Skip to content
OpenAdvisories
High RHSA-2022:5491 4 CVEs

Red Hat Security Advisory: rh-php73-php security and bug fix update

Published Sep 13, 2024 · Updated Jun 29, 2026

Ecosystem: Red Hat

Fixed packages 30

ReleasePackageFixed in
Red Hat · RHEL 3 rhel_software_collections:3::el7 rh-php73-php 0:7.3.33-1.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7 rh-php73-php-bcmath 0:7.3.33-1.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7 rh-php73-php-cli 0:7.3.33-1.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7 rh-php73-php-common 0:7.3.33-1.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7 rh-php73-php-dba 0:7.3.33-1.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7 rh-php73-php-dbg 0:7.3.33-1.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7 rh-php73-php-debuginfo 0:7.3.33-1.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7 rh-php73-php-devel 0:7.3.33-1.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7 rh-php73-php-embedded 0:7.3.33-1.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7 rh-php73-php-enchant 0:7.3.33-1.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7 rh-php73-php-fpm 0:7.3.33-1.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7 rh-php73-php-gd 0:7.3.33-1.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7 rh-php73-php-gmp 0:7.3.33-1.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7 rh-php73-php-intl 0:7.3.33-1.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7 rh-php73-php-json 0:7.3.33-1.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7 rh-php73-php-ldap 0:7.3.33-1.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7 rh-php73-php-mbstring 0:7.3.33-1.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7 rh-php73-php-mysqlnd 0:7.3.33-1.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7 rh-php73-php-odbc 0:7.3.33-1.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7 rh-php73-php-opcache 0:7.3.33-1.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7 rh-php73-php-pdo 0:7.3.33-1.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7 rh-php73-php-pgsql 0:7.3.33-1.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7 rh-php73-php-process 0:7.3.33-1.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7 rh-php73-php-pspell 0:7.3.33-1.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7 rh-php73-php-recode 0:7.3.33-1.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7 rh-php73-php-snmp 0:7.3.33-1.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7 rh-php73-php-soap 0:7.3.33-1.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7 rh-php73-php-xml 0:7.3.33-1.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7 rh-php73-php-xmlrpc 0:7.3.33-1.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7 rh-php73-php-zip 0:7.3.33-1.el7

Vulnerabilities 4

  • High 8.1
    CVE-2022-31625

    Freeing unallocated memory in php_pgsql_free_params()

    In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when using Postgres database extension, supplying invalid parameters to the parametrized query may lead to PHP attempting to free memory using uninitialized data as pointers. This …

    PHP Group PHP php5 php7.0 Debian Ubuntu Alpine
  • High 7.8
    CVE-2021-21703

    PHP-FPM memory access in root process leading to privilege escalation

    In PHP versions 7.3.x up to and including 7.3.31, 7.4.x below 7.4.25 and 8.0.x below 8.0.12, when running PHP FPM SAPI with main FPM daemon process running as root and child worker processes running as lower-privileged users, it is possible for the child proc…

    PHP Group PHP php5 php7.0 Debian Ubuntu Alpine
  • High 7.5
    CVE-2022-31626 Public exploit EPSS 58%

    mysqlnd/pdo password buffer overflow

    In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when pdo_mysql extension with mysqlnd driver, if the third party is allowed to supply host to connect to and the password for the connection, password of excessive length can trigg…

    PHP Group PHP php5 php7.0 Debian Ubuntu Alpine
  • Medium 5.3
    CVE-2021-21707 Public exploit EPSS 25%

    Special characters break path parsing in XML functions

    In PHP versions 7.3.x below 7.3.33, 7.4.x below 7.4.26 and 8.0.x below 8.0.13, certain XML parsing functions, like simplexml_load_file(), URL-decode the filename passed to them. If that filename contains URL-encoded NUL character, this may cause the function …

    PHP Group PHP php5 php7.0 Debian Ubuntu Alpine

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2016535
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2026045
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2098521
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2098523
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2100753
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_5491.json
  • report
    https://access.redhat.com/security/cve/CVE-2021-21703
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2021-21703
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2021-21703
  • report
    https://access.redhat.com/security/cve/CVE-2021-21707
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2021-21707
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2021-21707
  • report
    https://access.redhat.com/security/cve/CVE-2022-31625
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2022-31625
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2022-31625
  • article
    https://bugs.php.net/bug.php?id=81720
  • report
    https://access.redhat.com/security/cve/CVE-2022-31626
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2022-31626
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2022-31626
  • article
    https://bugs.php.net/bug.php?id=81719