prod
Bolt 4.1
115 vulnerabilities has been found
5 abandonned packages has been found
Last analyse : 22 hours ago
115
Vulnerabilities
20 affected packages
- Critical 17
- High 32
- Medium 30
- Low 3
- Unrated 1
-
Composer
55
-
Php/php
60
55
Composer
Vulnerabilities
- Critical 0
- High 11
- Medium 10
- Low 2
- Unrated 0
3
api-platform/core
v2.5.10
-
High CVE-2025-31481 Reported 4/4/25GraphQL query operations security can be bypassed
- Affected versions
<4.0.22- Patched versions
4.0.224.0.22
References
-
High CVE-2025-31485 Reported 4/4/25GraphQL grant on a property might be cached with different objects
- Affected versions
<4.0.22- Patched versions
4.0.224.0.22
References
-
Medium CVE-2026-54164 Reported 8/7/26API Platform Core: Relation IRIs are not type-checked: a related resource can be denormalised as the wrong resource type (type confusion)
- Affected versions
>=4.3.0,<4.3.12|>=4.2.0,<4.2.26|<4.1.30- Patched versions
4.1.304.2.264.3.12
References
1
bolt/core
4.1.14
-
High CVE-2021-40219 Reported 4/12/22Code Injection in Bolt CMS
- Affected versions
<=4.2
References
9
composer/composer
2.7.7
-
High CVE-2026-40176 Reported 4/14/26Composer has a command injection via malicious perforce repository
- Affected versions
>=2.0.0,<2.2.27|>=2.3.0,<2.9.6- Patched versions
2.9.62.2.27
References
-
High CVE-2026-40261 Reported 4/14/26Composer has a command injection via malicious perforce reference
- Affected versions
>=2.0.0,<2.2.27|>=2.3.0,<2.9.6- Patched versions
2.9.62.2.27
References
-
High CVE-2026-84361 Reported 9/8/26Composer arbitrary command execution via a malicious package's Perforce source URL
- Affected versions
>=1.0,<2.2.30|>=2.3.0,<2.10.3- Patched versions
2.10.32.2.30
References
-
High CVE-2026-59948 Reported 7/20/26Composer: Arbitrary file write outside vendor via malicious transitive package name
- Affected versions
>=1.0.0,<2.2.29|>=2.3.0,<2.10.2- Patched versions
2.10.22.2.29
References
-
Medium CVE-2026-59947 Reported 7/20/26Composer: URL-embedded HTTP-Basic username leaks to verbose logs (GitHub PAT exposure)
- Affected versions
>=1.0.0,<2.2.29|>=2.3.0,<2.10.2- Patched versions
2.10.22.2.29
References
-
Medium CVE-2026-59944 Reported 10/2/26Composer: GHSA-gjfg-22fp-rrxx fix bypass via symlinked package bin path
- Affected versions
>=1.0,<2.2.30|>=2.3.0,<2.10.3- Patched versions
2.10.32.2.30
References
-
Medium CVE-2026-59946 Reported 7/20/26Composer: Path traversal in package bin field lets dependencies chmod arbitrary host files
- Affected versions
>=1.0.0,<2.2.29|>=2.3.0,<2.10.2- Patched versions
2.10.22.2.29
References
-
Low CVE-2025-67746 Reported 12/30/25Composer is vulnerable to ANSI sequence injection
- Affected versions
>=2.3.0,<2.9.3|>=2.0.0,<2.2.26- Patched versions
2.2.262.9.3
References
-
Unrated Reported 5/13/26Github Actions issued GITHUB_TOKEN disclosure in GitHub Actions logs
- Affected versions
>=2.3,<2.9.8|>=2.0.0,<2.2.28|>=1.0,<1.10.28
References
4
guzzlehttp/psr7
2.7.1
-
Medium CVE-2026-55766 Reported 6/18/26CRLF injection in HTTP start-line serialization
- Affected versions
<2.12.1- Patched versions
2.12.1
References
-
Medium CVE-2026-49214 Reported 6/11/26guzzlehttp/psr7 has CRLF Injection via URI Host Component
- Affected versions
<2.10.2- Patched versions
2.10.2
References
-
Medium CVE-2026-48998 Reported 6/11/26guzzlehttp/psr7 has Host Confusion via Authority Reinterpretation
- Affected versions
<2.10.2- Patched versions
2.10.2
References
-
Medium CVE-2026-59882 Reported 7/21/26guzzlehttp/psr7: Host Confusion via Weak URI Host Validation
- Affected versions
<2.12.3- Patched versions
2.12.3
References
1
league/flysystem
1.1.10
-
Low CVE-2026-102601 Reported 9/29/26Flysystem: WhitespacePathNormalizer's control-character (CorruptedPathDetected) check is bypassed by malformed UTF-8 in the path, affecting every adapter
- Affected versions
<=3.35.2- Patched versions
3.35.3
References
1
symfony/cache
v5.4.46
-
Unrated CVE-2026-45073 Reported 5/20/26CVE-2026-45073: SQL Injection in PdoAdapter::doClear() via Unsanitized $prefix
- Affected versions
>=2.0.0,<3.0.0|>=3.0.0,<4.0.0|>=4.0.0,<5.0.0|>=5.0.0,<5.1.0|>=5.1.0,<5.2.0|>=5.2.0,<5.3.0|>=5.3.0,<5.4.0|>=5.4.0,<5.4.52|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.40|>=7.0.0,<7.1.0|>=7.1.0,<7.2.0|>=7.2.0,<7.3.0|>=7.3.0,<7.4.0|>=7.4.0,<7.4.12|>=8.0.0,<8.0.12
References
1
symfony/expression-language
v5.4.45
-
Unrated CVE-2026-109449 Reported 10/14/26CVE-2026-109449: Unbounded Nesting in the Expression Parser Lets Untrusted Expressions Crash the Process
- Affected versions
>=2.4.0,<3.0.0|>=3.0.0,<4.0.0|>=4.0.0,<5.0.0|>=5.0.0,<5.1.0|>=5.1.0,<5.2.0|>=5.2.0,<5.3.0|>=5.3.0,<5.4.0|>=5.4.0,<5.4.54|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.48|>=7.0.0,<7.1.0|>=7.1.0,<7.2.0|>=7.2.0,<7.3.0|>=7.3.0,<7.4.0|>=7.4.0,<7.4.21|>=8.0.0,<8.1.0|>=8.1.0,<8.1.9
References
1
symfony/http-client
v5.4.49
-
Unrated CVE-2026-48736 Reported 5/26/26CVE-2026-48736: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpClient
- Affected versions
>=5.4.0,<5.4.53
References
2
symfony/http-foundation
v5.4.48
-
High CVE-2025-64500 Reported 11/12/25CVE-2025-64500: Incorrect parsing of PATH_INFO can lead to limited authorization bypass
- Affected versions
>=2.0.0,<3.0.0|>=3.0.0,<4.0.0|>=4.0.0,<5.0.0|>=5.0.0,<5.1.0|>=5.1.0,<5.2.0|>=5.2.0,<5.3.0|>=5.3.0,<5.4.0|>=5.4.0,<5.4.50|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.29|>=7.0.0,<7.1.0|>=7.1.0,<7.2.0|>=7.2.0,<7.3.0|>=7.3.0,<7.3.7- Patched versions
5.4.506.4.297.3.75.4.506.4.297.3.7
References
-
Unrated CVE-2026-108082 Reported 9/15/26CVE-2026-108082: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request Header
- Affected versions
>=5.4.1,<5.4.54|>=6.0.1,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.46|>=7.0.0,<7.1.0|>=7.1.0,<7.2.0|>=7.2.0,<7.3.0|>=7.3.0,<7.4.0|>=7.4.0,<7.4.19|>=8.0.0,<8.1.0|>=8.1.0,<8.1.7
References
1
symfony/mailer
v5.4.45
-
Unrated CVE-2026-45068 Reported 5/20/26CVE-2026-45068: Argument Injection in SendmailTransport via Dash-Prefixed Recipient Address
- Affected versions
>=2.0.0,<3.0.0|>=3.0.0,<4.0.0|>=4.0.0,<5.0.0|>=5.0.0,<5.1.0|>=5.1.0,<5.2.0|>=5.2.0,<5.3.0|>=5.3.0,<5.4.0|>=5.4.0,<5.4.52|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.40|>=7.0.0,<7.1.0|>=7.1.0,<7.2.0|>=7.2.0,<7.3.0|>=7.3.0,<7.4.0|>=7.4.0,<7.4.12|>=8.0.0,<8.0.12
References
2
symfony/mime
v5.4.45
-
Unrated CVE-2026-45067 Reported 5/20/26CVE-2026-45067: Email Header / SMTP Command Injection via CRLF in Symfony\Component\Mime\Address
- Affected versions
>=2.0.0,<3.0.0|>=3.0.0,<4.0.0|>=4.0.0,<5.0.0|>=5.0.0,<5.1.0|>=5.1.0,<5.2.0|>=5.2.0,<5.3.0|>=5.3.0,<5.4.0|>=5.4.0,<5.4.52|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.40|>=7.0.0,<7.1.0|>=7.1.0,<7.2.0|>=7.2.0,<7.3.0|>=7.3.0,<7.4.0|>=7.4.0,<7.4.12|>=8.0.0,<8.0.12
References
-
Unrated CVE-2026-45070 Reported 5/20/26CVE-2026-45070: Email Header Injection via Non-Token Characters in Mime Parameter Names
- Affected versions
>=2.0.0,<3.0.0|>=3.0.0,<4.0.0|>=4.0.0,<5.0.0|>=5.0.0,<5.1.0|>=5.1.0,<5.2.0|>=5.2.0,<5.3.0|>=5.3.0,<5.4.0|>=5.4.0,<5.4.52|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.40|>=7.0.0,<7.1.0|>=7.1.0,<7.2.0|>=7.2.0,<7.3.0|>=7.3.0,<7.4.0|>=7.4.0,<7.4.12|>=8.0.0,<8.0.12
References
1
symfony/monolog-bridge
v5.4.45
-
Unrated CVE-2026-45077 Reported 5/20/26CVE-2026-45077: Unauthenticated PHP Object Deserialization in MonologBridge server:log Listener
- Affected versions
>=2.0.0,<3.0.0|>=3.0.0,<4.0.0|>=4.0.0,<5.0.0|>=5.0.0,<5.1.0|>=5.1.0,<5.2.0|>=5.2.0,<5.3.0|>=5.3.0,<5.4.0|>=5.4.0,<5.4.52|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.40|>=7.0.0,<7.1.0|>=7.1.0,<7.2.0|>=7.2.0,<7.3.0|>=7.3.0,<7.4.0|>=7.4.0,<7.4.12|>=8.0.0,<8.0.12
References
1
symfony/polyfill-intl-idn
v1.31.0
-
Unrated CVE-2026-46644 Reported 5/26/26CVE-2026-46644: symfony/polyfill-intl-idn accepts xn-- labels whose Punycode payload decodes to ASCII-only: insecure equivalence
- Affected versions
>=1.17.1,<1.38.1
References
1
symfony/process
v5.4.47
-
Medium CVE-2026-24739 Reported 1/28/26Symfony's incorrect argument escaping under MSYS2/Git Bash can lead to destructive file operations on Windows
- Affected versions
>=8.0,<8.0.5|>=7.4,<7.4.5|>=7.3,<7.3.11|>=6.4,<6.4.33|<5.4.51- Patched versions
5.4.516.4.337.3.117.4.58.0.55.4.516.4.337.3.117.4.58.0.5
References
2
symfony/routing
v5.4.48
-
Unrated CVE-2026-48784 Reported 5/26/26CVE-2026-48784: UrlGenerator Dot-Segment Encoding Skips Every Other Chained `../` or `./` → Generated URL Collapses Off-Route Under RFC 3986 Normalization
- Affected versions
>=2.0.0,<3.0.0|>=3.0.0,<4.0.0|>=4.0.0,<5.0.0|>=5.0.0,<5.1.0|>=5.1.0,<5.2.0|>=5.2.0,<5.3.0|>=5.3.0,<5.4.0|>=5.4.0,<5.4.53|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.41|>=7.0.0,<7.1.0|>=7.1.0,<7.2.0|>=7.2.0,<7.3.0|>=7.3.0,<7.4.0|>=7.4.0,<7.4.13|>=8.0.0,<8.0.13
References
-
Unrated CVE-2026-45065 Reported 5/20/26CVE-2026-45065: UrlGenerator Route-Requirement Bypass via Unanchored Regex Alternation → Off-Site //host URL Injection
- Affected versions
>=2.0.0,<3.0.0|>=3.0.0,<4.0.0|>=4.0.0,<5.0.0|>=5.0.0,<5.1.0|>=5.1.0,<5.2.0|>=5.2.0,<5.3.0|>=5.3.0,<5.4.0|>=5.4.0,<5.4.52|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.40|>=7.0.0,<7.1.0|>=7.1.0,<7.2.0|>=7.2.0,<7.3.0|>=7.3.0,<7.4.0|>=7.4.0,<7.4.12|>=8.0.0,<8.0.12
References
2
symfony/security-http
v5.4.47
-
Unrated CVE-2026-48489 Reported 5/26/26CVE-2026-48489: Security Firewall Bypass via failure_forward Subrequest: Unauthenticated Access to access_control-Protected GET Routes
- Affected versions
>=2.0.0,<3.0.0|>=3.0.0,<4.0.0|>=4.0.0,<5.0.0|>=5.0.0,<5.1.0|>=5.1.0,<5.2.0|>=5.2.0,<5.3.0|>=5.3.0,<5.4.0|>=5.4.0,<5.4.53|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.41|>=7.0.0,<7.1.0|>=7.1.0,<7.2.0|>=7.2.0,<7.3.0|>=7.3.0,<7.4.0|>=7.4.0,<7.4.13|>=8.0.0,<8.0.13
References
-
Unrated CVE-2026-45063 Reported 5/20/26CVE-2026-45063: Identity Spoofing via Unanchored DN Regex in X509Authenticator
- Affected versions
>=2.0.0,<3.0.0|>=3.0.0,<4.0.0|>=4.0.0,<5.0.0|>=5.0.0,<5.1.0|>=5.1.0,<5.2.0|>=5.2.0,<5.3.0|>=5.3.0,<5.4.0|>=5.4.0,<5.4.52|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.40|>=7.0.0,<7.1.0|>=7.1.0,<7.2.0|>=7.2.0,<7.3.0|>=7.3.0,<7.4.0|>=7.4.0,<7.4.12|>=8.0.0,<8.0.12
References
4
symfony/yaml
v5.4.45
-
Unrated CVE-2026-45133 Reported 5/20/26CVE-2026-45133: YAML Parser Stack Exhaustion via Unbounded Recursion in Nested Blocks, Sequences, and Mappings
- Affected versions
>=2.0.0,<3.0.0|>=3.0.0,<4.0.0|>=4.0.0,<5.0.0|>=5.0.0,<5.1.0|>=5.1.0,<5.2.0|>=5.2.0,<5.3.0|>=5.3.0,<5.4.0|>=5.4.0,<5.4.52|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.40|>=7.0.0,<7.1.0|>=7.1.0,<7.2.0|>=7.2.0,<7.3.0|>=7.3.0,<7.4.0|>=7.4.0,<7.4.12|>=8.0.0,<8.0.12
References
-
Unrated CVE-2026-45305 Reported 5/20/26CVE-2026-45305: YAML Parser ReDoS via Catastrophic Backtracking in Parser::cleanup() Regex
- Affected versions
>=2.0.0,<3.0.0|>=3.0.0,<4.0.0|>=4.0.0,<5.0.0|>=5.0.0,<5.1.0|>=5.1.0,<5.2.0|>=5.2.0,<5.3.0|>=5.3.0,<5.4.0|>=5.4.0,<5.4.52|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.40|>=7.0.0,<7.1.0|>=7.1.0,<7.2.0|>=7.2.0,<7.3.0|>=7.3.0,<7.4.0|>=7.4.0,<7.4.12|>=8.0.0,<8.0.12
References
-
Unrated CVE-2026-45304 Reported 5/20/26CVE-2026-45304: YAML Parser Exponential Memory Allocation via Recursive Collection-Alias Expansion ("Billion Laughs")
- Affected versions
>=2.0.0,<3.0.0|>=3.0.0,<4.0.0|>=4.0.0,<5.0.0|>=5.0.0,<5.1.0|>=5.1.0,<5.2.0|>=5.2.0,<5.3.0|>=5.3.0,<5.4.0|>=5.4.0,<5.4.52|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.40|>=7.0.0,<7.1.0|>=7.1.0,<7.2.0|>=7.2.0,<7.3.0|>=7.3.0,<7.4.0|>=7.4.0,<7.4.12|>=8.0.0,<8.0.12
References
-
Unrated CVE-2026-109413 Reported 8/30/26CVE-2026-109413: Unbounded Recursion in the YAML Inline Lexer Lets a Single Document Crash the Process
- Affected versions
>=2.0.0,<3.0.0|>=3.0.0,<4.0.0|>=4.0.0,<5.0.0|>=5.0.0,<5.1.0|>=5.1.0,<5.2.0|>=5.2.0,<5.3.0|>=5.3.0,<5.4.0|>=5.4.0,<5.4.54|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.45|>=7.0.0,<7.1.0|>=7.1.0,<7.2.0|>=7.2.0,<7.3.0|>=7.3.0,<7.4.0|>=7.4.0,<7.4.18|>=8.0.0,<8.1.0|>=8.1.0,<8.1.6
References
15
twig/twig
v3.11.3
-
High CVE-2026-49981 Reported 7/1/26Twig: Sandbox filter, tag and function allow-list bypass when sandbox state changes between renders for a cached `Template`
- Affected versions
<=3.26.0- Patched versions
3.27.0
References
-
Unrated CVE-2026-48806 Reported 5/27/26Sandbox `__toString()` policy bypass via dynamic mapping keys
- Affected versions
>=1.0.0,<2.0.0|>=2.0.0,<3.0.0|>=3.0.0,<3.27.0
References
-
Unrated CVE-2026-46634 Reported 5/20/26`template_from_string()` escapes a SourcePolicy-driven sandbox via synthesized template name
- Affected versions
>=3.9.0,<3.26.0
References
-
Unrated CVE-2026-46638 Reported 5/20/26`{% sandbox %}{% include %}` skips checkSecurity() on cached templates (incomplete fix for CVE-2024-45411)
- Affected versions
>=1.0.0,<2.0.0|>=2.0.0,<3.0.0|>=3.0.0,<3.26.0
References
-
Unrated CVE-2026-47732 Reported 5/20/26Sandbox: multiple `__toString()` policy bypasses via unguarded string coercion points
- Affected versions
>=1.0.0,<2.0.0|>=2.0.0,<3.0.0|>=3.0.0,<3.26.0
References
-
Unrated CVE-2026-48808 Reported 5/27/26Sandbox property allowlist bypass via the `column` filter under `SourcePolicyInterface`
- Affected versions
>=1.0.0,<2.0.0|>=2.0.0,<3.0.0|>=3.0.0,<3.27.0
References
-
Unrated CVE-2026-48805 Reported 5/27/26Sandbox state regression in deprecated internal wrappers in `src/Resources/core.php`
- Affected versions
>=1.0.0,<2.0.0|>=2.0.0,<3.0.0|>=3.0.0,<3.27.0
References
-
Unrated CVE-2026-24425 Reported 5/20/26Possible sandbox bypass when using a source policy
- Affected versions
>=2.16.0,<3.0.0|>=3.9.0,<3.26.0
References
-
Unrated CVE-2026-46633 Reported 5/20/26PHP code injection via `{% use %}` template name
- Affected versions
>=1.0.0,<2.0.0|>=2.0.0,<3.0.0|>=3.0.0,<3.26.0
References
-
Unrated CVE-2026-46627 Reported 5/20/26Sandbox does not protect against resource exhaustion
- Affected versions
>=1.0.0,<2.0.0|>=2.0.0,<3.0.0|>=3.0.0,<3.26.0
References
-
Unrated CVE-2026-46635 Reported 5/20/26Sandbox property allowlist bypass via the `column` filter (array_column on objects)
- Affected versions
>=1.0.0,<2.0.0|>=2.0.0,<3.0.0|>=3.0.0,<3.26.0
References
-
Unrated CVE-2026-46628 Reported 5/20/26The `spaceless` filter implicitly marks its output as safe
- Affected versions
>=1.0.0,<2.0.0|>=2.0.0,<3.0.0|>=3.0.0,<3.26.0
References
-
Unrated CVE-2026-47730 Reported 5/20/26XSS in profiler HtmlDumper via unescaped template and profile names
- Affected versions
>=3.0.0,<3.26.0
References
-
Unrated CVE-2026-48807 Reported 5/27/26Sandbox `__toString()` policy bypass via `Traversable` in `join`/`replace` and `in`/`not in` operators
- Affected versions
>=1.0.0,<2.0.0|>=2.0.0,<3.0.0|>=3.0.0,<3.27.0
References
-
Unrated CVE-2026-46636 Reported 5/27/26Sandbox filter, tag and function allow-list bypass when sandbox state changes between renders
- Affected versions
>=1.0.0,<2.0.0|>=2.0.0,<3.0.0|>=3.0.0,<3.27.0
References
3
webonyx/graphql-php
v0.13.9
-
High Reported 5/4/26webonyx/graphql-php has quadratic validation cost in OverlappingFieldsCanBeMerged via inline fragments
- Affected versions
<15.32.2- Patched versions
15.32.2
References
-
High Reported 5/5/26webonyx/graphql-php has unbounded recursion in parser that causes stack overflow on crafted nested input
- Affected versions
<=15.32.2- Patched versions
15.32.3
References
-
Medium Reported 4/14/26graphql-php is affected by a Denial of Service via quadratic complexity in OverlappingFieldsCanBeMerged validation
- Affected versions
<=15.31.4- Patched versions
15.31.5
References
60
Php/php
Vulnerabilities
- Critical 17
- High 21
- Medium 20
- Low 1
- Unrated 1
60
php/php
7.2
-
Critical CVE-2015-8866 Reported 5/22/16ext/libxml/libxml.c in PHP before 5.5.22 and 5.6.x before 5.6.6, when PHP-FPM is used, does not isolate each thread from libxml_disable_entity_loader changes in other threads, which allows remote attackers to conduct XML External Entity (XXE) and XML Entity Expansion (XEE) attacks via a crafted XML document, a related issue to CVE-2015-5161.
References
- www.openwall.com /lists/oss-security/2016/04/24/1
- www.php.net /ChangeLog-5.php
- bugs.launchpad.net /ubuntu/+source/php5/+bug/1509817
- bugs.php.net /bug.php?id=64938
- www.securityfocus.com /bid/87470
- lists.opensuse.org /opensuse-security-announce/2016-05/msg00031.html
- lists.opensuse.org /opensuse-security-announce/2016-05/msg00033.html
- www.ubuntu.com /usn/USN-2952-1
- www.ubuntu.com /usn/USN-2952-2
- lists.opensuse.org /opensuse-security-announce/2016-05/msg00056.html
- rhn.redhat.com /errata/RHSA-2016-2750.html
- git.php.net /?p=php-src.git%3Ba=commit%3Bh=de31324c221c1791b26350ba106cc26bad23ace9
-
Critical CVE-2017-8923 Reported 5/12/17The zend_string_extend function in Zend/zend_string.h in PHP through 7.1.5 does not prevent changes to string objects that result in a negative length, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact by leveraging a script's use of .= with a long string.
References
-
Critical CVE-2018-12882 Reported 6/26/18exif_read_from_impl in ext/exif/exif.c in PHP 7.2.x through 7.2.7 allows attackers to trigger a use-after-free (in exif_read_from_file) because it closes a stream that it is not responsible for closing. The vulnerable code is reachable through the PHP exif_read_data function.
References
-
Critical CVE-2018-7584 Reported 3/1/18In PHP through 5.6.33, 7.0.x before 7.0.28, 7.1.x through 7.1.14, and 7.2.x through 7.2.2, there is a stack-based buffer under-read while parsing an HTTP response in the php_stream_url_wrap_http_ex function in ext/standard/http_fopen_wrapper.c. This subsequently results in copying a large string.
References
- github.com /php/php-src/commit/523f230c831d7b33353203fa34aee4e92ac12bba
- bugs.php.net /bug.php?id=75981
- php.net /ChangeLog-7.php
- www.securityfocus.com /bid/103204
- usn.ubuntu.com /3600-1/
- lists.debian.org /debian-lts-announce/2018/03/msg00030.html
- www.tenable.com /security/tns-2018-03
- usn.ubuntu.com /3600-2/
- www.exploit-db.com /exploits/44846/
- lists.debian.org /debian-lts-announce/2018/06/msg00005.html
- www.debian.org /security/2018/dsa-4240
- www.securitytracker.com /id/1041607
- www.tenable.com /security/tns-2018-12
- access.redhat.com /errata/RHSA-2019:2519
-
Critical CVE-2019-11036 Reported 5/3/19When processing certain files, PHP EXIF extension in versions 7.1.x below 7.1.29, 7.2.x below 7.2.18 and 7.3.x below 7.3.5 can be caused to read past allocated buffer in exif_process_IFD_TAG function. This may lead to information disclosure or crash.
References
- bugs.php.net /bug.php?id=77950
- www.securityfocus.com /bid/108177
- security.netapp.com /advisory/ntap-20190517-0003/
- usn.ubuntu.com /3566-2/
- lists.debian.org /debian-lts-announce/2019/05/msg00035.html
- lists.opensuse.org /opensuse-security-announce/2019-06/msg00012.html
- lists.opensuse.org /opensuse-security-announce/2019-06/msg00010.html
- usn.ubuntu.com /4009-1/
- lists.opensuse.org /opensuse-security-announce/2019-06/msg00041.html
- lists.opensuse.org /opensuse-security-announce/2019-06/msg00044.html
- access.redhat.com /errata/RHSA-2019:2519
- seclists.org /bugtraq/2019/Sep/35
- www.debian.org /security/2019/dsa-4527
- seclists.org /bugtraq/2019/Sep/38
- www.debian.org /security/2019/dsa-4529
- access.redhat.com /errata/RHSA-2019:3299
- lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/3BY2XUUAN277LS7HKAOGL4DVGAELOJV3/
- lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/2NFXYNCXZCPYT7ZN4ZLI5EPQQW44FRRO/
- lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/WN2HLPGEZEF4MFM5YC5FILZB5QEQFP3A/
-
Critical CVE-2019-11039 Reported 6/19/19Function iconv_mime_decode_headers() in PHP versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and 7.3.x below 7.3.6 may perform out-of-buffer read due to integer overflow when parsing MIME headers. This may lead to information disclosure or crash.
References
- bugs.php.net /bug.php?id=78069
- lists.opensuse.org /opensuse-security-announce/2019-07/msg00029.html
- access.redhat.com /errata/RHSA-2019:2519
- seclists.org /bugtraq/2019/Sep/35
- www.debian.org /security/2019/dsa-4527
- seclists.org /bugtraq/2019/Sep/38
- www.debian.org /security/2019/dsa-4529
- access.redhat.com /errata/RHSA-2019:3299
-
Critical CVE-2019-11040 Reported 6/19/19When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and 7.3.x below 7.3.6 it is possible to supply it with data what will cause it to read past the allocated buffer. This may lead to information disclosure or crash.
References
- bugs.php.net /bug.php?id=77988
- lists.opensuse.org /opensuse-security-announce/2019-07/msg00029.html
- access.redhat.com /errata/RHSA-2019:2519
- seclists.org /bugtraq/2019/Sep/35
- www.debian.org /security/2019/dsa-4527
- seclists.org /bugtraq/2019/Sep/38
- www.debian.org /security/2019/dsa-4529
- access.redhat.com /errata/RHSA-2019:3299
-
Critical CVE-2019-11043 Reported 10/28/19In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for FCGI protocol data, thus opening the possibility of remote code execution.
References
- github.com /neex/phuip-fpizdam
- bugs.php.net /bug.php?id=78599
- usn.ubuntu.com /4166-1/
- usn.ubuntu.com /4166-2/
- www.debian.org /security/2019/dsa-4553
- www.debian.org /security/2019/dsa-4552
- security.netapp.com /advisory/ntap-20191031-0003/
- access.redhat.com /errata/RHSA-2019:3287
- access.redhat.com /errata/RHSA-2019:3286
- access.redhat.com /errata/RHSA-2019:3299
- access.redhat.com /errata/RHSA-2019:3300
- lists.opensuse.org /opensuse-security-announce/2019-11/msg00011.html
- access.redhat.com /errata/RHSA-2019:3724
- access.redhat.com /errata/RHSA-2019:3735
- access.redhat.com /errata/RHSA-2019:3736
- www.synology.com /security/advisory/Synology_SA_19_36
- lists.opensuse.org /opensuse-security-announce/2019-11/msg00014.html
- support.apple.com /kb/HT210919
- seclists.org /bugtraq/2020/Jan/44
- seclists.org /fulldisclosure/2020/Jan/40
- access.redhat.com /errata/RHSA-2020:0322
- packetstormsecurity.com /files/156642/PHP-FPM-7.x-Remote-Code-Execution.html
- www.tenable.com /security/tns-2021-14
- support.f5.com /csp/article/K75408500?utm_source=f5support&%3Butm_medium=RSS
- lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/T62LF4ZWVV7OMMIZFO6IFO5QLZKK7YRD/
- lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/3W23TP6X4H7LB645FYZLUPNIRD5W3EPU/
- lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/FSNBUSPKMLUHHOADROKNG5GDWDCRHT5M/
-
Critical CVE-2019-13224 Reported 7/10/19A use-after-free in onig_new_deluxe() in regext.c in Oniguruma 6.9.2 allows attackers to potentially cause information disclosure, denial of service, or possibly code execution by providing a crafted regular expression. The attacker provides a pair of a regex pattern and a string, with a multi-byte encoding that gets handled by onig_new_deluxe(). Oniguruma issues often affect Ruby, as well as common optional libraries for PHP and Rust.
References
- github.com /kkos/oniguruma/commit/0f7f61ed1b7b697e283e37bd2d731d0bd57adb55
- lists.debian.org /debian-lts-announce/2019/07/msg00013.html
- usn.ubuntu.com /4088-1/
- support.f5.com /csp/article/K00103182
- security.gentoo.org /glsa/201911-03
- lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/SNL26OZSQRVLEO6JRNUVIMZTICXBNEQW/
- lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/JWCPDTZOIUKGMFAD5NAKUB7FPJFAIQN5/
- support.f5.com /csp/article/K00103182?utm_source=f5support&%3Butm_medium=RSS
-
Critical CVE-2019-9020 Reported 2/22/19An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. Invalid input to the function xmlrpc_decode() can lead to an invalid memory access (heap out of bounds read or read after free). This is related to xml_elem_parse_buf in ext/xmlrpc/libxmlrpc/xml_element.c.
References
- bugs.php.net /bug.php?id=77249
- bugs.php.net /bug.php?id=77242
- www.securityfocus.com /bid/107156
- www.debian.org /security/2019/dsa-4398
- usn.ubuntu.com /3902-1/
- usn.ubuntu.com /3902-2/
- security.netapp.com /advisory/ntap-20190321-0001/
- lists.opensuse.org /opensuse-security-announce/2019-04/msg00083.html
- lists.opensuse.org /opensuse-security-announce/2019-04/msg00104.html
- lists.opensuse.org /opensuse-security-announce/2019-06/msg00041.html
- lists.opensuse.org /opensuse-security-announce/2019-06/msg00044.html
- access.redhat.com /errata/RHSA-2019:2519
- access.redhat.com /errata/RHSA-2019:3299
-
Critical CVE-2019-9021 Reported 2/22/19An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. A heap-based buffer over-read in PHAR reading functions in the PHAR extension may allow an attacker to read allocated or unallocated memory past the actual data when trying to parse the file name, a different vulnerability than CVE-2018-20783. This is related to phar_detect_phar_fname_ext in ext/phar/phar.c.
References
- bugs.php.net /bug.php?id=77247
- www.securityfocus.com /bid/107156
- www.securityfocus.com /bid/106747
- www.debian.org /security/2019/dsa-4398
- usn.ubuntu.com /3902-1/
- usn.ubuntu.com /3902-2/
- security.netapp.com /advisory/ntap-20190321-0001/
- lists.opensuse.org /opensuse-security-announce/2019-04/msg00083.html
- lists.opensuse.org /opensuse-security-announce/2019-04/msg00104.html
- lists.opensuse.org /opensuse-security-announce/2019-06/msg00041.html
- lists.opensuse.org /opensuse-security-announce/2019-06/msg00044.html
- access.redhat.com /errata/RHSA-2019:2519
- access.redhat.com /errata/RHSA-2019:3299
-
Critical CVE-2019-9023 Reported 2/22/19An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. A number of heap-based buffer over-read instances are present in mbstring regular expression functions when supplied with invalid multibyte data. These occur in ext/mbstring/oniguruma/regcomp.c, ext/mbstring/oniguruma/regexec.c, ext/mbstring/oniguruma/regparse.c, ext/mbstring/oniguruma/enc/unicode.c, and ext/mbstring/oniguruma/src/utf32_be.c when a multibyte regular expression pattern contains invalid multibyte sequences.
References
- bugs.php.net /bug.php?id=77418
- bugs.php.net /bug.php?id=77394
- bugs.php.net /bug.php?id=77385
- bugs.php.net /bug.php?id=77382
- bugs.php.net /bug.php?id=77381
- bugs.php.net /bug.php?id=77371
- bugs.php.net /bug.php?id=77370
- www.securityfocus.com /bid/107156
- www.debian.org /security/2019/dsa-4398
- usn.ubuntu.com /3902-1/
- usn.ubuntu.com /3902-2/
- security.netapp.com /advisory/ntap-20190321-0001/
- support.f5.com /csp/article/K06372014
- lists.opensuse.org /opensuse-security-announce/2019-04/msg00083.html
- lists.opensuse.org /opensuse-security-announce/2019-04/msg00104.html
- lists.opensuse.org /opensuse-security-announce/2019-06/msg00041.html
- lists.opensuse.org /opensuse-security-announce/2019-06/msg00044.html
- access.redhat.com /errata/RHSA-2019:2519
- access.redhat.com /errata/RHSA-2019:3299
-
Critical CVE-2019-9641 Reported 3/9/19An issue was discovered in the EXIF component in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. There is an uninitialized read in exif_process_IFD_in_TIFF.
References
- bugs.php.net /bug.php?id=77509
- www.debian.org /security/2019/dsa-4403
- usn.ubuntu.com /3922-1/
- lists.debian.org /debian-lts-announce/2019/03/msg00043.html
- usn.ubuntu.com /3922-2/
- lists.opensuse.org /opensuse-security-announce/2019-04/msg00083.html
- usn.ubuntu.com /3922-3/
- lists.opensuse.org /opensuse-security-announce/2019-04/msg00104.html
- security.netapp.com /advisory/ntap-20190502-0007/
- lists.opensuse.org /opensuse-security-announce/2019-06/msg00041.html
- lists.opensuse.org /opensuse-security-announce/2019-06/msg00044.html
-
Critical CVE-2020-7059 Reported 2/10/20When using fgetss() function to read data with stripping tags, in PHP versions 7.2.x below 7.2.27, 7.3.x below 7.3.14 and 7.4.x below 7.4.2 it is possible to supply data that will cause this function to read past the allocated buffer. This may lead to information disclosure or crash.
References
- bugs.php.net /bug.php?id=79099
- seclists.org /bugtraq/2020/Feb/27
- www.debian.org /security/2020/dsa-4626
- usn.ubuntu.com /4279-1/
- seclists.org /bugtraq/2020/Feb/31
- www.debian.org /security/2020/dsa-4628
- security.netapp.com /advisory/ntap-20200221-0002/
- lists.debian.org /debian-lts-announce/2020/02/msg00030.html
- lists.opensuse.org /opensuse-security-announce/2020-03/msg00023.html
- security.gentoo.org /glsa/202003-57
- www.oracle.com /security-alerts/cpujul2020.html
- seclists.org /bugtraq/2021/Jan/3
- www.oracle.com /security-alerts/cpuApr2021.html
- www.tenable.com /security/tns-2021-14
-
Critical CVE-2020-7060 Reported 2/10/20When using certain mbstring functions to convert multibyte encodings, in PHP versions 7.2.x below 7.2.27, 7.3.x below 7.3.14 and 7.4.x below 7.4.2 it is possible to supply data that will cause function mbfl_filt_conv_big5_wchar to read past the allocated buffer. This may lead to information disclosure or crash.
References
- bugs.php.net /bug.php?id=79037
- seclists.org /bugtraq/2020/Feb/27
- www.debian.org /security/2020/dsa-4626
- usn.ubuntu.com /4279-1/
- seclists.org /bugtraq/2020/Feb/31
- www.debian.org /security/2020/dsa-4628
- security.netapp.com /advisory/ntap-20200221-0002/
- lists.debian.org /debian-lts-announce/2020/02/msg00030.html
- lists.opensuse.org /opensuse-security-announce/2020-03/msg00023.html
- security.gentoo.org /glsa/202003-57
- www.oracle.com /security-alerts/cpujul2020.html
- seclists.org /bugtraq/2021/Jan/3
- www.oracle.com /security-alerts/cpuApr2021.html
- www.tenable.com /security/tns-2021-14
-
Critical CVE-2020-7061 Reported 2/27/20In PHP versions 7.3.x below 7.3.15 and 7.4.x below 7.4.3, while extracting PHAR files on Windows using phar extension, certain content inside PHAR file could lead to one-byte read past the allocated buffer. This could potentially lead to information disclosure or crash.
References
-
Critical CVE-2022-37454 Reported 10/21/22The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute arbitrary code or eliminate expected cryptographic properties. This occurs in the sponge function interface.
References
- news.ycombinator.com /item?id=33281106
- csrc.nist.gov /projects/hash-functions/sha-3-project
- mouha.be /sha-3-buffer-overflow/
- github.com /XKCP/XKCP/security/advisories/GHSA-6w4m-2xhg-2658
- lists.debian.org /debian-lts-announce/2022/10/msg00041.html
- lists.debian.org /debian-lts-announce/2022/11/msg00000.html
- www.debian.org /security/2022/dsa-5267
- www.debian.org /security/2022/dsa-5269
- lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/CMIEXLMTW5GO36HTFFWIPB3OHZXCT3G4/
- lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/3ALQ6BDDPX5HU5YBQOBMDVAA2TSGDKIJ/
- eprint.iacr.org /2023/331
- news.ycombinator.com /item?id=35050307
- security.gentoo.org /glsa/202305-02
-
High CVE-2018-10546 Reported 4/29/18An issue was discovered in PHP before 5.6.36, 7.0.x before 7.0.30, 7.1.x before 7.1.17, and 7.2.x before 7.2.5. An infinite loop exists in ext/iconv/iconv.c because the iconv stream filter does not reject invalid multibyte sequences.
References
- bugs.php.net /bug.php?id=76249
- php.net /ChangeLog-7.php
- php.net /ChangeLog-5.php
- www.securityfocus.com /bid/104019
- www.securitytracker.com /id/1040807
- usn.ubuntu.com /3646-1/
- security.netapp.com /advisory/ntap-20180607-0003/
- lists.debian.org /debian-lts-announce/2018/06/msg00005.html
- www.debian.org /security/2018/dsa-4240
- www.tenable.com /security/tns-2018-12
- security.gentoo.org /glsa/201812-01
- access.redhat.com /errata/RHSA-2019:2519
-
High CVE-2018-10548 Reported 4/29/18An issue was discovered in PHP before 5.6.36, 7.0.x before 7.0.30, 7.1.x before 7.1.17, and 7.2.x before 7.2.5. ext/ldap/ldap.c allows remote LDAP servers to cause a denial of service (NULL pointer dereference and application crash) because of mishandling of the ldap_get_dn return value.
References
- bugs.php.net /bug.php?id=76248
- php.net /ChangeLog-7.php
- php.net /ChangeLog-5.php
- www.securityfocus.com /bid/104019
- www.securitytracker.com /id/1040807
- lists.debian.org /debian-lts-announce/2018/05/msg00004.html
- usn.ubuntu.com /3646-1/
- usn.ubuntu.com /3646-2/
- security.netapp.com /advisory/ntap-20180607-0003/
- lists.debian.org /debian-lts-announce/2018/06/msg00005.html
- www.debian.org /security/2018/dsa-4240
- www.tenable.com /security/tns-2018-12
- security.gentoo.org /glsa/201812-01
- access.redhat.com /errata/RHSA-2019:2519
- www.tenable.com /security/tns-2019-07
-
High CVE-2018-10549 Reported 4/29/18An issue was discovered in PHP before 5.6.36, 7.0.x before 7.0.30, 7.1.x before 7.1.17, and 7.2.x before 7.2.5. exif_read_data in ext/exif/exif.c has an out-of-bounds read for crafted JPEG data because exif_iif_add_value mishandles the case of a MakerNote that lacks a final '\0' character.
References
- bugs.php.net /bug.php?id=76130
- php.net /ChangeLog-7.php
- php.net /ChangeLog-5.php
- www.securityfocus.com /bid/104019
- www.synology.com /support/security/Synology_SA_18_20
- www.securitytracker.com /id/1040807
- usn.ubuntu.com /3646-1/
- security.netapp.com /advisory/ntap-20180607-0003/
- lists.debian.org /debian-lts-announce/2018/06/msg00005.html
- www.debian.org /security/2018/dsa-4240
- www.tenable.com /security/tns-2018-12
- security.gentoo.org /glsa/201812-01
- access.redhat.com /errata/RHSA-2019:2519
-
High CVE-2018-14883 Reported 8/3/18An issue was discovered in PHP before 5.6.37, 7.0.x before 7.0.31, 7.1.x before 7.1.20, and 7.2.x before 7.2.8. An Integer Overflow leads to a heap-based buffer over-read in exif_thumbnail_extract of exif.c.
References
- bugs.php.net /bug.php?id=76423
- php.net /ChangeLog-7.php
- php.net /ChangeLog-5.php
- lists.debian.org /debian-lts-announce/2018/09/msg00000.html
- usn.ubuntu.com /3766-1/
- www.tenable.com /security/tns-2018-12
- usn.ubuntu.com /3766-2/
- www.securityfocus.com /bid/104871
- security.netapp.com /advisory/ntap-20181107-0003/
- www.debian.org /security/2018/dsa-4353
-
High CVE-2018-14884 Reported 8/3/18An issue was discovered in PHP 7.0.x before 7.0.27, 7.1.x before 7.1.13, and 7.2.x before 7.2.1. Inappropriately parsing an HTTP response leads to a segmentation fault because http_header_value in ext/standard/http_fopen_wrapper.c can be a NULL value that is mishandled in an atoi call.
References
-
High CVE-2018-15132 Reported 8/7/18An issue was discovered in ext/standard/link_win32.c in PHP before 5.6.37, 7.0.x before 7.0.31, 7.1.x before 7.1.20, and 7.2.x before 7.2.8. The linkinfo function on Windows doesn't implement the open_basedir check. This could be abused to find files on paths outside of the allowed directories.
References
-
High CVE-2018-19518 Reported 11/25/18University of Washington IMAP Toolkit 2007f on UNIX, as used in imap_open() in PHP and other products, launches an rsh command (by means of the imap_rimap function in c-client/imap4r1.c and the tcp_aopen function in osdep/unix/tcp_unix.c) without preventing argument injection, which might allow remote attackers to execute arbitrary OS commands if the IMAP server name is untrusted input (e.g., entered by a user of a web application) and if rsh has been replaced by a program with different argument semantics. For example, if rsh is a link to ssh (as seen on Debian and Ubuntu systems), then the attack can use an IMAP server name containing a "-oProxyCommand" argument.
References
- www.openwall.com /lists/oss-security/2018/11/22/3
- github.com /Bo0oM/PHP_imap_open_exploit/blob/master/exploit.php
- bugs.php.net /bug.php?id=77160
- bugs.php.net /bug.php?id=77153
- bugs.php.net /bug.php?id=76428
- bugs.debian.org /913836
- bugs.debian.org /913835
- bugs.debian.org /913775
- antichat.com /threads/463395/#post-4254681
- www.securitytracker.com /id/1042157
- www.securityfocus.com /bid/106018
- www.exploit-db.com /exploits/45914/
- www.debian.org /security/2018/dsa-4353
- lists.debian.org /debian-lts-announce/2018/12/msg00006.html
- security.netapp.com /advisory/ntap-20181221-0004/
- lists.debian.org /debian-lts-announce/2019/03/msg00001.html
- usn.ubuntu.com /4160-1/
- security.gentoo.org /glsa/202003-57
- lists.debian.org /debian-lts-announce/2021/12/msg00031.html
- git.php.net /?p=php-src.git%3Ba=commit%3Bh=e5bfea64c81ae34816479bb05d17cdffe45adddb
-
High CVE-2018-19935 Reported 12/7/18ext/imap/php_imap.c in PHP 5.x and 7.x before 7.3.0 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an empty string in the message argument to the imap_mail function.
References
- bugs.php.net /bug.php?id=77020
- www.securityfocus.com /bid/106143
- www.debian.org /security/2018/dsa-4353
- lists.debian.org /debian-lts-announce/2018/12/msg00006.html
- security.netapp.com /advisory/ntap-20181221-0003/
- lists.opensuse.org /opensuse-security-announce/2019-06/msg00041.html
- lists.opensuse.org /opensuse-security-announce/2019-06/msg00044.html
-
High CVE-2018-20783 Reported 2/21/19In PHP before 5.6.39, 7.x before 7.0.33, 7.1.x before 7.1.25, and 7.2.x before 7.2.13, a buffer over-read in PHAR reading functions may allow an attacker to read allocated or unallocated memory past the actual data when trying to parse a .phar file. This is related to phar_parse_pharfile in ext/phar/phar.c.
References
- bugs.php.net /bug.php?id=77143
- php.net /ChangeLog-7.php
- php.net /ChangeLog-5.php
- lists.opensuse.org /opensuse-security-announce/2019-04/msg00083.html
- lists.opensuse.org /opensuse-security-announce/2019-04/msg00104.html
- usn.ubuntu.com /3566-2/
- lists.opensuse.org /opensuse-security-announce/2019-06/msg00041.html
- lists.opensuse.org /opensuse-security-announce/2019-06/msg00044.html
- access.redhat.com /errata/RHSA-2019:2519
- access.redhat.com /errata/RHSA-2019:3299
-
High CVE-2019-11041 Reported 8/9/19When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.1.x below 7.1.31, 7.2.x below 7.2.21 and 7.3.x below 7.3.8 it is possible to supply it with data what will cause it to read past the allocated buffer. This may lead to information disclosure or crash.
References
- bugs.php.net /bug.php?id=78222
- lists.debian.org /debian-lts-announce/2019/08/msg00010.html
- usn.ubuntu.com /4097-2/
- usn.ubuntu.com /4097-1/
- security.netapp.com /advisory/ntap-20190822-0003/
- seclists.org /bugtraq/2019/Sep/35
- www.debian.org /security/2019/dsa-4527
- seclists.org /bugtraq/2019/Sep/38
- www.debian.org /security/2019/dsa-4529
- lists.opensuse.org /opensuse-security-announce/2019-10/msg00019.html
- support.apple.com /kb/HT210634
- seclists.org /bugtraq/2019/Oct/9
- seclists.org /fulldisclosure/2019/Oct/15
- seclists.org /fulldisclosure/2019/Oct/55
- access.redhat.com /errata/RHSA-2019:3299
- support.apple.com /kb/HT210722
- www.tenable.com /security/tns-2021-14
-
High CVE-2019-11042 Reported 8/9/19When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.1.x below 7.1.31, 7.2.x below 7.2.21 and 7.3.x below 7.3.8 it is possible to supply it with data what will cause it to read past the allocated buffer. This may lead to information disclosure or crash.
References
- bugs.php.net /bug.php?id=78256
- lists.debian.org /debian-lts-announce/2019/08/msg00010.html
- usn.ubuntu.com /4097-2/
- usn.ubuntu.com /4097-1/
- security.netapp.com /advisory/ntap-20190822-0003/
- seclists.org /bugtraq/2019/Sep/35
- www.debian.org /security/2019/dsa-4527
- seclists.org /bugtraq/2019/Sep/38
- www.debian.org /security/2019/dsa-4529
- lists.opensuse.org /opensuse-security-announce/2019-10/msg00019.html
- support.apple.com /kb/HT210634
- seclists.org /bugtraq/2019/Oct/9
- seclists.org /fulldisclosure/2019/Oct/15
- seclists.org /fulldisclosure/2019/Oct/55
- access.redhat.com /errata/RHSA-2019:3299
- support.apple.com /kb/HT210722
- www.tenable.com /security/tns-2021-14
-
High CVE-2019-11044 Reported 12/23/19In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0 on Windows, PHP link() function accepts filenames with embedded \0 byte and treats them as terminating at that byte. This could lead to security vulnerabilities, e.g. in applications checking paths that the code is allowed to access.
References
- bugs.php.net /bug.php?id=78862
- security.netapp.com /advisory/ntap-20200103-0002/
- www.tenable.com /security/tns-2021-14
- lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/N7GCOAE6KVHYJ3UQ4KLPLTGSLX6IRVRN/
- lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/XWRQPYXVG43Q7DXMXH6UVWMKWGUW552F/
-
High CVE-2019-6977 Reported 1/27/19gdImageColorMatch in gd_color_match.c in the GD Graphics Library (aka LibGD) 2.2.5, as used in the imagecolormatch function in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1, has a heap-based buffer overflow. This can be exploited by an attacker who is able to trigger imagecolormatch calls with crafted image data.
References
- bugs.php.net /bug.php?id=77270
- php.net /ChangeLog-7.php
- php.net /ChangeLog-5.php
- www.securityfocus.com /bid/106731
- lists.debian.org /debian-lts-announce/2019/01/msg00028.html
- www.debian.org /security/2019/dsa-4384
- usn.ubuntu.com /3900-1/
- security.netapp.com /advisory/ntap-20190315-0003/
- security.gentoo.org /glsa/201903-18
- lists.opensuse.org /opensuse-security-announce/2019-04/msg00025.html
- lists.opensuse.org /opensuse-security-announce/2019-04/msg00031.html
- packetstormsecurity.com /files/152459/PHP-7.2-imagecolormatch-Out-Of-Band-Heap-Write.html
- www.exploit-db.com /exploits/46677/
- access.redhat.com /errata/RHSA-2019:2519
- access.redhat.com /errata/RHSA-2019:3299
- lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/TEYUUOW75YD3DENIPYMO263E6NL2NFHI/
- lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/3WRUPZVT2MWFUEMVGTRAGDOBHLNMGK5R/
- lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/TTXSLRZI5BCQT3H5KALG3DHUWUMNPDX2/
- lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/3CZ2QADQTKRHTGB2AHD7J4QQNDLBEMM6/
-
High CVE-2019-9022 Reported 2/22/19An issue was discovered in PHP 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.2. dns_get_record misparses a DNS response, which can allow a hostile DNS server to cause PHP to misuse memcpy, leading to read operations going past the buffer allocated for DNS data. This affects php_parserr in ext/standard/dns.c for DNS_CAA and DNS_ANY queries.
References
- bugs.php.net /bug.php?id=77369
- www.debian.org /security/2019/dsa-4398
- usn.ubuntu.com /3902-1/
- security.netapp.com /advisory/ntap-20190321-0001/
- lists.debian.org /debian-lts-announce/2019/03/msg00043.html
- usn.ubuntu.com /3922-2/
- usn.ubuntu.com /3922-3/
- lists.opensuse.org /opensuse-security-announce/2019-06/msg00041.html
- lists.opensuse.org /opensuse-security-announce/2019-06/msg00044.html
- access.redhat.com /errata/RHSA-2019:2519
- access.redhat.com /errata/RHSA-2019:3299
- www.tenable.com /security/tns-2019-07
-
High CVE-2019-9024 Reported 2/22/19An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. xmlrpc_decode() can allow a hostile XMLRPC server to cause PHP to read memory outside of allocated areas in base64_decode_xmlrpc in ext/xmlrpc/libxmlrpc/base64.c.
References
- bugs.php.net /bug.php?id=77380
- www.securityfocus.com /bid/107156
- www.debian.org /security/2019/dsa-4398
- usn.ubuntu.com /3902-1/
- usn.ubuntu.com /3902-2/
- security.netapp.com /advisory/ntap-20190321-0001/
- lists.opensuse.org /opensuse-security-announce/2019-04/msg00083.html
- lists.opensuse.org /opensuse-security-announce/2019-04/msg00104.html
- lists.opensuse.org /opensuse-security-announce/2019-06/msg00041.html
- lists.opensuse.org /opensuse-security-announce/2019-06/msg00044.html
- access.redhat.com /errata/RHSA-2019:2519
- access.redhat.com /errata/RHSA-2019:3299
-
High CVE-2019-9637 Reported 3/9/19An issue was discovered in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. Due to the way rename() across filesystems is implemented, it is possible that file being renamed is briefly available with wrong permissions while the rename is ongoing, thus enabling unauthorized users to access the data.
References
- bugs.php.net /bug.php?id=77630
- www.debian.org /security/2019/dsa-4403
- usn.ubuntu.com /3922-1/
- support.f5.com /csp/article/K53825211
- lists.debian.org /debian-lts-announce/2019/03/msg00043.html
- usn.ubuntu.com /3922-2/
- usn.ubuntu.com /3922-3/
- lists.opensuse.org /opensuse-security-announce/2019-04/msg00104.html
- security.netapp.com /advisory/ntap-20190502-0007/
- lists.opensuse.org /opensuse-security-announce/2019-06/msg00012.html
- lists.opensuse.org /opensuse-security-announce/2019-06/msg00041.html
- lists.opensuse.org /opensuse-security-announce/2019-06/msg00044.html
- access.redhat.com /errata/RHSA-2019:2519
- access.redhat.com /errata/RHSA-2019:3299
- www.tenable.com /security/tns-2019-07
-
High CVE-2019-9638 Reported 3/9/19An issue was discovered in the EXIF component in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. There is an uninitialized read in exif_process_IFD_in_MAKERNOTE because of mishandling the maker_note->offset relationship to value_len.
References
- bugs.php.net /bug.php?id=77563
- www.debian.org /security/2019/dsa-4403
- usn.ubuntu.com /3922-1/
- lists.debian.org /debian-lts-announce/2019/03/msg00043.html
- usn.ubuntu.com /3922-2/
- usn.ubuntu.com /3922-3/
- lists.opensuse.org /opensuse-security-announce/2019-04/msg00104.html
- security.netapp.com /advisory/ntap-20190502-0007/
- lists.opensuse.org /opensuse-security-announce/2019-06/msg00012.html
- lists.opensuse.org /opensuse-security-announce/2019-06/msg00041.html
- lists.opensuse.org /opensuse-security-announce/2019-06/msg00044.html
- access.redhat.com /errata/RHSA-2019:2519
- access.redhat.com /errata/RHSA-2019:3299
-
High CVE-2019-9639 Reported 3/9/19An issue was discovered in the EXIF component in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. There is an uninitialized read in exif_process_IFD_in_MAKERNOTE because of mishandling the data_len variable.
References
- bugs.php.net /bug.php?id=77659
- www.debian.org /security/2019/dsa-4403
- usn.ubuntu.com /3922-1/
- lists.debian.org /debian-lts-announce/2019/03/msg00043.html
- usn.ubuntu.com /3922-2/
- usn.ubuntu.com /3922-3/
- lists.opensuse.org /opensuse-security-announce/2019-04/msg00104.html
- security.netapp.com /advisory/ntap-20190502-0007/
- lists.opensuse.org /opensuse-security-announce/2019-06/msg00012.html
- lists.opensuse.org /opensuse-security-announce/2019-06/msg00041.html
- lists.opensuse.org /opensuse-security-announce/2019-06/msg00044.html
- access.redhat.com /errata/RHSA-2019:2519
- access.redhat.com /errata/RHSA-2019:3299
-
High CVE-2019-9640 Reported 3/9/19An issue was discovered in the EXIF component in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. There is an Invalid Read in exif_process_SOFn.
References
- bugs.php.net /bug.php?id=77540
- www.debian.org /security/2019/dsa-4403
- usn.ubuntu.com /3922-1/
- lists.debian.org /debian-lts-announce/2019/03/msg00043.html
- usn.ubuntu.com /3922-2/
- usn.ubuntu.com /3922-3/
- lists.opensuse.org /opensuse-security-announce/2019-04/msg00104.html
- security.netapp.com /advisory/ntap-20190502-0007/
- lists.opensuse.org /opensuse-security-announce/2019-06/msg00012.html
- lists.opensuse.org /opensuse-security-announce/2019-06/msg00041.html
- lists.opensuse.org /opensuse-security-announce/2019-06/msg00044.html
- access.redhat.com /errata/RHSA-2019:2519
- access.redhat.com /errata/RHSA-2019:3299
-
High CVE-2020-7062 Reported 2/27/20In PHP versions 7.2.x below 7.2.28, 7.3.x below 7.3.15 and 7.4.x below 7.4.3, when using file upload functionality, if upload progress tracking is enabled, but session.upload_progress.cleanup is set to 0 (disabled), and the file upload fails, the upload procedure would try to clean up data that does not exist and encounter null pointer dereference, which would likely lead to a crash.
References
- bugs.php.net /bug.php?id=79221
- lists.opensuse.org /opensuse-security-announce/2020-03/msg00023.html
- security.gentoo.org /glsa/202003-57
- lists.debian.org /debian-lts-announce/2020/03/msg00034.html
- usn.ubuntu.com /4330-1/
- www.debian.org /security/2020/dsa-4717
- www.debian.org /security/2020/dsa-4719
- www.tenable.com /security/tns-2021-14
-
High CVE-2020-7067 Reported 4/27/20In PHP versions 7.2.x below 7.2.30, 7.3.x below 7.3.17 and 7.4.x below 7.4.5, if PHP is compiled with EBCDIC support (uncommon), urldecode() function can be made to access locations past the allocated memory, due to erroneously using signed numbers as array indexes.
References
-
Medium CVE-2007-3205 Reported 6/13/07The parse_str function in (1) PHP, (2) Hardened-PHP, and (3) Suhosin, when called without a second parameter, might allow remote attackers to overwrite arbitrary variables by specifying variable names and values in the string to be parsed. NOTE: it is not clear whether this is a design limitation of the function or a bug in PHP, although it is likely to be regarded as a bug in Hardened-PHP and Suhosin.
- Affected versions
<8.0- Patched versions
8.0.0
References
- osvdb.org /39834
- securityreason.com /securityalert/2800
- www.acid-root.new.fr /advisories/14070612.txt
- www.securityfocus.com /archive/1/471178/100/0/threaded
- www.securityfocus.com /archive/1/471204/100/0/threaded
- www.securityfocus.com /archive/1/471275/100/0/threaded
- exchange.xforce.ibmcloud.com /vulnerabilities/34836
-
Medium CVE-2015-9253 Reported 2/19/18An issue was discovered in PHP 7.3.x before 7.3.0alpha3, 7.2.x before 7.2.8, and before 7.1.20. The php-fpm master process restarts a child process in an endless loop when using program execution functions (e.g., passthru, exec, shell_exec, or system) with a non-blocking STDIN stream, causing this master process to consume 100% of the CPU, and consume disk space with a large volume of error logs, as demonstrated by an attack by a customer of a shared-hosting facility.
References
- bugs.php.net /bug.php?id=75968
- bugs.php.net /bug.php?id=70185
- www.futureweb.at /security/CVE-2015-9253/
- github.com /php/php-src/commit/69dee5c732fe982c82edb17d0dbc3e79a47748d8
- bugs.php.net /bug.php?id=73342https://github.com/php/php-src/pull/3287
- github.com /php/php-src/blob/PHP-7.1.20/NEWS#L20-L22
- usn.ubuntu.com /3766-1/
- usn.ubuntu.com /4279-1/
-
Medium CVE-2018-10545 Reported 4/29/18An issue was discovered in PHP before 5.6.35, 7.0.x before 7.0.29, 7.1.x before 7.1.16, and 7.2.x before 7.2.4. Dumpable FPM child processes allow bypassing opcache access controls because fpm_unix.c makes a PR_SET_DUMPABLE prctl call, allowing one user (in a multiuser environment) to obtain sensitive information from the process memory of a second user's PHP applications by running gcore on the PID of the PHP-FPM worker process.
References
- bugs.php.net /bug.php?id=75605
- php.net /ChangeLog-7.php
- php.net /ChangeLog-5.php
- www.securityfocus.com /bid/104022
- lists.debian.org /debian-lts-announce/2018/05/msg00004.html
- usn.ubuntu.com /3646-1/
- usn.ubuntu.com /3646-2/
- security.netapp.com /advisory/ntap-20180607-0003/
- lists.debian.org /debian-lts-announce/2018/06/msg00005.html
- www.debian.org /security/2018/dsa-4240
- www.tenable.com /security/tns-2018-12
- security.gentoo.org /glsa/201812-01
- access.redhat.com /errata/RHSA-2019:2519
-
Medium CVE-2018-10547 Reported 4/29/18An issue was discovered in ext/phar/phar_object.c in PHP before 5.6.36, 7.0.x before 7.0.30, 7.1.x before 7.1.17, and 7.2.x before 7.2.5. There is Reflected XSS on the PHAR 403 and 404 error pages via request data of a request for a .phar file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2018-5712.
References
- bugs.php.net /bug.php?id=76129
- php.net /ChangeLog-7.php
- php.net /ChangeLog-5.php
- www.securitytracker.com /id/1040807
- lists.debian.org /debian-lts-announce/2018/05/msg00004.html
- usn.ubuntu.com /3646-1/
- usn.ubuntu.com /3646-2/
- security.netapp.com /advisory/ntap-20180607-0003/
- lists.debian.org /debian-lts-announce/2018/06/msg00005.html
- www.debian.org /security/2018/dsa-4240
- www.tenable.com /security/tns-2018-12
- access.redhat.com /errata/RHSA-2019:2519
-
Medium CVE-2018-14851 Reported 8/2/18exif_process_IFD_in_MAKERNOTE in ext/exif/exif.c in PHP before 5.6.37, 7.0.x before 7.0.31, 7.1.x before 7.1.20, and 7.2.x before 7.2.8 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted JPEG file.
References
- bugs.php.net /bug.php?id=76557
- php.net /ChangeLog-7.php
- php.net /ChangeLog-5.php
- lists.debian.org /debian-lts-announce/2018/09/msg00000.html
- usn.ubuntu.com /3766-1/
- www.tenable.com /security/tns-2018-12
- usn.ubuntu.com /3766-2/
- www.securityfocus.com /bid/104871
- security.netapp.com /advisory/ntap-20181107-0003/
- www.debian.org /security/2018/dsa-4353
- access.redhat.com /errata/RHSA-2019:2519
-
Medium CVE-2018-17082 Reported 9/16/18The Apache2 component in PHP before 5.6.38, 7.0.x before 7.0.32, 7.1.x before 7.1.22, and 7.2.x before 7.2.10 allows XSS via the body of a "Transfer-Encoding: chunked" request, because the bucket brigade is mishandled in the php_handler function in sapi/apache2handler/sapi_apache2.c.
References
- github.com /php/php-src/commit/23b057742e3cf199612fa8050ae86cae675e214e
- bugs.php.net /bug.php?id=76582
- php.net /ChangeLog-7.php
- php.net /ChangeLog-5.php
- lists.debian.org /debian-lts-announce/2018/09/msg00020.html
- security.netapp.com /advisory/ntap-20180924-0001/
- security.gentoo.org /glsa/201812-01
- www.debian.org /security/2018/dsa-4353
- access.redhat.com /errata/RHSA-2019:2519
- www.tenable.com /security/tns-2019-07
-
Medium CVE-2019-11038 Reported 6/19/19When using the gdImageCreateFromXbm() function in the GD Graphics Library (aka LibGD) 2.2.5, as used in the PHP GD extension in PHP versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and 7.3.x below 7.3.6, it is possible to supply data that will cause the function to use the value of uninitialized variable. This may lead to disclosing contents of the stack that has been left there by previous code.
References
- bugs.php.net /bug.php?id=77973
- lists.debian.org /debian-lts-announce/2019/06/msg00003.html
- bugzilla.redhat.com /show_bug.cgi?id=1724149
- bugzilla.suse.com /show_bug.cgi?id=1140120
- bugs.debian.org /cgi-bin/bugreport.cgi?bug=929821
- github.com /libgd/libgd/issues/501
- bugzilla.redhat.com /show_bug.cgi?id=1724432
- bugzilla.suse.com /show_bug.cgi?id=1140118
- access.redhat.com /errata/RHSA-2019:2519
- seclists.org /bugtraq/2019/Sep/38
- www.debian.org /security/2019/dsa-4529
- access.redhat.com /errata/RHSA-2019:3299
- lists.opensuse.org /opensuse-security-announce/2020-03/msg00020.html
- usn.ubuntu.com /4316-2/
- usn.ubuntu.com /4316-1/
- lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/PKSSWFR2WPMUOIB5EN5ZM252NNEPYUTG/
- lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/WAZBVK6XNYEIN7RDQXESSD63QHXPLKWL/
- lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/3CZ2QADQTKRHTGB2AHD7J4QQNDLBEMM6/
-
Medium CVE-2019-11045 Reported 12/23/19In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0, PHP DirectoryIterator class accepts filenames with embedded \0 byte and treats them as terminating at that byte. This could lead to security vulnerabilities, e.g. in applications checking paths that the code is allowed to access.
References
- bugs.php.net /bug.php?id=78863
- lists.debian.org /debian-lts-announce/2019/12/msg00034.html
- security.netapp.com /advisory/ntap-20200103-0002/
- usn.ubuntu.com /4239-1/
- lists.opensuse.org /opensuse-security-announce/2020-01/msg00036.html
- seclists.org /bugtraq/2020/Feb/27
- www.debian.org /security/2020/dsa-4626
- seclists.org /bugtraq/2020/Feb/31
- www.debian.org /security/2020/dsa-4628
- seclists.org /bugtraq/2021/Jan/3
- www.tenable.com /security/tns-2021-14
- lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/N7GCOAE6KVHYJ3UQ4KLPLTGSLX6IRVRN/
- lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/XWRQPYXVG43Q7DXMXH6UVWMKWGUW552F/
-
Medium CVE-2019-11046 Reported 12/23/19In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0, PHP bcmath extension functions on some systems, including Windows, can be tricked into reading beyond the allocated space by supplying it with string containing characters that are identified as numeric by the OS but aren't ASCII numbers. This can read to disclosure of the content of some memory locations.
References
- bugs.php.net /bug.php?id=78878
- lists.debian.org /debian-lts-announce/2019/12/msg00034.html
- security.netapp.com /advisory/ntap-20200103-0002/
- usn.ubuntu.com /4239-1/
- lists.opensuse.org /opensuse-security-announce/2020-01/msg00036.html
- seclists.org /bugtraq/2020/Feb/27
- www.debian.org /security/2020/dsa-4626
- seclists.org /bugtraq/2020/Feb/31
- www.debian.org /security/2020/dsa-4628
- seclists.org /bugtraq/2021/Jan/3
- www.tenable.com /security/tns-2021-14
- lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/N7GCOAE6KVHYJ3UQ4KLPLTGSLX6IRVRN/
- lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/XWRQPYXVG43Q7DXMXH6UVWMKWGUW552F/
- support.f5.com /csp/article/K48866433?utm_source=f5support&%3Butm_medium=RSS
-
Medium CVE-2019-11047 Reported 12/23/19When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0 it is possible to supply it with data what will cause it to read past the allocated buffer. This may lead to information disclosure or crash.
References
- bugs.php.net /bug.php?id=78910
- lists.debian.org /debian-lts-announce/2019/12/msg00034.html
- security.netapp.com /advisory/ntap-20200103-0002/
- usn.ubuntu.com /4239-1/
- lists.opensuse.org /opensuse-security-announce/2020-01/msg00036.html
- seclists.org /bugtraq/2020/Feb/27
- www.debian.org /security/2020/dsa-4626
- seclists.org /bugtraq/2020/Feb/31
- www.debian.org /security/2020/dsa-4628
- seclists.org /bugtraq/2021/Jan/3
- www.tenable.com /security/tns-2021-14
- lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/N7GCOAE6KVHYJ3UQ4KLPLTGSLX6IRVRN/
- lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/XWRQPYXVG43Q7DXMXH6UVWMKWGUW552F/
-
Medium CVE-2019-11048 Reported 5/20/20In PHP versions 7.2.x below 7.2.31, 7.3.x below 7.3.18 and 7.4.x below 7.4.6, when HTTP file uploads are allowed, supplying overly long filenames or field names could lead PHP engine to try to allocate oversized memory storage, hit the memory limit and stop processing the request, without cleaning up temporary files created by upload request. This potentially could lead to accumulation of uncleaned temporary files exhausting the disk space on the target server.
References
- bugs.php.net /bug.php?id=78876
- bugs.php.net /bug.php?id=78875
- security.netapp.com /advisory/ntap-20200528-0006/
- usn.ubuntu.com /4375-1/
- lists.opensuse.org /opensuse-security-announce/2020-06/msg00045.html
- lists.debian.org /debian-lts-announce/2020/06/msg00033.html
- www.debian.org /security/2020/dsa-4717
- www.debian.org /security/2020/dsa-4719
- www.oracle.com /security-alerts/cpuoct2020.html
- www.oracle.com /security-alerts/cpuApr2021.html
- www.tenable.com /security/tns-2021-14
- lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/OBA3TFZSP3TB5N4G24SO6BI64RJZXE3D/
- lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/XMDUQ7XFONY3BWTAQQUD3QUGZT6NFZUF/
-
Medium CVE-2019-11050 Reported 12/23/19When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0 it is possible to supply it with data what will cause it to read past the allocated buffer. This may lead to information disclosure or crash.
References
- bugs.php.net /bug.php?id=78793
- lists.debian.org /debian-lts-announce/2019/12/msg00034.html
- security.netapp.com /advisory/ntap-20200103-0002/
- usn.ubuntu.com /4239-1/
- lists.opensuse.org /opensuse-security-announce/2020-01/msg00036.html
- seclists.org /bugtraq/2020/Feb/27
- www.debian.org /security/2020/dsa-4626
- seclists.org /bugtraq/2020/Feb/31
- www.debian.org /security/2020/dsa-4628
- seclists.org /bugtraq/2021/Jan/3
- www.tenable.com /security/tns-2021-14
- lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/N7GCOAE6KVHYJ3UQ4KLPLTGSLX6IRVRN/
- lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/XWRQPYXVG43Q7DXMXH6UVWMKWGUW552F/
-
Medium CVE-2020-7063 Reported 2/27/20In PHP versions 7.2.x below 7.2.28, 7.3.x below 7.3.15 and 7.4.x below 7.4.3, when creating PHAR archive using PharData::buildFromIterator() function, the files are added with default permissions (0666, or all access) even if the original files on the filesystem were with more restrictive permissions. This may result in files having more lax permissions than intended when such archive is extracted.
References
- bugs.php.net /bug.php?id=79082
- lists.opensuse.org /opensuse-security-announce/2020-03/msg00023.html
- security.gentoo.org /glsa/202003-57
- lists.debian.org /debian-lts-announce/2020/03/msg00034.html
- usn.ubuntu.com /4330-1/
- www.debian.org /security/2020/dsa-4717
- www.debian.org /security/2020/dsa-4719
- www.tenable.com /security/tns-2021-14
-
Medium CVE-2020-7064 Reported 4/1/20In PHP versions 7.2.x below 7.2.9, 7.3.x below 7.3.16 and 7.4.x below 7.4.4, while parsing EXIF data with exif_read_data() function, it is possible for malicious data to cause PHP to read one byte of uninitialized memory. This could potentially lead to information disclosure or crash.
References
- bugs.php.net /bug.php?id=79282
- security.netapp.com /advisory/ntap-20200403-0001/
- lists.debian.org /debian-lts-announce/2020/04/msg00021.html
- usn.ubuntu.com /4330-1/
- usn.ubuntu.com /4330-2/
- lists.opensuse.org /opensuse-security-announce/2020-05/msg00025.html
- www.debian.org /security/2020/dsa-4717
- www.debian.org /security/2020/dsa-4719
- www.oracle.com /security-alerts/cpujan2021.html
- www.tenable.com /security/tns-2021-14
-
Medium CVE-2020-7066 Reported 4/1/20In PHP versions 7.2.x below 7.2.29, 7.3.x below 7.3.16 and 7.4.x below 7.4.4, while using get_headers() with user-supplied URL, if the URL contains zero (\0) character, the URL will be silently truncated at it. This may cause some software to make incorrect assumptions about the target of the get_headers() and possibly send some information to a wrong server.
References
- bugs.php.net /bug.php?id=79329
- security.netapp.com /advisory/ntap-20200403-0001/
- lists.debian.org /debian-lts-announce/2020/04/msg00021.html
- usn.ubuntu.com /4330-2/
- lists.opensuse.org /opensuse-security-announce/2020-05/msg00025.html
- www.debian.org /security/2020/dsa-4717
- www.debian.org /security/2020/dsa-4719
- www.tenable.com /security/tns-2021-14
-
Medium CVE-2020-7069 Reported 10/2/20In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when AES-CCM mode is used with openssl_encrypt() function with 12 bytes IV, only first 7 bytes of the IV is actually used. This can lead to both decreased security and incorrect encryption data.
References
- bugs.php.net /bug.php?id=79601
- security.netapp.com /advisory/ntap-20201016-0001/
- lists.opensuse.org /opensuse-security-announce/2020-10/msg00045.html
- usn.ubuntu.com /4583-1/
- lists.opensuse.org /opensuse-security-announce/2020-10/msg00067.html
- security.gentoo.org /glsa/202012-16
- www.debian.org /security/2021/dsa-4856
- www.oracle.com /security-alerts/cpuApr2021.html
- www.tenable.com /security/tns-2021-14
- www.oracle.com /security-alerts/cpuoct2021.html
- lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/RRU57N3OSYZPOMFWPRDNVH7EMYOTSZ66/
- lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/7EVDN7D3IB4EAI4D3ZOM2OJKQ5SD7K4E/
- lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/P2J3ZZDHCSX65T5QWV4AHBN7MOJXBEKG/
-
Medium CVE-2020-7070 Reported 10/2/20In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when PHP is processing incoming HTTP cookie values, the cookie names are url-decoded. This may lead to cookies with prefixes like __Host confused with cookies that decode to such prefix, thus leading to an attacker being able to forge cookie which is supposed to be secure. See also CVE-2020-8184 for more information.
References
- bugs.php.net /bug.php?id=79699
- cve.circl.lu /cve/CVE-2020-8184
- hackerone.com /reports/895727
- lists.debian.org /debian-lts-announce/2020/10/msg00008.html
- security.netapp.com /advisory/ntap-20201016-0001/
- lists.opensuse.org /opensuse-security-announce/2020-10/msg00045.html
- usn.ubuntu.com /4583-1/
- lists.opensuse.org /opensuse-security-announce/2020-10/msg00067.html
- security.gentoo.org /glsa/202012-16
- www.debian.org /security/2021/dsa-4856
- www.tenable.com /security/tns-2021-14
- www.oracle.com /security-alerts/cpuoct2021.html
- lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/RRU57N3OSYZPOMFWPRDNVH7EMYOTSZ66/
- lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/7EVDN7D3IB4EAI4D3ZOM2OJKQ5SD7K4E/
- lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/P2J3ZZDHCSX65T5QWV4AHBN7MOJXBEKG/
-
Medium CVE-2022-31628 Reported 9/28/22In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the phar uncompressor code would recursively uncompress "quines" gzip files, resulting in an infinite loop.
References
- bugs.php.net /bug.php?id=81726
- www.debian.org /security/2022/dsa-5277
- security.gentoo.org /glsa/202211-03
- security.netapp.com /advisory/ntap-20221209-0001/
- lists.debian.org /debian-lts-announce/2022/12/msg00030.html
- lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/XNIEABBH5XCXLFWWZYIDE457SPEDZTXV/
- lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/VI3E6A3ZTH2RP7OMLJHSVFIEQBIFM6RF/
- lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/2L5SUVYGAKSWODUQPZFBUB3AL6E6CSEV/
-
Medium CVE-2022-31629 Reported 9/28/22In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the vulnerability enables network and same-site attackers to set a standard insecure cookie in the victim's browser which is treated as a `__Host-` or `__Secure-` cookie by PHP applications.
References
- bugs.php.net /bug.php?id=81727
- www.debian.org /security/2022/dsa-5277
- security.gentoo.org /glsa/202211-03
- security.netapp.com /advisory/ntap-20221209-0001/
- lists.debian.org /debian-lts-announce/2022/12/msg00030.html
- lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/XNIEABBH5XCXLFWWZYIDE457SPEDZTXV/
- lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/VI3E6A3ZTH2RP7OMLJHSVFIEQBIFM6RF/
- lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/2L5SUVYGAKSWODUQPZFBUB3AL6E6CSEV/
- lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/ZGWIK3HMBACERGB4TSBB2JUOMPYY2VKY/
- lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/LSJVPJTX7T3J5V7XHR4MFNHZGP44R5XE/
- lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/KJZK3X6B7FBE32FETDSMRLJXTFTHKWSY/
- www.openwall.com /lists/oss-security/2024/04/12/11
-
Medium CVE-2022-4900 Reported 11/2/23A vulnerability was found in PHP where setting the environment variable PHP_CLI_SERVER_WORKERS to a large value leads to a heap buffer overflow.
References
-
Low CVE-2020-7068 Reported 9/9/20In PHP versions 7.2.x below 7.2.33, 7.3.x below 7.3.21 and 7.4.x below 7.4.9, while processing PHAR files using phar extension, phar_parse_zipfile could be tricked into accessing freed memory, which could lead to a crash or information disclosure.
References
-
Unrated CVE-2024-3566 Reported 4/10/24A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly depend on the CreateProcess function when the specific conditions are satisfied.
References
- flatt.tech /research/posts/batbadbut-you-cant-securely-execute-commands-on-windows/
- kb.cert.org /vuls/id/123335
- learn.microsoft.com /en-us/archive/blogs/twistylittlepassagesallalike/everyone-quotes-command-line-arguments-the-wrong-way
- www.cve.org /CVERecord?id=CVE-2024-1874
- www.cve.org /CVERecord?id=CVE-2024-22423
- www.cve.org /CVERecord?id=CVE-2024-24576
- www.kb.cert.org /vuls/id/123335
5
Abandonned packages
to replace or keep an eye on
Current vulnerabilities
115
Last change
+1
Oct 23, 2026
Abandoned packages
5
Analyses with changes
36
Vulnerabilities by severity
Changes between analyses
Latest changes
-
Oct 23, 2026, 3:05 AM+1 new115 total
-
Oct 16, 2026, 3:05 AM+3 new114 total
-
Oct 3, 2026, 3:05 AM+1 new111 total
-
Oct 1, 2026, 4:10 PM+59 new110 total
-
Sep 30, 2026, 3:06 AM+1 new51 total
-
Sep 24, 2026, 3:04 AM−60 closed50 total
-
Sep 9, 2026, 3:05 AM+1 new110 total
-
Aug 8, 2026, 3:04 AM+1 new109 total
-
Jul 22, 2026, 3:04 AM+1 new108 total
-
Jul 21, 2026, 3:05 AM+3 new107 total
-
Jul 7, 2026, 3:05 AM+60 new104 total
-
Jul 2, 2026, 3:09 AM+1 new44 total
-
Jul 1, 2026, 3:08 AM−60 closed43 total
-
Jun 20, 2026, 3:03 AM+1 new103 total
-
Jun 13, 2026, 3:04 AM+2 new102 total
-
May 28, 2026, 3:04 AM+8 new100 total
-
May 27, 2026, 3:04 AM+1 new92 total
-
May 21, 2026, 3:05 AM+19 new91 total
-
May 14, 2026, 3:04 AM+1 new72 total
-
May 6, 2026, 3:04 AM+1 new71 total
-
May 5, 2026, 3:04 AM+1 new70 total
-
May 1, 2026, 3:04 AM+9 new +5 abandoned69 total
-
Apr 30, 2026, 3:03 AM−9 closed −5 abandoned60 total
-
Apr 15, 2026, 3:04 AM+3 new69 total
-
Jan 29, 2026, 2:05 AM+1 new66 total
-
Dec 31, 2025, 2:05 AM+1 new65 total
-
Dec 10, 2025, 2:06 AM+60 new64 total
-
Dec 9, 2025, 2:05 AM−60 closed4 total
-
Dec 5, 2025, 2:05 AM+4 new +5 abandoned64 total
-
Dec 4, 2025, 2:05 AM−4 closed −5 abandoned60 total
-
Nov 13, 2025, 2:05 AM+1 new64 total
-
Oct 8, 2025, 3:05 AM−1 closed63 total
-
Aug 5, 2025, 3:05 AM+60 new64 total
-
Jul 31, 2025, 3:09 AM−60 closed4 total
-
Jun 19, 2025, 3:02 AM+1 new64 total
-
Apr 5, 2025, 3:03 AM+2 new63 total
Badges
[](https://audit.security.code-rhapsodie.fr/en/project/0195f0ac-9253-7c4f-a024-1329835d0d85)
[](https://audit.security.code-rhapsodie.fr/en/project/0195f0ac-9253-7c4f-a024-1329835d0d85)
[](https://audit.security.code-rhapsodie.fr/en/project/0195f0ac-9253-7c4f-a024-1329835d0d85)
[](https://audit.security.code-rhapsodie.fr/en/project/0195f0ac-9253-7c4f-a024-1329835d0d85)