Skip to content
OpenAdvisories
Medium ELSA-2023-2903 5 CVEs

Moderate: php:7.4 security update (Oracle Linux 8)

Published May 24, 2023 · Updated May 24, 2023

Summary

libzip
[1.6.1-1]
- update to 1.6.1
- enable lzma support

[1.5.2-1]
- update to 1.5.2
- add all explicit cmake options to ensure openssl is used
even in local build with other lilbraries available

[1.5.1-1]
- update to 1.5.1
- drop dependency on zlib-devel and bzip2-devel no more
referenced in libzip.pc
- drop rpath patch merged upstream

[1.5.0-2]
- add dependency on zlib-devel and bzip2-devel #1556068

[1.5.0-1]
- update to 1.5.0
- use openssl for cryptography instead of bundled custom AES implementation

[1.4.0-5]
- missing BR on C compiler
- use ldconfig_scriptlets

[1.4.0-4]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild

[1.4.0-3]
- add upstream patch and drop multilib hack

[1.4.0-2]
- re-add multilib hack #1529886

[1.4.0-1]
- update to 1.4.0
- switch to cmake
- add upstream patch for lib64

[1.3.2-1]
- update to 1.3.2
- drop multilib header hack
- change URL to https://libzip.org/
- test suite now ok on all arch

[1.3.0-2]
- use multilib-rpm-config for multilib hacks

[1.3.0-1]
- update to 1.3.0
- add dependency on bzip2 library
- ignore 3 tests failing on 32-bit

[1.2.0-3]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild

[1.2.0-2]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild

[1.2.0-1]
- update to 1.2.0
- soname bump to 5

[1.2.0-0]
- update to 1.2.0
- soname bump to 5
- temporarily keep libzip.so.4

[1.1.3-2]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild

[1.1.3-1]
- update to 1.1.3

[1.1.2-1]
- update to 1.1.2
- add BR on perl(Getopt::Long)

[1.1.1-1]
- update to 1.1.1

[1.1-2]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild

[1.1-1]
- update to 1.1
- new ziptool command
- add fix for undefined optopt in ziptool.c (upstream)

[1.0.1-3]
- fix libzip-tools summary #1288424

[1.0.1-2]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild

[1.0.1-1]
- update to 1.0.1
- soname bump from .2 to .4
- drop ziptorrent
- create 'tools' sub package

[0.11.2-5]
- actually apply patch (using %autosetup)

[0.11.2-4]
- CVE-2015-2331: integer overflow when processing ZIP archives (#1204676,#1204677)

[0.11.2-3]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild

[0.11.2-2]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild

[0.11.2-1]
- update to 0.11.2
- run test during build

[0.11.1-3]
- replace php patch with upstream one

[0.11.1-2]
- include API-CHANGES and LICENSE in package doc

[0.11.1-1]
- update to 0.11.1

[0.10.1-7]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild

[0.10.1-6]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild

[0.10.1-5]
- fix typo in multiarch (#866171)

[0.10.1-4]
- Warning about conflicting contexts for /usr/lib64/libzip/include/zipconf.h versus /usr/include/zipconf-64.h (#853954)

[0.10.1-3]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild

[0.10.1-2]
- spec cleanup, better multilib fix

[0.10.1-1]
- update to 0.10.1 (security fix only)
- fixes for CVE-2012-1162 and CVE-2012-1163

[0.10-2]
- try to fix ARM issue (#799684)

[0.10-1]
- update to 0.10
- apply patch with changes from php bundled lib (thanks spot)
- handle multiarch headers (ex from MySQL)

[0.9.3-4]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild

[0.9.3-3]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild

[0.9.3-2]
- Cleaned up pkgconfig deps which are now automatically handled by RPM.

[0.9.3-1]
- Updated to libzip 0.9.3

[0.9-4]
- Use bzipped upstream tarball.

[0.9-3]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild

[0.9-2]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild

[0.9-1]
- libzip-0.9

[0.8-5]
- rebuild for new gcc-4.3

[0.8-4]
- use better workaround for removing rpaths

[0.8-3]
- require pkgconfig in devel subpkg
- move api description to devel subpkg
- keep timestamps in %install
- avoid lib64 rpaths

[0.8-2]
- Change License to BSD

[0.8-1]
- Initial version for Fedora

php-pear
php-pecl-apcu
[5.1.18-1]
- update to 5.1.18

[5.1.17-1]
- update to 5.1.17

[5.1.12-1]
- update to 5.1.12 (stable)

[5.1.11-1]
- update to 5.1.11 (stable)

[5.1.10-1]
- update to 5.1.10 (stable)

[5.1.9-3]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild

[5.1.9-2]
- undefine _strict_symbol_defs_build

[5.1.9-1]
- Update to 5.1.9 (php 7, stable)

[5.1.8-5]
- rebuild for https://fedoraproject.org/wiki/Changes/php72

[5.1.8-4]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild

[5.1.8-3]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild

[5.1.8-2]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild

[5.1.8-1]
- Update to 5.1.8 (php 7, stable)

[5.1.7-2]
- rebuild for https://fedoraproject.org/wiki/Changes/php71

[5.1.7-1]
- Update to 5.1.7 (php 7, stable)

[5.1.6-1]
- Update to 5.1.6 (php 7, stable)

[5.1.5-1]
- Update to 5.1.5 (php 7, stable)

[4.0.11-1]
- Update to 4.0.11 (stable)
- fix license usage and spec cleanup

[4.0.10-4]
- add upstream patch, fix FTBFS with 5.6.21RC1, thanks Koschei

[4.0.10-3]
- drop scriptlets (replaced file triggers in php-pear)

[4.0.10-2]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild

[4.0.10-1]
- Update to 4.0.10 (stable)

[4.0.8-1]
- Update to 4.0.8

[4.0.7-2]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild

[4.0.7-1]
- Update to 4.0.7

[4.0.6-3]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild

[4.0.6-2]
- rebuild for https://fedoraproject.org/wiki/Changes/Php56

[4.0.6-1]
- Update to 4.0.6 (beta)

[4.0.4-3]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild

[4.0.4-2]
- add numerical prefix to extension configuration file

[4.0.4-1]
- Update to 4.0.4 (beta)

[4.0.3-1]
- Update to 4.0.3 (beta)
- install doc in pecl doc_dir
- install tests in pecl test_dir (in devel)
- cleanup SCL stuff

[4.0.2-3]
- EPEL-7 build

[4.0.2-2

Fixed packages 37

ReleasePackageFixed in
Oracle Linux · 8 apcu-panel 0:5.1.18-1.module+el8.3.0+7685+72d70b58
Oracle Linux · 8 libzip 0:1.6.1-1.module+el8.3.0+7685+72d70b58
Oracle Linux · 8 libzip-devel 0:1.6.1-1.module+el8.3.0+7685+72d70b58
Oracle Linux · 8 libzip-tools 0:1.6.1-1.module+el8.3.0+7685+72d70b58
Oracle Linux · 8 php 0:7.4.33-1.module+el8.8.0+20974+ef7eddfa
Oracle Linux · 8 php-bcmath 0:7.4.33-1.module+el8.8.0+20974+ef7eddfa
Oracle Linux · 8 php-cli 0:7.4.33-1.module+el8.8.0+20974+ef7eddfa
Oracle Linux · 8 php-common 0:7.4.33-1.module+el8.8.0+20974+ef7eddfa
Oracle Linux · 8 php-dba 0:7.4.33-1.module+el8.8.0+20974+ef7eddfa
Oracle Linux · 8 php-dbg 0:7.4.33-1.module+el8.8.0+20974+ef7eddfa
Oracle Linux · 8 php-devel 0:7.4.33-1.module+el8.8.0+20974+ef7eddfa
Oracle Linux · 8 php-embedded 0:7.4.33-1.module+el8.8.0+20974+ef7eddfa
Oracle Linux · 8 php-enchant 0:7.4.33-1.module+el8.8.0+20974+ef7eddfa
Oracle Linux · 8 php-ffi 0:7.4.33-1.module+el8.8.0+20974+ef7eddfa
Oracle Linux · 8 php-fpm 0:7.4.33-1.module+el8.8.0+20974+ef7eddfa
Oracle Linux · 8 php-gd 0:7.4.33-1.module+el8.8.0+20974+ef7eddfa
Oracle Linux · 8 php-gmp 0:7.4.33-1.module+el8.8.0+20974+ef7eddfa
Oracle Linux · 8 php-intl 0:7.4.33-1.module+el8.8.0+20974+ef7eddfa
Oracle Linux · 8 php-json 0:7.4.33-1.module+el8.8.0+20974+ef7eddfa
Oracle Linux · 8 php-ldap 0:7.4.33-1.module+el8.8.0+20974+ef7eddfa
Oracle Linux · 8 php-mbstring 0:7.4.33-1.module+el8.8.0+20974+ef7eddfa
Oracle Linux · 8 php-mysqlnd 0:7.4.33-1.module+el8.8.0+20974+ef7eddfa
Oracle Linux · 8 php-odbc 0:7.4.33-1.module+el8.8.0+20974+ef7eddfa
Oracle Linux · 8 php-opcache 0:7.4.33-1.module+el8.8.0+20974+ef7eddfa
Oracle Linux · 8 php-pdo 0:7.4.33-1.module+el8.8.0+20974+ef7eddfa
Oracle Linux · 8 php-pear 1:1.10.13-1.module+el8.7.0+20800+8e29b882
Oracle Linux · 8 php-pecl-apcu 0:5.1.18-1.module+el8.3.0+7685+72d70b58
Oracle Linux · 8 php-pecl-apcu-devel 0:5.1.18-1.module+el8.3.0+7685+72d70b58
Oracle Linux · 8 php-pecl-rrd 0:2.0.1-1.module+el8.3.0+7685+72d70b58
Oracle Linux · 8 php-pecl-xdebug 0:2.9.5-1.module+el8.3.0+7685+72d70b58
Oracle Linux · 8 php-pecl-zip 0:1.18.2-1.module+el8.3.0+7685+72d70b58
Oracle Linux · 8 php-pgsql 0:7.4.33-1.module+el8.8.0+20974+ef7eddfa
Oracle Linux · 8 php-process 0:7.4.33-1.module+el8.8.0+20974+ef7eddfa
Oracle Linux · 8 php-snmp 0:7.4.33-1.module+el8.8.0+20974+ef7eddfa
Oracle Linux · 8 php-soap 0:7.4.33-1.module+el8.8.0+20974+ef7eddfa
Oracle Linux · 8 php-xml 0:7.4.33-1.module+el8.8.0+20974+ef7eddfa
Oracle Linux · 8 php-xmlrpc 0:7.4.33-1.module+el8.8.0+20974+ef7eddfa

Vulnerabilities 5

  • Critical 9.8

    Buffer overflow in sponge queue functions

    The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute arbitrary code or eliminate expected cryptographic properties. This occurs in the sponge function interface.

  • Critical 9.1

    PDO::quote() may return unquoted string

    In PHP versions 8.0.* before 8.0.27, 8.1.* before 8.1.15, 8.2.* before 8.2.2 when using PDO::quote() function to quote user-supplied data for SQLite, supplying an overly long string may cause the driver to incorrectly quote the data, which may further lead to…

  • Medium 6.5
    CVE-2022-31629 Public exploit EPSS 50%

    $_COOKIE names string replacement (. -> _): cookie integrity vulnerabilities

    In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the vulnerability enables network and same-site attackers to set a standard insecure cookie in the victim's browser which is treated as a `__Host-` or `__Secure-` cookie by PHP applications.

  • Medium 6.5
    CVE-2022-31630 Public exploit

    OOB read due to insufficient input validation in imageloadfont()

    In PHP versions prior to 7.4.33, 8.0.25 and 8.1.12, when using imageloadfont() function in gd extension, it is possible to supply a specially crafted font file, such as if the loaded font is used with imagechar() function, the read outside allocated buffer wi…

  • Low 2.3

    phar wrapper can occur dos when using quine gzip file

    In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the phar uncompressor code would recursively uncompress "quines" gzip files, resulting in an infinite loop.