Summary
libzip
[1.6.1-1]
- update to 1.6.1
- enable lzma support
php-pear
[1:1.10.12-1]
- update PEAR to 1.10.12
- update Archive_Tar to 1.4.9
- update Console_Getopt to 1.4.3
- update XML_Util to 1.4.5
php-pecl-apcu
[5.1.18-1]
- update to 5.1.18
php-pecl-rrd
php-pecl-xdebug
[2.9.5-1]
- update to 2.9.5
php-pecl-zip
[1.18.2-1]
- update to 1.18.2
php
[7.4.19-2]
- fix SSRF bypass in FILTER_VALIDATE_URL
CVE-2021-21705
- fix Local privilege escalation via PHP-FPM
CVE-2021-21703
Fixed packages 37
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 8 | apcu-panel | 0:5.1.18-1.module+el8.3.0+7685+72d70b58 |
| Oracle Linux · 8 | libzip | 0:1.6.1-1.module+el8.3.0+7685+72d70b58 |
| Oracle Linux · 8 | libzip-devel | 0:1.6.1-1.module+el8.3.0+7685+72d70b58 |
| Oracle Linux · 8 | libzip-tools | 0:1.6.1-1.module+el8.3.0+7685+72d70b58 |
| Oracle Linux · 8 | php | 0:7.4.19-2.module+el8.6.0+20552+0a59ce9f |
| Oracle Linux · 8 | php-bcmath | 0:7.4.19-2.module+el8.6.0+20552+0a59ce9f |
| Oracle Linux · 8 | php-cli | 0:7.4.19-2.module+el8.6.0+20552+0a59ce9f |
| Oracle Linux · 8 | php-common | 0:7.4.19-2.module+el8.6.0+20552+0a59ce9f |
| Oracle Linux · 8 | php-dba | 0:7.4.19-2.module+el8.6.0+20552+0a59ce9f |
| Oracle Linux · 8 | php-dbg | 0:7.4.19-2.module+el8.6.0+20552+0a59ce9f |
| Oracle Linux · 8 | php-devel | 0:7.4.19-2.module+el8.6.0+20552+0a59ce9f |
| Oracle Linux · 8 | php-embedded | 0:7.4.19-2.module+el8.6.0+20552+0a59ce9f |
| Oracle Linux · 8 | php-enchant | 0:7.4.19-2.module+el8.6.0+20552+0a59ce9f |
| Oracle Linux · 8 | php-ffi | 0:7.4.19-2.module+el8.6.0+20552+0a59ce9f |
| Oracle Linux · 8 | php-fpm | 0:7.4.19-2.module+el8.6.0+20552+0a59ce9f |
| Oracle Linux · 8 | php-gd | 0:7.4.19-2.module+el8.6.0+20552+0a59ce9f |
| Oracle Linux · 8 | php-gmp | 0:7.4.19-2.module+el8.6.0+20552+0a59ce9f |
| Oracle Linux · 8 | php-intl | 0:7.4.19-2.module+el8.6.0+20552+0a59ce9f |
| Oracle Linux · 8 | php-json | 0:7.4.19-2.module+el8.6.0+20552+0a59ce9f |
| Oracle Linux · 8 | php-ldap | 0:7.4.19-2.module+el8.6.0+20552+0a59ce9f |
| Oracle Linux · 8 | php-mbstring | 0:7.4.19-2.module+el8.6.0+20552+0a59ce9f |
| Oracle Linux · 8 | php-mysqlnd | 0:7.4.19-2.module+el8.6.0+20552+0a59ce9f |
| Oracle Linux · 8 | php-odbc | 0:7.4.19-2.module+el8.6.0+20552+0a59ce9f |
| Oracle Linux · 8 | php-opcache | 0:7.4.19-2.module+el8.6.0+20552+0a59ce9f |
| Oracle Linux · 8 | php-pdo | 0:7.4.19-2.module+el8.6.0+20552+0a59ce9f |
| Oracle Linux · 8 | php-pear | 1:1.10.12-1.module+el8.3.0+7685+72d70b58 |
| Oracle Linux · 8 | php-pecl-apcu | 0:5.1.18-1.module+el8.3.0+7685+72d70b58 |
| Oracle Linux · 8 | php-pecl-apcu-devel | 0:5.1.18-1.module+el8.3.0+7685+72d70b58 |
| Oracle Linux · 8 | php-pecl-rrd | 0:2.0.1-1.module+el8.3.0+7685+72d70b58 |
| Oracle Linux · 8 | php-pecl-xdebug | 0:2.9.5-1.module+el8.3.0+7685+72d70b58 |
| Oracle Linux · 8 | php-pecl-zip | 0:1.18.2-1.module+el8.3.0+7685+72d70b58 |
| Oracle Linux · 8 | php-pgsql | 0:7.4.19-2.module+el8.6.0+20552+0a59ce9f |
| Oracle Linux · 8 | php-process | 0:7.4.19-2.module+el8.6.0+20552+0a59ce9f |
| Oracle Linux · 8 | php-snmp | 0:7.4.19-2.module+el8.6.0+20552+0a59ce9f |
| Oracle Linux · 8 | php-soap | 0:7.4.19-2.module+el8.6.0+20552+0a59ce9f |
| Oracle Linux · 8 | php-xml | 0:7.4.19-2.module+el8.6.0+20552+0a59ce9f |
| Oracle Linux · 8 | php-xmlrpc | 0:7.4.19-2.module+el8.6.0+20552+0a59ce9f |
Vulnerabilities 2
-
High 7.8
PHP-FPM memory access in root process leading to privilege escalation
In PHP versions 7.3.x up to and including 7.3.31, 7.4.x below 7.4.25 and 8.0.x below 8.0.12, when running PHP FPM SAPI with main FPM daemon process running as root and child worker processes running as lower-privileged users, it is possible for the child proc…
-
Medium 4.3
Incorrect URL validation in FILTER_VALIDATE_URL
In PHP versions 7.3.x below 7.3.29, 7.4.x below 7.4.21 and 8.0.x below 8.0.8, when using URL validation functionality via filter_var() function with FILTER_VALIDATE_URL parameter, an URL with invalid password field can be accepted as valid. This can lead to t…