Moderate: php:8.0 security update
PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. The following packages have been upgraded to a later upstream version: php (8.0). (BZ#2161666) Security Fix(es): * XKCP: buffer overflow in the SHA-3 reference implementation (CVE-2022-37454) * php: standard insecure cookie could be treated as a `__Host-` or `__Secure-` cookie by PHP applications (CVE-2022-31629) * php: OOB read due to insufficient input validation in imageloadfont() (CVE-2022-31630) * php: Due to an integer overflow PDO::quote() may return unquoted string (CVE-2022-31631) * php: phar wrapper can occur dos when using quine gzip file (CVE-2022-31628) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
02 / AFFECTED SOFTWARE
Affected packages
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. The following packages have been upgraded to a later upstream version: php (8.0). (BZ#2161666) Security Fix(es): * XKCP: buffer overflow in the SHA-3 reference implementation (CVE-2022-37454) * php: standard insecure cookie could be treated as a `__Host-` or `__Secure-` cookie by PHP applications (CVE-2022-31629) * php: OOB read due to insufficient input validation in imageloadfont() (CVE-2022-31630) * php: Due to an integer overflow PDO::quote() may return unquoted string (CVE-2022-31631) * php: phar wrapper can occur dos when using quine gzip file (CVE-2022-31628) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
05 / REFERENCES
Further evidence
- https://access.redhat.com/errata/RHSA-2023:0848
- https://access.redhat.com/security/cve/CVE-2022-31628
- https://access.redhat.com/security/cve/CVE-2022-31629
- https://access.redhat.com/security/cve/CVE-2022-31630
- https://access.redhat.com/security/cve/CVE-2022-31631
- https://access.redhat.com/security/cve/CVE-2022-37454
- https://bugzilla.redhat.com/2133687
- https://bugzilla.redhat.com/2133688
- https://bugzilla.redhat.com/2139280
- https://bugzilla.redhat.com/2140200
- https://bugzilla.redhat.com/2158791
- https://errata.almalinux.org/8/ALSA-2023-0848.html