Bug 13642

Please patch CVEs for package php version 7.4.19  
INFO (CVEs are): php 7.4.19 cves found
CVE-2017-8923
Desc: The zend_string_extend function in Zend/zend_string.h in PHP through 7.1.5 does not prevent changes to string objects that result in a negative length, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact by leveraging a script's use of .= with a long string.
Link: https://nvd.nist.gov/vuln/detail/CVE-2017-8923
Severity: CRITICAL
CVE-2017-9118
Desc: PHP 7.1.5 has an Out of bounds access in php_pcre_replace_impl via a crafted preg_replace call.
Link: https://nvd.nist.gov/vuln/detail/CVE-2017-9118
Severity: HIGH
CVE-2017-9120
Desc: PHP 7.x through 7.1.5 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a long string because of an Integer overflow in mysqli_real_escape_string.
Link: https://nvd.nist.gov/vuln/detail/CVE-2017-9120
Severity: CRITICAL
CVE-2017-9224
Desc: An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A stack out-of-bounds read occurs in match_at() during regular expression searching. A logical error involving order of validation and access in match_at() could result in an out-of-bounds read from a stack buffer.
Link: https://nvd.nist.gov/vuln/detail/CVE-2017-9224
Severity: CRITICAL
CVE-2017-9226
Desc: An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A heap out-of-bounds write or read occurs in next_state_val() during regular expression compilation. Octal numbers larger than 0xff are not handled correctly in fetch_token() and fetch_token_in_cc(). A malformed regular expression containing an octal number in the form of '\700' would produce an invalid code point value larger than 0xff in next_state_val(), resulting in an out-of-bounds write memory corruption.
Link: https://nvd.nist.gov/vuln/detail/CVE-2017-9226
Severity: CRITICAL
CVE-2017-9227
Desc: An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A stack out-of-bounds read occurs in mbc_enc_len() during regular expression searching. Invalid handling of reg->dmin in forward_search_range() could result in an invalid pointer dereference, as an out-of-bounds read from a stack buffer.
Link: https://nvd.nist.gov/vuln/detail/CVE-2017-9227
Severity: CRITICAL
CVE-2017-9228
Desc: An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A heap out-of-bounds write occurs in bitset_set_range() during regular expression compilation due to an uninitialized variable from an incorrect state transition. An incorrect state transition in parse_char_class() could create an execution path that leaves a critical local variable uninitialized until it's used as an index, resulting in an out-of-bounds write memory corruption.
Link: https://nvd.nist.gov/vuln/detail/CVE-2017-9228
Severity: CRITICAL
CVE-2017-9229
Desc: An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A SIGSEGV occurs in left_adjust_char_head() during regular expression compilation. Invalid handling of reg->dmax in forward_search_range() could result in an invalid pointer dereference, normally as an immediate denial-of-service condition.
Link: https://nvd.nist.gov/vuln/detail/CVE-2017-9229
Severity: HIGH
CVE-2021-21703
Desc: In PHP versions 7.3.x up to and including 7.3.31, 7.4.x below 7.4.25 and 8.0.x below 8.0.12, when running PHP FPM SAPI with main FPM daemon process running as root and child worker processes running as lower-privileged users, it is possible for the child processes to access memory shared with the main process and write to it, modifying it in a way that would cause the root process to conduct invalid memory reads and writes, which can be used to escalate privileges from local unprivileged user to the root user.
Link: https://nvd.nist.gov/vuln/detail/CVE-2021-21703
Severity: HIGH
CVE-2021-21704
Desc: In PHP versions 7.3.x below 7.3.29, 7.4.x below 7.4.21 and 8.0.x below 8.0.8, when using Firebird PDO driver extension, a malicious database server could cause crashes in various database functions, such as getAttribute(), execute(), fetch() and others by returning invalid response data that is not parsed correctly by the driver. This can result in crashes, denial of service or potentially memory corruption.
Link: https://nvd.nist.gov/vuln/detail/CVE-2021-21704
Severity: MEDIUM
CVE-2021-21705
Desc: In PHP versions 7.3.x below 7.3.29, 7.4.x below 7.4.21 and 8.0.x below 8.0.8, when using URL validation functionality via filter_var() function with FILTER_VALIDATE_URL parameter, an URL with invalid password field can be accepted as valid. This can lead to the code incorrectly parsing the URL and potentially leading to other security implications - like contacting a wrong server or making a wrong access decision.
Link: https://nvd.nist.gov/vuln/detail/CVE-2021-21705
Severity: MEDIUM
CVE-2021-21707
Desc: In PHP versions 7.3.x below 7.3.33, 7.4.x below 7.4.26 and 8.0.x below 8.0.13, certain XML parsing functions, like simplexml_load_file(), URL-decode the filename passed to them. If that filename contains URL-encoded NUL character, this may cause the function to interpret this as the end of the filename, thus interpreting the filename differently from what the user intended, which may lead it to reading a different file than intended.
Link: https://nvd.nist.gov/vuln/detail/CVE-2021-21707
Severity: MEDIUM
CVE-2021-21708
Desc: In PHP versions 7.4.x below 7.4.28, 8.0.x below 8.0.16, and 8.1.x below 8.1.3, when using filter functions with FILTER_VALIDATE_FLOAT filter and min/max limits, if the filter fails, there is a possibility to trigger use of allocated memory after free, which can result it crashes, and potentially in overwrite of other memory chunks and RCE. This issue affects: code that uses FILTER_VALIDATE_FLOAT with min/max limits.
Link: https://nvd.nist.gov/vuln/detail/CVE-2021-21708
Severity: CRITICAL
CVE-2022-31625
Desc: In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when using Postgres database extension, supplying invalid parameters to the parametrized query may lead to PHP attempting to free memory using uninitialized data as pointers. This could lead to RCE vulnerability or denial of service.
Link: https://nvd.nist.gov/vuln/detail/CVE-2022-31625
Severity: HIGH
CVE-2022-31626
Desc: In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when pdo_mysql extension with mysqlnd driver, if the third party is allowed to supply host to connect to and the password for the connection, password of excessive length can trigger a buffer overflow in PHP, which can lead to a remote code execution vulnerability.
Link: https://nvd.nist.gov/vuln/detail/CVE-2022-31626
Severity: HIGH
CVE-2022-31628
Desc: In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the phar uncompressor code would recursively uncompress "quines" gzip files, resulting in an infinite loop.
Link: https://nvd.nist.gov/vuln/detail/CVE-2022-31628
Severity: MEDIUM
CVE-2022-31629
Desc: In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the vulnerability enables network and same-site attackers to set a standard insecure cookie in the victim's browser which is treated as a `__Host-` or `__Secure-` cookie by PHP applications.
Link: https://nvd.nist.gov/vuln/detail/CVE-2022-31629
Severity: MEDIUM
CVE-2022-31630
Desc: In PHP versions prior to 7.4.33, 8.0.25 and 8.2.12, when using imageloadfont() function in gd extension, it is possible to supply a specially crafted font file, such as if the loaded font is used with imagechar() function, the read outside allocated buffer will be used. This can lead to crashes or disclosure of confidential information.
Link: https://nvd.nist.gov/vuln/detail/CVE-2022-31630
Severity: HIGH
CVE-2022-37454
Desc: The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute arbitrary code or eliminate expected cryptographic properties. This occurs in the sponge function interface.
Link: https://nvd.nist.gov/vuln/detail/CVE-2022-37454
Severity: CRITICAL