Search CVE reports
1 – 10 of 75 results
Circular symbolic links in phar archives could lead to unbounded recursion, exhausting the C stack and crashing the PHP process, in PHP versions from 8.2.* before 8.2.33, from 8.3.* before 8.3.33, from 8.4.* before 8.4.24, and...
7 affected packages
php5, php7.0, php7.2, php7.4, php8.1...
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| php5 | Not in release | Not in release | Not in release | — | — |
| php7.0 | Not in release | Not in release | Not in release | — | — |
| php7.2 | Not in release | Not in release | Not in release | — | Needs evaluation |
| php7.4 | Not in release | Not in release | Not in release | Needs evaluation | — |
| php8.1 | Not in release | Not in release | Needs evaluation | — | — |
| php8.3 | Not in release | Needs evaluation | Not in release | — | — |
| php8.5 | Needs evaluation | Not in release | Not in release | — | — |
Attacker-provided inputs to bccomp() could lead to an out-of-bounds write with stack and heap corruption in PHP versions from 8.4.* before 8.4.24 and from 8.5.* before 8.5.9.
7 affected packages
php5, php7.0, php7.2, php7.4, php8.1...
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| php5 | Not in release | Not in release | Not in release | — | — |
| php7.0 | Not in release | Not in release | Not in release | — | — |
| php7.2 | Not in release | Not in release | Not in release | — | Needs evaluation |
| php7.4 | Not in release | Not in release | Not in release | Needs evaluation | — |
| php8.1 | Not in release | Not in release | Needs evaluation | — | — |
| php8.3 | Not in release | Needs evaluation | Not in release | — | — |
| php8.5 | Needs evaluation | Not in release | Not in release | — | — |
Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2.* before 8.2.33, from 8.3.* before 8.3.33, from 8.4.* before 8.4.24, and from 8.5.* before 8.5.9.
7 affected packages
php5, php7.0, php7.2, php7.4, php8.1...
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| php5 | Not in release | Not in release | Not in release | — | — |
| php7.0 | Not in release | Not in release | Not in release | — | — |
| php7.2 | Not in release | Not in release | Not in release | — | Needs evaluation |
| php7.4 | Not in release | Not in release | Not in release | Needs evaluation | — |
| php8.1 | Not in release | Not in release | Needs evaluation | — | — |
| php8.3 | Not in release | Needs evaluation | Not in release | — | — |
| php8.5 | Needs evaluation | Not in release | Not in release | — | — |
Some fixes available 3 of 8
In PHP versions 8.2.* before 8.2.32, 8.3.* before 8.3.32, 8.4.* before 8.4.23, 8.5.* before 8.5.8, the AES-WRAP-PAD algorithm implementation in OpenSSL extension contains a buffer allocation flaw. The output buffer for the AES...
8 affected packages
php5, php7.0, php7.2, php7.4, php8.1...
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| php5 | Not in release | Not in release | Not in release | — | — |
| php7.0 | Not in release | Not in release | Not in release | — | — |
| php7.2 | Not in release | Not in release | Not in release | — | Needs evaluation |
| php7.4 | Not in release | Not in release | Not in release | Needs evaluation | — |
| php8.1 | Not in release | Not in release | Fixed | — | — |
| php8.3 | Not in release | Fixed | Not in release | — | — |
| php8.4 | Not in release | Not in release | Not in release | — | — |
| php8.5 | Fixed | Not in release | Not in release | — | — |
Some fixes available 1 of 2
PHP: Failure to setup TLS with a remote server can result in a remote DoS
8 affected packages
php5, php7.0, php7.2, php7.4, php8.1...
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| php5 | Not in release | Not in release | Not in release | — | — |
| php7.0 | Not in release | Not in release | Not in release | — | — |
| php7.2 | Not in release | Not in release | Not in release | — | Not affected |
| php7.4 | Not in release | Not in release | Not in release | Not affected | — |
| php8.1 | Not in release | Not in release | Not affected | — | — |
| php8.3 | Not in release | Not affected | Not in release | — | — |
| php8.4 | Not in release | Not in release | Not in release | — | — |
| php8.5 | Fixed | Not in release | Not in release | — | — |
PHP Standard Library (PSL) is set of APIs covering async, collections, networking, I/O, cryptography, terminal UI, etc. In versions 6.1.0, 6.1.1 and 6.2.0, the Psl\H2\ServerConnection does not validate that the total bytes...
8 affected packages
php5, php7.0, php7.2, php7.4, php8.1...
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| php5 | Not in release | Not in release | Not in release | — | — |
| php7.0 | Not in release | Not in release | Not in release | — | — |
| php7.2 | Not in release | Not in release | Not in release | — | Not affected |
| php7.4 | Not in release | Not in release | Not in release | Not affected | — |
| php8.1 | Not in release | Not in release | Not affected | — | — |
| php8.3 | Not in release | Not affected | Not in release | — | — |
| php8.4 | Not in release | Not in release | Not in release | — | — |
| php8.5 | Not affected | Not in release | Not in release | — | — |
In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, DOMNode::C14N() method may process the XML data incorrectly, causing a circular linked list in the data structure representing the XML document. This may cause subsequent...
8 affected packages
php5, php7.0, php7.2, php7.4, php8.1...
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| php5 | Not in release | Not in release | Not in release | — | — |
| php7.0 | Not in release | Not in release | Not in release | — | — |
| php7.2 | Not in release | Not in release | Not in release | — | Not affected |
| php7.4 | Not in release | Not in release | Not in release | Not affected | — |
| php8.1 | Not in release | Not in release | Not affected | — | — |
| php8.3 | Not in release | Not affected | Not in release | — | — |
| php8.4 | Not in release | Not in release | Not in release | — | — |
| php8.5 | Fixed | Not in release | Not in release | — | — |
In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, when an encoding name containing an embedded NUL byte is passed to mb_convert_encoding() or related mbstring functions, the code incorrectly assumes that...
8 affected packages
php5, php7.0, php7.2, php7.4, php8.1...
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| php5 | Not in release | Not in release | Not in release | — | — |
| php7.0 | Not in release | Not in release | Not in release | — | — |
| php7.2 | Not in release | Not in release | Not in release | — | Not affected |
| php7.4 | Not in release | Not in release | Not in release | Not affected | — |
| php8.1 | Not in release | Not in release | Not affected | — | — |
| php8.3 | Not in release | Not affected | Not in release | — | — |
| php8.4 | Not in release | Not in release | Not in release | — | — |
| php8.5 | Fixed | Not in release | Not in release | — | — |
Some fixes available 4 of 8
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the metaphone() function in ext/standard/metaphone.c uses a signed int variable to track the current position within the input...
8 affected packages
php5, php7.0, php7.2, php7.4, php8.1...
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| php5 | Not in release | Not in release | Not in release | — | — |
| php7.0 | Not in release | Not in release | Not in release | — | — |
| php7.2 | Not in release | Not in release | Not in release | — | Needs evaluation |
| php7.4 | Not in release | Not in release | Not in release | Needs evaluation | — |
| php8.1 | Not in release | Not in release | Fixed | — | — |
| php8.3 | Not in release | Fixed | Not in release | — | — |
| php8.4 | Not in release | Not in release | Not in release | — | — |
| php8.5 | Fixed | Not in release | Not in release | — | — |
Some fixes available 4 of 8
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, when a SOAP server has a typemap configured, the decoding process contains a mistake which checks the wrong variable in case of...
8 affected packages
php5, php7.0, php7.2, php7.4, php8.1...
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| php5 | Not in release | Not in release | Not in release | — | — |
| php7.0 | Not in release | Not in release | Not in release | — | — |
| php7.2 | Not in release | Not in release | Not in release | — | Needs evaluation |
| php7.4 | Not in release | Not in release | Not in release | Needs evaluation | — |
| php8.1 | Not in release | Not in release | Fixed | — | — |
| php8.3 | Not in release | Fixed | Not in release | — | — |
| php8.4 | Not in release | Not in release | Not in release | — | — |
| php8.5 | Fixed | Not in release | Not in release | — | — |