php7.4 - security update

Fixed packages 1

Vulnerabilities 4

• Critical 9.8
  CVE-2022-37454

  Buffer overflow in sponge queue functions

  The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute arbitrary code or eliminate expected cryptographic properties. This occurs in the sponge function interface.

  php7.2 python3.6 python3.8 python3.7 Debian Ubuntu Azure Linux Alpine PyPI RubyGems
  Oct 21, 2022
• Medium 6.5
  CVE-2022-31629 Public exploit EPSS 50%

  $_COOKIE names string replacement (. -> _): cookie integrity vulnerabilities

  In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the vulnerability enables network and same-site attackers to set a standard insecure cookie in the victim's browser which is treated as a `__Host-` or `__Secure-` cookie by PHP applications.

  PHP Group PHP php5 php7.0 Debian Ubuntu Alpine
  Sep 28, 2022
• Medium 6.5
  CVE-2022-31630 Public exploit

  OOB read due to insufficient input validation in imageloadfont()

  In PHP versions prior to 7.4.33, 8.0.25 and 8.1.12, when using imageloadfont() function in gd extension, it is possible to supply a specially crafted font file, such as if the loaded font is used with imagechar() function, the read outside allocated buffer wi…

  PHP Group PHP php7 php7.4 Debian Ubuntu Alpine
  Nov 14, 2022
• Low 2.3
  CVE-2022-31628

  phar wrapper can occur dos when using quine gzip file

  In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the phar uncompressor code would recursively uncompress "quines" gzip files, resulting in an infinite loop.

  PHP Group PHP php5 php7.0 Debian Ubuntu Alpine
  Sep 28, 2022