Skip to content
OpenAdvisories
Medium ELSA-2022-7624 2 CVEs

Moderate: php:8.0 security, bug fix, and enhancement update (Oracle Linux 8)

Published Nov 15, 2022 · Updated Nov 15, 2022

Ecosystem: Oracle Linux

Summary

libzip
[1.7.3-1]
- update to 1.7.3

php-pecl-apcu
[5.1.20-1]
- update to 5.1.20

php-pecl-rrd
[2.0.3-1]
- update to 2.0.3

php-pecl-xdebug3
[3.1.2-1]
- update to 3.1.2 rhbz#2030322

Fixed packages 35

ReleasePackageFixed in
Oracle Linux · 8 apcu-panel 0:5.1.20-1.module+el8.6.0+20568+84712317
Oracle Linux · 8 libzip 0:1.7.3-1.module+el8.6.0+20568+84712317
Oracle Linux · 8 libzip-devel 0:1.7.3-1.module+el8.6.0+20568+84712317
Oracle Linux · 8 libzip-tools 0:1.7.3-1.module+el8.6.0+20568+84712317
Oracle Linux · 8 php 0:8.0.20-2.module+el8.7.0+20803+bb5ab920
Oracle Linux · 8 php-bcmath 0:8.0.20-2.module+el8.7.0+20803+bb5ab920
Oracle Linux · 8 php-cli 0:8.0.20-2.module+el8.7.0+20803+bb5ab920
Oracle Linux · 8 php-common 0:8.0.20-2.module+el8.7.0+20803+bb5ab920
Oracle Linux · 8 php-dba 0:8.0.20-2.module+el8.7.0+20803+bb5ab920
Oracle Linux · 8 php-dbg 0:8.0.20-2.module+el8.7.0+20803+bb5ab920
Oracle Linux · 8 php-devel 0:8.0.20-2.module+el8.7.0+20803+bb5ab920
Oracle Linux · 8 php-embedded 0:8.0.20-2.module+el8.7.0+20803+bb5ab920
Oracle Linux · 8 php-enchant 0:8.0.20-2.module+el8.7.0+20803+bb5ab920
Oracle Linux · 8 php-ffi 0:8.0.20-2.module+el8.7.0+20803+bb5ab920
Oracle Linux · 8 php-fpm 0:8.0.20-2.module+el8.7.0+20803+bb5ab920
Oracle Linux · 8 php-gd 0:8.0.20-2.module+el8.7.0+20803+bb5ab920
Oracle Linux · 8 php-gmp 0:8.0.20-2.module+el8.7.0+20803+bb5ab920
Oracle Linux · 8 php-intl 0:8.0.20-2.module+el8.7.0+20803+bb5ab920
Oracle Linux · 8 php-ldap 0:8.0.20-2.module+el8.7.0+20803+bb5ab920
Oracle Linux · 8 php-mbstring 0:8.0.20-2.module+el8.7.0+20803+bb5ab920
Oracle Linux · 8 php-mysqlnd 0:8.0.20-2.module+el8.7.0+20803+bb5ab920
Oracle Linux · 8 php-odbc 0:8.0.20-2.module+el8.7.0+20803+bb5ab920
Oracle Linux · 8 php-opcache 0:8.0.20-2.module+el8.7.0+20803+bb5ab920
Oracle Linux · 8 php-pdo 0:8.0.20-2.module+el8.7.0+20803+bb5ab920
Oracle Linux · 8 php-pear 1:1.10.13-1.module+el8.6.0+20568+84712317
Oracle Linux · 8 php-pecl-apcu 0:5.1.20-1.module+el8.6.0+20568+84712317
Oracle Linux · 8 php-pecl-apcu-devel 0:5.1.20-1.module+el8.6.0+20568+84712317
Oracle Linux · 8 php-pecl-rrd 0:2.0.3-1.module+el8.6.0+20568+84712317
Oracle Linux · 8 php-pecl-xdebug3 0:3.1.2-1.module+el8.6.0+20568+84712317
Oracle Linux · 8 php-pecl-zip 0:1.19.2-1.module+el8.6.0+20568+84712317
Oracle Linux · 8 php-pgsql 0:8.0.20-2.module+el8.7.0+20803+bb5ab920
Oracle Linux · 8 php-process 0:8.0.20-2.module+el8.7.0+20803+bb5ab920
Oracle Linux · 8 php-snmp 0:8.0.20-2.module+el8.7.0+20803+bb5ab920
Oracle Linux · 8 php-soap 0:8.0.20-2.module+el8.7.0+20803+bb5ab920
Oracle Linux · 8 php-xml 0:8.0.20-2.module+el8.7.0+20803+bb5ab920

Vulnerabilities 2

  • High 8.2
    CVE-2021-21708

    UAF due to php_filter_float() failing

    In PHP versions 7.4.x below 7.4.28, 8.0.x below 8.0.16, and 8.1.x below 8.1.3, when using filter functions with FILTER_VALIDATE_FLOAT filter and min/max limits, if the filter fails, there is a possibility to trigger use of allocated memory after free, which c…

    PHP Group PHP php7 php7.4 Debian Ubuntu Alpine
  • High 8.1
    CVE-2022-31625

    Freeing unallocated memory in php_pgsql_free_params()

    In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when using Postgres database extension, supplying invalid parameters to the parametrized query may lead to PHP attempting to free memory using uninitialized data as pointers. This …

    PHP Group PHP php5 php7.0 Debian Ubuntu Alpine