Skip to content
OpenAdvisories
Medium DLA-3810-1 2 CVEs

php7.3 - security update

Published May 7, 2024 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 10 php7.3 7.3.31-1~deb10u6

Vulnerabilities 2

  • Medium 6.5
    CVE-2024-2756 EPSS 38%

    __Host-/__Secure- cookie bypass due to partial CVE-2022-31629 fix

    Due to an incomplete fix to CVE-2022-31629 https://github.com/advisories/GHSA-c43m-486j-j32p , network and same-site attackers can set a standard insecure cookie in the victim's browser which is treated as a __Host- or __Secure- cookie by PHP applications.

    PHP Group PHP php5 php7.0 Debian Ubuntu Azure Linux Alpine
  • Medium 6.5
    CVE-2024-3096

    PHP function password_verify can erroneously return true when argument contains NUL

    In PHP  version 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, if a password stored with password_hash() starts with a null byte (\x00), testing a blank string as the password via password_verify() will incorrectly return true.

    PHP Group PHP php5 php7.0 Debian Ubuntu Azure Linux Alpine