Skip to content
OpenAdvisories
High ELSA-2022-5468 1 CVE

Important: php:8.0 security update (Oracle Linux 8)

Published Jul 4, 2022 · Updated Jul 4, 2022

Ecosystem: Oracle Linux

Summary

php
[8.0.13-3]
- fix password of excessive length triggers buffer overflow leading to RCE
CVE-2022-31626

Fixed packages 35

ReleasePackageFixed in
Oracle Linux · 8 apcu-panel 0:5.1.20-1.module+el8.6.0+20568+84712317
Oracle Linux · 8 libzip 0:1.7.3-1.module+el8.6.0+20568+84712317
Oracle Linux · 8 libzip-devel 0:1.7.3-1.module+el8.6.0+20568+84712317
Oracle Linux · 8 libzip-tools 0:1.7.3-1.module+el8.6.0+20568+84712317
Oracle Linux · 8 php 0:8.0.13-3.module+el8.6.0+20694+4397942f
Oracle Linux · 8 php-bcmath 0:8.0.13-3.module+el8.6.0+20694+4397942f
Oracle Linux · 8 php-cli 0:8.0.13-3.module+el8.6.0+20694+4397942f
Oracle Linux · 8 php-common 0:8.0.13-3.module+el8.6.0+20694+4397942f
Oracle Linux · 8 php-dba 0:8.0.13-3.module+el8.6.0+20694+4397942f
Oracle Linux · 8 php-dbg 0:8.0.13-3.module+el8.6.0+20694+4397942f
Oracle Linux · 8 php-devel 0:8.0.13-3.module+el8.6.0+20694+4397942f
Oracle Linux · 8 php-embedded 0:8.0.13-3.module+el8.6.0+20694+4397942f
Oracle Linux · 8 php-enchant 0:8.0.13-3.module+el8.6.0+20694+4397942f
Oracle Linux · 8 php-ffi 0:8.0.13-3.module+el8.6.0+20694+4397942f
Oracle Linux · 8 php-fpm 0:8.0.13-3.module+el8.6.0+20694+4397942f
Oracle Linux · 8 php-gd 0:8.0.13-3.module+el8.6.0+20694+4397942f
Oracle Linux · 8 php-gmp 0:8.0.13-3.module+el8.6.0+20694+4397942f
Oracle Linux · 8 php-intl 0:8.0.13-3.module+el8.6.0+20694+4397942f
Oracle Linux · 8 php-ldap 0:8.0.13-3.module+el8.6.0+20694+4397942f
Oracle Linux · 8 php-mbstring 0:8.0.13-3.module+el8.6.0+20694+4397942f
Oracle Linux · 8 php-mysqlnd 0:8.0.13-3.module+el8.6.0+20694+4397942f
Oracle Linux · 8 php-odbc 0:8.0.13-3.module+el8.6.0+20694+4397942f
Oracle Linux · 8 php-opcache 0:8.0.13-3.module+el8.6.0+20694+4397942f
Oracle Linux · 8 php-pdo 0:8.0.13-3.module+el8.6.0+20694+4397942f
Oracle Linux · 8 php-pear 1:1.10.13-1.module+el8.6.0+20568+84712317
Oracle Linux · 8 php-pecl-apcu 0:5.1.20-1.module+el8.6.0+20568+84712317
Oracle Linux · 8 php-pecl-apcu-devel 0:5.1.20-1.module+el8.6.0+20568+84712317
Oracle Linux · 8 php-pecl-rrd 0:2.0.3-1.module+el8.6.0+20568+84712317
Oracle Linux · 8 php-pecl-xdebug3 0:3.1.2-1.module+el8.6.0+20568+84712317
Oracle Linux · 8 php-pecl-zip 0:1.19.2-1.module+el8.6.0+20568+84712317
Oracle Linux · 8 php-pgsql 0:8.0.13-3.module+el8.6.0+20694+4397942f
Oracle Linux · 8 php-process 0:8.0.13-3.module+el8.6.0+20694+4397942f
Oracle Linux · 8 php-snmp 0:8.0.13-3.module+el8.6.0+20694+4397942f
Oracle Linux · 8 php-soap 0:8.0.13-3.module+el8.6.0+20694+4397942f
Oracle Linux · 8 php-xml 0:8.0.13-3.module+el8.6.0+20694+4397942f

Vulnerabilities 1

  • High 7.5
    CVE-2022-31626 Public exploit EPSS 58%

    mysqlnd/pdo password buffer overflow

    In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when pdo_mysql extension with mysqlnd driver, if the third party is allowed to supply host to connect to and the password for the connection, password of excessive length can trigg…

    PHP Group PHP php5 php7.0 Debian Ubuntu Alpine