Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Debian · 10 | php7.3 | 7.3.31-1~deb10u5 |
Vulnerabilities 2
-
Critical 9.4
Buffer overflow and overread in phar_dir_read()
In PHP version 8.0.* before 8.0.30, 8.1.* before 8.1.22, and 8.2.* before 8.2.8, when loading phar file, while reading PHAR directory entries, insufficient length checking may lead to a stack buffer overflow, leading potentially to memory corruption or RCE.
-
High 8.6
Security issue with external entity loading in XML without enabling it
In PHP versions 8.0.* before 8.0.30, 8.1.* before 8.1.22, and 8.2.* before 8.2.8 various XML functions rely on libxml global state to track configuration variables, like whether external entities are loaded. This state is assumed to be unchanged unless the us…