Skip to content
OpenAdvisories
Medium RHSA-2020:1624 17 CVEs

Red Hat Security Advisory: php:7.2 security, bug fix, and enhancement update

Published Sep 13, 2024 · Updated Nov 13, 2026

Ecosystem: Red Hat

Fixed packages 69

ReleasePackageFixed in
Red Hat · RHEL 8 enterprise_linux:8::appstream apcu-panel 0:5.1.12-2.module+el8.1.0+3202+af5476b9
Red Hat · RHEL 8 enterprise_linux:8::appstream libzip 0:1.5.1-2.module+el8.1.0+3202+af5476b9
Red Hat · RHEL 8 enterprise_linux:8::appstream libzip-debuginfo 0:1.5.1-2.module+el8.1.0+3202+af5476b9
Red Hat · RHEL 8 enterprise_linux:8::appstream libzip-debugsource 0:1.5.1-2.module+el8.1.0+3202+af5476b9
Red Hat · RHEL 8 enterprise_linux:8::appstream libzip-devel 0:1.5.1-2.module+el8.1.0+3202+af5476b9
Red Hat · RHEL 8 enterprise_linux:8::appstream libzip-tools 0:1.5.1-2.module+el8.1.0+3202+af5476b9
Red Hat · RHEL 8 enterprise_linux:8::appstream libzip-tools-debuginfo 0:1.5.1-2.module+el8.1.0+3202+af5476b9
Red Hat · RHEL 8 enterprise_linux:8::appstream php 0:7.2.24-1.module+el8.2.0+4601+7c76a223
Red Hat · RHEL 8 enterprise_linux:8::appstream php-bcmath 0:7.2.24-1.module+el8.2.0+4601+7c76a223
Red Hat · RHEL 8 enterprise_linux:8::appstream php-bcmath-debuginfo 0:7.2.24-1.module+el8.2.0+4601+7c76a223
Red Hat · RHEL 8 enterprise_linux:8::appstream php-cli 0:7.2.24-1.module+el8.2.0+4601+7c76a223
Red Hat · RHEL 8 enterprise_linux:8::appstream php-cli-debuginfo 0:7.2.24-1.module+el8.2.0+4601+7c76a223
Red Hat · RHEL 8 enterprise_linux:8::appstream php-common 0:7.2.24-1.module+el8.2.0+4601+7c76a223
Red Hat · RHEL 8 enterprise_linux:8::appstream php-common-debuginfo 0:7.2.24-1.module+el8.2.0+4601+7c76a223
Red Hat · RHEL 8 enterprise_linux:8::appstream php-dba 0:7.2.24-1.module+el8.2.0+4601+7c76a223
Red Hat · RHEL 8 enterprise_linux:8::appstream php-dba-debuginfo 0:7.2.24-1.module+el8.2.0+4601+7c76a223
Red Hat · RHEL 8 enterprise_linux:8::appstream php-dbg 0:7.2.24-1.module+el8.2.0+4601+7c76a223
Red Hat · RHEL 8 enterprise_linux:8::appstream php-dbg-debuginfo 0:7.2.24-1.module+el8.2.0+4601+7c76a223
Red Hat · RHEL 8 enterprise_linux:8::appstream php-debuginfo 0:7.2.24-1.module+el8.2.0+4601+7c76a223
Red Hat · RHEL 8 enterprise_linux:8::appstream php-debugsource 0:7.2.24-1.module+el8.2.0+4601+7c76a223
Red Hat · RHEL 8 enterprise_linux:8::appstream php-devel 0:7.2.24-1.module+el8.2.0+4601+7c76a223
Red Hat · RHEL 8 enterprise_linux:8::appstream php-embedded 0:7.2.24-1.module+el8.2.0+4601+7c76a223
Red Hat · RHEL 8 enterprise_linux:8::appstream php-embedded-debuginfo 0:7.2.24-1.module+el8.2.0+4601+7c76a223
Red Hat · RHEL 8 enterprise_linux:8::appstream php-enchant 0:7.2.24-1.module+el8.2.0+4601+7c76a223
Red Hat · RHEL 8 enterprise_linux:8::appstream php-enchant-debuginfo 0:7.2.24-1.module+el8.2.0+4601+7c76a223
Red Hat · RHEL 8 enterprise_linux:8::appstream php-fpm 0:7.2.24-1.module+el8.2.0+4601+7c76a223
Red Hat · RHEL 8 enterprise_linux:8::appstream php-fpm-debuginfo 0:7.2.24-1.module+el8.2.0+4601+7c76a223
Red Hat · RHEL 8 enterprise_linux:8::appstream php-gd 0:7.2.24-1.module+el8.2.0+4601+7c76a223
Red Hat · RHEL 8 enterprise_linux:8::appstream php-gd-debuginfo 0:7.2.24-1.module+el8.2.0+4601+7c76a223
Red Hat · RHEL 8 enterprise_linux:8::appstream php-gmp 0:7.2.24-1.module+el8.2.0+4601+7c76a223
Red Hat · RHEL 8 enterprise_linux:8::appstream php-gmp-debuginfo 0:7.2.24-1.module+el8.2.0+4601+7c76a223
Red Hat · RHEL 8 enterprise_linux:8::appstream php-intl 0:7.2.24-1.module+el8.2.0+4601+7c76a223
Red Hat · RHEL 8 enterprise_linux:8::appstream php-intl-debuginfo 0:7.2.24-1.module+el8.2.0+4601+7c76a223
Red Hat · RHEL 8 enterprise_linux:8::appstream php-json 0:7.2.24-1.module+el8.2.0+4601+7c76a223
Red Hat · RHEL 8 enterprise_linux:8::appstream php-json-debuginfo 0:7.2.24-1.module+el8.2.0+4601+7c76a223
Red Hat · RHEL 8 enterprise_linux:8::appstream php-ldap 0:7.2.24-1.module+el8.2.0+4601+7c76a223
Red Hat · RHEL 8 enterprise_linux:8::appstream php-ldap-debuginfo 0:7.2.24-1.module+el8.2.0+4601+7c76a223
Red Hat · RHEL 8 enterprise_linux:8::appstream php-mbstring 0:7.2.24-1.module+el8.2.0+4601+7c76a223
Red Hat · RHEL 8 enterprise_linux:8::appstream php-mbstring-debuginfo 0:7.2.24-1.module+el8.2.0+4601+7c76a223
Red Hat · RHEL 8 enterprise_linux:8::appstream php-mysqlnd 0:7.2.24-1.module+el8.2.0+4601+7c76a223
Red Hat · RHEL 8 enterprise_linux:8::appstream php-mysqlnd-debuginfo 0:7.2.24-1.module+el8.2.0+4601+7c76a223
Red Hat · RHEL 8 enterprise_linux:8::appstream php-odbc 0:7.2.24-1.module+el8.2.0+4601+7c76a223
Red Hat · RHEL 8 enterprise_linux:8::appstream php-odbc-debuginfo 0:7.2.24-1.module+el8.2.0+4601+7c76a223
Red Hat · RHEL 8 enterprise_linux:8::appstream php-opcache 0:7.2.24-1.module+el8.2.0+4601+7c76a223
Red Hat · RHEL 8 enterprise_linux:8::appstream php-opcache-debuginfo 0:7.2.24-1.module+el8.2.0+4601+7c76a223
Red Hat · RHEL 8 enterprise_linux:8::appstream php-pdo 0:7.2.24-1.module+el8.2.0+4601+7c76a223
Red Hat · RHEL 8 enterprise_linux:8::appstream php-pdo-debuginfo 0:7.2.24-1.module+el8.2.0+4601+7c76a223
Red Hat · RHEL 8 enterprise_linux:8::appstream php-pear 1:1.10.5-9.module+el8.1.0+3202+af5476b9
Red Hat · RHEL 8 enterprise_linux:8::appstream php-pecl-apcu 0:5.1.12-2.module+el8.1.0+3202+af5476b9
Red Hat · RHEL 8 enterprise_linux:8::appstream php-pecl-apcu-debuginfo 0:5.1.12-2.module+el8.1.0+3202+af5476b9
Red Hat · RHEL 8 enterprise_linux:8::appstream php-pecl-apcu-debugsource 0:5.1.12-2.module+el8.1.0+3202+af5476b9
Red Hat · RHEL 8 enterprise_linux:8::appstream php-pecl-apcu-devel 0:5.1.12-2.module+el8.1.0+3202+af5476b9
Red Hat · RHEL 8 enterprise_linux:8::appstream php-pecl-zip 0:1.15.3-1.module+el8.1.0+3186+20164e6f
Red Hat · RHEL 8 enterprise_linux:8::appstream php-pecl-zip-debuginfo 0:1.15.3-1.module+el8.1.0+3186+20164e6f
Red Hat · RHEL 8 enterprise_linux:8::appstream php-pecl-zip-debugsource 0:1.15.3-1.module+el8.1.0+3186+20164e6f
Red Hat · RHEL 8 enterprise_linux:8::appstream php-pgsql 0:7.2.24-1.module+el8.2.0+4601+7c76a223
Red Hat · RHEL 8 enterprise_linux:8::appstream php-pgsql-debuginfo 0:7.2.24-1.module+el8.2.0+4601+7c76a223
Red Hat · RHEL 8 enterprise_linux:8::appstream php-process 0:7.2.24-1.module+el8.2.0+4601+7c76a223
Red Hat · RHEL 8 enterprise_linux:8::appstream php-process-debuginfo 0:7.2.24-1.module+el8.2.0+4601+7c76a223
Red Hat · RHEL 8 enterprise_linux:8::appstream php-recode 0:7.2.24-1.module+el8.2.0+4601+7c76a223
Red Hat · RHEL 8 enterprise_linux:8::appstream php-recode-debuginfo 0:7.2.24-1.module+el8.2.0+4601+7c76a223
Red Hat · RHEL 8 enterprise_linux:8::appstream php-snmp 0:7.2.24-1.module+el8.2.0+4601+7c76a223
Red Hat · RHEL 8 enterprise_linux:8::appstream php-snmp-debuginfo 0:7.2.24-1.module+el8.2.0+4601+7c76a223
Red Hat · RHEL 8 enterprise_linux:8::appstream php-soap 0:7.2.24-1.module+el8.2.0+4601+7c76a223
Red Hat · RHEL 8 enterprise_linux:8::appstream php-soap-debuginfo 0:7.2.24-1.module+el8.2.0+4601+7c76a223
Red Hat · RHEL 8 enterprise_linux:8::appstream php-xml 0:7.2.24-1.module+el8.2.0+4601+7c76a223
Red Hat · RHEL 8 enterprise_linux:8::appstream php-xml-debuginfo 0:7.2.24-1.module+el8.2.0+4601+7c76a223
Red Hat · RHEL 8 enterprise_linux:8::appstream php-xmlrpc 0:7.2.24-1.module+el8.2.0+4601+7c76a223
Red Hat · RHEL 8 enterprise_linux:8::appstream php-xmlrpc-debuginfo 0:7.2.24-1.module+el8.2.0+4601+7c76a223

Vulnerabilities 17

  • Medium 4.8
    CVE-2019-11034

    Heap over-read in PHP EXIF extension

    When processing certain files, PHP EXIF extension in versions 7.1.x below 7.1.28, 7.2.x below 7.2.17 and 7.3.x below 7.3.4 can be caused to read past allocated buffer in exif_process_IFD_TAG function. This may lead to information disclosure or crash.

    PHP Group PHP php5 php7.0 Ubuntu Alpine
  • Medium 4.8
    CVE-2019-11035

    Heap over-read in PHP EXIF extension

    When processing certain files, PHP EXIF extension in versions 7.1.x below 7.1.28, 7.2.x below 7.2.17 and 7.3.x below 7.3.4 can be caused to read past allocated buffer in exif_iif_add_value function. This may lead to information disclosure or crash.

    PHP Group PHP php5 php7.0 Ubuntu Alpine
  • Medium 4.8
    CVE-2019-11036

    Heap over-read in PHP EXIF extension

    When processing certain files, PHP EXIF extension in versions 7.1.x below 7.1.29, 7.2.x below 7.2.18 and 7.3.x below 7.3.5 can be caused to read past allocated buffer in exif_process_IFD_TAG function. This may lead to information disclosure or crash.

    PHP Group PHP php5 php7.0 Ubuntu Alpine
  • Medium 4.8
    CVE-2019-11040

    Heap buffer overflow in EXIF extension

    When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and 7.3.x below 7.3.6 it is possible to supply it with data what will cause it to read past the alloc…

    PHP Group PHP php5 php7.0 Ubuntu Alpine
  • Medium 4.8
    CVE-2019-11041

    heap-buffer-overflow on exif_scan_thumbnail in EXIF extension

    When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.1.x below 7.1.31, 7.2.x below 7.2.21 and 7.3.x below 7.3.8 it is possible to supply it with data what will cause it to read past the alloc…

    PHP Group PHP php5 php7.0 Ubuntu Alpine
  • Medium 4.8
    CVE-2019-11042

    heap-buffer-overflow on exif_process_user_comment in EXIF extension

    When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.1.x below 7.1.31, 7.2.x below 7.2.21 and 7.3.x below 7.3.8 it is possible to supply it with data what will cause it to read past the alloc…

    PHP Group PHP php5 php7.0 Ubuntu Alpine
  • Medium 4.2
    CVE-2019-11039

    Out-of-bounds read in iconv.c

    Function iconv_mime_decode_headers() in PHP versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and 7.3.x below 7.3.6 may perform out-of-buffer read due to integer overflow when parsing MIME headers. This may lead to information disclosure or crash.

    PHP Group PHP php5 php7.0 Ubuntu Alpine
  • Unscored —
    CVE-2018-20783

    In PHP before 5.6.39, 7.x before 7.0.33, 7.1.x before 7.1.25, and 7.2.x before 7.2.13, a buffer over-read in PHAR readi…

    php5 php7.0 php7.2 php7 Ubuntu Alpine
  • Unscored —
    CVE-2019-9020 EPSS 10%

    An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. Invalid i…

    php5 php7.0 php7.2 php7 Ubuntu Alpine
  • Unscored —
    CVE-2019-9021 EPSS 10%

    An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. A heap-ba…

    php5 php7.0 php7.2 php7 Ubuntu Alpine
  • Unscored —
    CVE-2019-9022

    An issue was discovered in PHP 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.2. dns_get_record misparses…

    php5 php7.0 php7.2 php7 Ubuntu Alpine
  • Unscored —
    CVE-2019-9023

    An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. A number …

    php5 php7.0 php7.2 php7 Ubuntu Alpine
  • Unscored —
    CVE-2019-9024

    An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. xmlrpc_de…

    php5 php7.0 php7.2 php7 Ubuntu Alpine
  • Unscored —
    CVE-2019-9637

    An issue was discovered in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. Due to the way rename() acro…

    php5 php7.0 php7.2 php7 Ubuntu Alpine
  • Unscored —
    CVE-2019-9638

    An issue was discovered in the EXIF component in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. There …

    php5 php7.0 php7.2 php7 Ubuntu Alpine
  • Unscored —
    CVE-2019-9639

    An issue was discovered in the EXIF component in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. There …

    php5 php7.0 php7.2 php7 Ubuntu Alpine
  • Unscored —
    CVE-2019-9640

    An issue was discovered in the EXIF component in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. There …

    php5 php7.0 php7.2 php7 Ubuntu Alpine

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • article
    https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.2_release_notes/index
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1680545
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1685123
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1685132
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1685398
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1685404
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1685412
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1688897
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1688922
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1688934
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1688939
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1702246
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1702256
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1707299
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1724152
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1724154
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1739459
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1739465
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_1624.json
  • report
    https://access.redhat.com/security/cve/CVE-2018-20783
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2018-20783
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2018-20783
  • report
    https://access.redhat.com/security/cve/CVE-2019-9020
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2019-9020
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2019-9020
  • report
    https://access.redhat.com/security/cve/CVE-2019-9021
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2019-9021
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2019-9021
  • report
    https://access.redhat.com/security/cve/CVE-2019-9022
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2019-9022
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2019-9022
  • report
    https://access.redhat.com/security/cve/CVE-2019-9023
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2019-9023
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2019-9023
  • report
    https://access.redhat.com/security/cve/CVE-2019-9024
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2019-9024
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2019-9024
  • report
    https://access.redhat.com/security/cve/CVE-2019-9637