024-9026: Fixed pollution of worker output logs in PHP-FPM (bsc#1231382)
This update for php8 fixes the following issues: - CVE-2024-5458: Fixed an issue that allows to bypass filters in filter_var FILTER_VALIDATE_URL. (bsc#1226073)
This update for php74 fixes the following issues: - CVE-2024-2756: Fixed bypass of security fix applied for CVE-2022-31629 that lead PHP to consider not secure cookies as secure (bsc#1222857) - CVE-2024-3096: Fixed bypass on null byte leading passwords checked via password_verify (bsc#1222858)
This update for php7 fixes the following issues: - CVE-2023-3823: Fixed an issue with external entity loading in XML without enabling it. (bsc#1214106) - CVE-2023-3824: Fixed a buffer overflow in phar_dir_read(). (bsc#1214103)
This update for php74 fixes the following issues: - CVE-2023-3247: Fixed missing error check and insufficient random bytes in HTTP Digest authentication for SOAP (bsc#1212349).
This update for php7 fixes the following issues: - CVE-2022-4900: Fixed potential buffer overflow via PHP_CLI_SERVER_WORKERS environment variable. (bsc#1209537)
This update for php74 fixes the following issues: - CVE-2023-0568: Fixed NULL byte off-by-one in php_check_specific_open_basedir (bnc#1208366). - CVE-2023-0662: Fixed DoS vulnerability when parsing multipart request body (bnc#1208367). - CVE-2023-0567: Fixed vulnerability where BCrypt hashes erroneously validate if the salt is cut short by `$` (bsc#1208388).
This update for php74 fixes the following issues: - CVE-2022-31631: Fixed an issue where PDO::quote would return an unquoted string (bsc#1206958).
This update for php74 fixes the following issues: - Version update to 7.4.33: - CVE-2022-31630: Fixed out-of-bounds read due to insufficient input validation in imageloadfont() (bsc#1204979). - CVE-2022-37454: Fixed buffer overflow in hash_update() on long parameter (bsc#1204577). - Version update to 7.4.32 (jsc#SLE-23639) - CVE-2022-31628: Fixed an uncontrolled recursion in the phar uncompressor while decompressing 'quines' gzip files. (bsc#1203867) - CVE-2022-31629: Fixed a bug which could lead an attacker to set an insecure cookie that will treated as secure in the victim's browser. (bsc#1203870)
This update for php74 fixes the following issues: - CVE-2022-31625: Fixed uninitialized pointers free in Postgres extension. (bsc#1200645) - CVE-2022-31626: Fixed buffer overflow via user-supplied password when using pdo_mysql extension with mysqlnd driver. (bsc#1200628).
This update for php74 fixes the following issues: - Fixed filter_var bypass vulnerability (bsc#1197644).
This update for php74 fixes the following issues: - CVE-2021-21708: Fixed use after free due to php_filter_float() failing for ints (bsc#1196252).
This update for php74 fixes the following issues: - CVE-2017-8923: Fixed denial of service (application crash) when using .= with a long string (zend_string_extend func in Zend/zend_string.h) (bsc#1038980).
This update for php74 fixes the following issues: - CVE-2021-21707: Fixed special character breaks path in xml parsing (bsc#1193041).
This update for php74 fixes the following issues: - CVE-2021-21703: Fixed local privilege escalation via PHP-FPM (bsc#1192050).
This update for php74 fixes the following issues: - CVE-2021-21704: Fixed security issues in pdo_firebase module (bsc#1188035). - CVE-2021-21705: Fixed SSRF bypass in FILTER_VALIDATE_URL (bsc#1188037).
This update for php74 fixes the following issues: - CVE-2021-21702 [bsc#1182049]: NULL pointer dereference in SoapClient
This update for php74 fixes the following issue: - CVE-2020-7071: Fixed an insufficient filter in parse_url() that accepted URLs with invalid userinfo (bsc#1180706).
This update for php74 fixes the following issues: - CVE-2020-7069: Fixed an issue when AES-CCM mode was used with openssl_encrypt() function with 12 bytes IV, only first 7 bytes of the IV was used (bsc#1177351). - CVE-2020-7070: Fixed an issue where percent-encoded cookies could have been used to overwrite existing prefixed cookie names (bsc#1177352). - Added tmpfiles.d for php-fpm to provide a base for a socket (bsc#1173786)
This update for php74 fixes the following issues: - CVE-2020-7068: Use of freed hash key in the phar_parse_zipfile function (bsc#1175223).
Check your installed stack and versions against the current vulnerability feeds.