Skip to content
OpenAdvisories
Critical RHSA-2023:2903 6 CVEs

Red Hat Security Advisory: php:7.4 security update

Published Sep 16, 2024 · Updated Jun 27, 2026

Ecosystem: Red Hat

Fixed packages 75

ReleasePackageFixed in
Red Hat · RHEL 8 enterprise_linux:8::appstream apcu-panel 0:5.1.18-1.module+el8.3.0+6678+b09f589e
Red Hat · RHEL 8 enterprise_linux:8::appstream libzip 0:1.6.1-1.module+el8.3.0+6678+b09f589e
Red Hat · RHEL 8 enterprise_linux:8::appstream libzip-debuginfo 0:1.6.1-1.module+el8.3.0+6678+b09f589e
Red Hat · RHEL 8 enterprise_linux:8::appstream libzip-debugsource 0:1.6.1-1.module+el8.3.0+6678+b09f589e
Red Hat · RHEL 8 enterprise_linux:8::appstream libzip-devel 0:1.6.1-1.module+el8.3.0+6678+b09f589e
Red Hat · RHEL 8 enterprise_linux:8::appstream libzip-tools 0:1.6.1-1.module+el8.3.0+6678+b09f589e
Red Hat · RHEL 8 enterprise_linux:8::appstream libzip-tools-debuginfo 0:1.6.1-1.module+el8.3.0+6678+b09f589e
Red Hat · RHEL 8 enterprise_linux:8::appstream php 0:7.4.33-1.module+el8.8.0+17865+ef7eddfa
Red Hat · RHEL 8 enterprise_linux:8::appstream php-bcmath 0:7.4.33-1.module+el8.8.0+17865+ef7eddfa
Red Hat · RHEL 8 enterprise_linux:8::appstream php-bcmath-debuginfo 0:7.4.33-1.module+el8.8.0+17865+ef7eddfa
Red Hat · RHEL 8 enterprise_linux:8::appstream php-cli 0:7.4.33-1.module+el8.8.0+17865+ef7eddfa
Red Hat · RHEL 8 enterprise_linux:8::appstream php-cli-debuginfo 0:7.4.33-1.module+el8.8.0+17865+ef7eddfa
Red Hat · RHEL 8 enterprise_linux:8::appstream php-common 0:7.4.33-1.module+el8.8.0+17865+ef7eddfa
Red Hat · RHEL 8 enterprise_linux:8::appstream php-common-debuginfo 0:7.4.33-1.module+el8.8.0+17865+ef7eddfa
Red Hat · RHEL 8 enterprise_linux:8::appstream php-dba 0:7.4.33-1.module+el8.8.0+17865+ef7eddfa
Red Hat · RHEL 8 enterprise_linux:8::appstream php-dba-debuginfo 0:7.4.33-1.module+el8.8.0+17865+ef7eddfa
Red Hat · RHEL 8 enterprise_linux:8::appstream php-dbg 0:7.4.33-1.module+el8.8.0+17865+ef7eddfa
Red Hat · RHEL 8 enterprise_linux:8::appstream php-dbg-debuginfo 0:7.4.33-1.module+el8.8.0+17865+ef7eddfa
Red Hat · RHEL 8 enterprise_linux:8::appstream php-debuginfo 0:7.4.33-1.module+el8.8.0+17865+ef7eddfa
Red Hat · RHEL 8 enterprise_linux:8::appstream php-debugsource 0:7.4.33-1.module+el8.8.0+17865+ef7eddfa
Red Hat · RHEL 8 enterprise_linux:8::appstream php-devel 0:7.4.33-1.module+el8.8.0+17865+ef7eddfa
Red Hat · RHEL 8 enterprise_linux:8::appstream php-embedded 0:7.4.33-1.module+el8.8.0+17865+ef7eddfa
Red Hat · RHEL 8 enterprise_linux:8::appstream php-embedded-debuginfo 0:7.4.33-1.module+el8.8.0+17865+ef7eddfa
Red Hat · RHEL 8 enterprise_linux:8::appstream php-enchant 0:7.4.33-1.module+el8.8.0+17865+ef7eddfa
Red Hat · RHEL 8 enterprise_linux:8::appstream php-enchant-debuginfo 0:7.4.33-1.module+el8.8.0+17865+ef7eddfa
Red Hat · RHEL 8 enterprise_linux:8::appstream php-ffi 0:7.4.33-1.module+el8.8.0+17865+ef7eddfa
Red Hat · RHEL 8 enterprise_linux:8::appstream php-ffi-debuginfo 0:7.4.33-1.module+el8.8.0+17865+ef7eddfa
Red Hat · RHEL 8 enterprise_linux:8::appstream php-fpm 0:7.4.33-1.module+el8.8.0+17865+ef7eddfa
Red Hat · RHEL 8 enterprise_linux:8::appstream php-fpm-debuginfo 0:7.4.33-1.module+el8.8.0+17865+ef7eddfa
Red Hat · RHEL 8 enterprise_linux:8::appstream php-gd 0:7.4.33-1.module+el8.8.0+17865+ef7eddfa
Red Hat · RHEL 8 enterprise_linux:8::appstream php-gd-debuginfo 0:7.4.33-1.module+el8.8.0+17865+ef7eddfa
Red Hat · RHEL 8 enterprise_linux:8::appstream php-gmp 0:7.4.33-1.module+el8.8.0+17865+ef7eddfa
Red Hat · RHEL 8 enterprise_linux:8::appstream php-gmp-debuginfo 0:7.4.33-1.module+el8.8.0+17865+ef7eddfa
Red Hat · RHEL 8 enterprise_linux:8::appstream php-intl 0:7.4.33-1.module+el8.8.0+17865+ef7eddfa
Red Hat · RHEL 8 enterprise_linux:8::appstream php-intl-debuginfo 0:7.4.33-1.module+el8.8.0+17865+ef7eddfa
Red Hat · RHEL 8 enterprise_linux:8::appstream php-json 0:7.4.33-1.module+el8.8.0+17865+ef7eddfa
Red Hat · RHEL 8 enterprise_linux:8::appstream php-json-debuginfo 0:7.4.33-1.module+el8.8.0+17865+ef7eddfa
Red Hat · RHEL 8 enterprise_linux:8::appstream php-ldap 0:7.4.33-1.module+el8.8.0+17865+ef7eddfa
Red Hat · RHEL 8 enterprise_linux:8::appstream php-ldap-debuginfo 0:7.4.33-1.module+el8.8.0+17865+ef7eddfa
Red Hat · RHEL 8 enterprise_linux:8::appstream php-mbstring 0:7.4.33-1.module+el8.8.0+17865+ef7eddfa
Red Hat · RHEL 8 enterprise_linux:8::appstream php-mbstring-debuginfo 0:7.4.33-1.module+el8.8.0+17865+ef7eddfa
Red Hat · RHEL 8 enterprise_linux:8::appstream php-mysqlnd 0:7.4.33-1.module+el8.8.0+17865+ef7eddfa
Red Hat · RHEL 8 enterprise_linux:8::appstream php-mysqlnd-debuginfo 0:7.4.33-1.module+el8.8.0+17865+ef7eddfa
Red Hat · RHEL 8 enterprise_linux:8::appstream php-odbc 0:7.4.33-1.module+el8.8.0+17865+ef7eddfa
Red Hat · RHEL 8 enterprise_linux:8::appstream php-odbc-debuginfo 0:7.4.33-1.module+el8.8.0+17865+ef7eddfa
Red Hat · RHEL 8 enterprise_linux:8::appstream php-opcache 0:7.4.33-1.module+el8.8.0+17865+ef7eddfa
Red Hat · RHEL 8 enterprise_linux:8::appstream php-opcache-debuginfo 0:7.4.33-1.module+el8.8.0+17865+ef7eddfa
Red Hat · RHEL 8 enterprise_linux:8::appstream php-pdo 0:7.4.33-1.module+el8.8.0+17865+ef7eddfa
Red Hat · RHEL 8 enterprise_linux:8::appstream php-pdo-debuginfo 0:7.4.33-1.module+el8.8.0+17865+ef7eddfa
Red Hat · RHEL 8 enterprise_linux:8::appstream php-pear 1:1.10.13-1.module+el8.7.0+15127+a450a8db
Red Hat · RHEL 8 enterprise_linux:8::appstream php-pecl-apcu 0:5.1.18-1.module+el8.3.0+6678+b09f589e
Red Hat · RHEL 8 enterprise_linux:8::appstream php-pecl-apcu-debuginfo 0:5.1.18-1.module+el8.3.0+6678+b09f589e
Red Hat · RHEL 8 enterprise_linux:8::appstream php-pecl-apcu-debugsource 0:5.1.18-1.module+el8.3.0+6678+b09f589e
Red Hat · RHEL 8 enterprise_linux:8::appstream php-pecl-apcu-devel 0:5.1.18-1.module+el8.3.0+6678+b09f589e
Red Hat · RHEL 8 enterprise_linux:8::appstream php-pecl-rrd 0:2.0.1-1.module+el8.3.0+6678+b09f589e
Red Hat · RHEL 8 enterprise_linux:8::appstream php-pecl-rrd-debuginfo 0:2.0.1-1.module+el8.3.0+6678+b09f589e
Red Hat · RHEL 8 enterprise_linux:8::appstream php-pecl-rrd-debugsource 0:2.0.1-1.module+el8.3.0+6678+b09f589e
Red Hat · RHEL 8 enterprise_linux:8::appstream php-pecl-xdebug 0:2.9.5-1.module+el8.3.0+6678+b09f589e
Red Hat · RHEL 8 enterprise_linux:8::appstream php-pecl-xdebug-debuginfo 0:2.9.5-1.module+el8.3.0+6678+b09f589e
Red Hat · RHEL 8 enterprise_linux:8::appstream php-pecl-xdebug-debugsource 0:2.9.5-1.module+el8.3.0+6678+b09f589e
Red Hat · RHEL 8 enterprise_linux:8::appstream php-pecl-zip 0:1.18.2-1.module+el8.3.0+6678+b09f589e
Red Hat · RHEL 8 enterprise_linux:8::appstream php-pecl-zip-debuginfo 0:1.18.2-1.module+el8.3.0+6678+b09f589e
Red Hat · RHEL 8 enterprise_linux:8::appstream php-pecl-zip-debugsource 0:1.18.2-1.module+el8.3.0+6678+b09f589e
Red Hat · RHEL 8 enterprise_linux:8::appstream php-pgsql 0:7.4.33-1.module+el8.8.0+17865+ef7eddfa
Red Hat · RHEL 8 enterprise_linux:8::appstream php-pgsql-debuginfo 0:7.4.33-1.module+el8.8.0+17865+ef7eddfa
Red Hat · RHEL 8 enterprise_linux:8::appstream php-process 0:7.4.33-1.module+el8.8.0+17865+ef7eddfa
Red Hat · RHEL 8 enterprise_linux:8::appstream php-process-debuginfo 0:7.4.33-1.module+el8.8.0+17865+ef7eddfa
Red Hat · RHEL 8 enterprise_linux:8::appstream php-snmp 0:7.4.33-1.module+el8.8.0+17865+ef7eddfa
Red Hat · RHEL 8 enterprise_linux:8::appstream php-snmp-debuginfo 0:7.4.33-1.module+el8.8.0+17865+ef7eddfa
Red Hat · RHEL 8 enterprise_linux:8::appstream php-soap 0:7.4.33-1.module+el8.8.0+17865+ef7eddfa
Red Hat · RHEL 8 enterprise_linux:8::appstream php-soap-debuginfo 0:7.4.33-1.module+el8.8.0+17865+ef7eddfa
Red Hat · RHEL 8 enterprise_linux:8::appstream php-xml 0:7.4.33-1.module+el8.8.0+17865+ef7eddfa
Red Hat · RHEL 8 enterprise_linux:8::appstream php-xml-debuginfo 0:7.4.33-1.module+el8.8.0+17865+ef7eddfa
Red Hat · RHEL 8 enterprise_linux:8::appstream php-xmlrpc 0:7.4.33-1.module+el8.8.0+17865+ef7eddfa
Red Hat · RHEL 8 enterprise_linux:8::appstream php-xmlrpc-debuginfo 0:7.4.33-1.module+el8.8.0+17865+ef7eddfa

Vulnerabilities 6

  • Critical 9.8
    CVE-2022-37454

    Buffer overflow in sponge queue functions

    The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute arbitrary code or eliminate expected cryptographic properties. This occurs in the sponge function interface.

    php7.2 python3.6 python3.8 python3.7 Debian Ubuntu Azure Linux Alpine PyPI RubyGems
  • Critical 9.1
    CVE-2022-31631

    PDO::quote() may return unquoted string

    In PHP versions 8.0.* before 8.0.27, 8.1.* before 8.1.15, 8.2.* before 8.2.2 when using PDO::quote() function to quote user-supplied data for SQLite, supplying an overly long string may cause the driver to incorrectly quote the data, which may further lead to…

    PHP Group PHP php5 php7.0 Debian Ubuntu Alpine
  • Medium 6.5
    CVE-2022-31629 Public exploit EPSS 50%

    $_COOKIE names string replacement (. -> _): cookie integrity vulnerabilities

    In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the vulnerability enables network and same-site attackers to set a standard insecure cookie in the victim's browser which is treated as a `__Host-` or `__Secure-` cookie by PHP applications.

    PHP Group PHP php5 php7.0 Debian Ubuntu Alpine
  • Medium 6.5
    CVE-2022-31630 Public exploit

    OOB read due to insufficient input validation in imageloadfont()

    In PHP versions prior to 7.4.33, 8.0.25 and 8.1.12, when using imageloadfont() function in gd extension, it is possible to supply a specially crafted font file, such as if the loaded font is used with imagechar() function, the read outside allocated buffer wi…

    PHP Group PHP php7 php7.4 Debian Ubuntu Alpine
  • Low 2.3
    CVE-2022-31628

    phar wrapper can occur dos when using quine gzip file

    In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the phar uncompressor code would recursively uncompress "quines" gzip files, resulting in an infinite loop.

    PHP Group PHP php5 php7.0 Debian Ubuntu Alpine
  • Unscored —
    CVE-2017-8923

    The zend_string_extend function in Zend/zend_string.h in PHP through 7.1.5 does not prevent changes to string objects t…

    php5 php7.0 php7.2 php7.4 Ubuntu

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • article
    https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.8_release_notes/index
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2133687
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2133688
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2139280
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2140200
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2158791
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_2903.json
  • report
    https://access.redhat.com/security/cve/CVE-2017-8923
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1451700
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2017-8923
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2017-8923
  • report
    https://access.redhat.com/security/cve/CVE-2022-31628
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2022-31628
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2022-31628
  • article
    https://bugs.php.net/bug.php?id=81726
  • report
    https://access.redhat.com/security/cve/CVE-2022-31629
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2022-31629
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2022-31629
  • article
    https://bugs.php.net/bug.php?id=81727
  • report
    https://access.redhat.com/security/cve/CVE-2022-31630
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2022-31630
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2022-31630
  • article
    https://bugs.php.net/bug.php?id=81739
  • article
    https://www.php.net/ChangeLog-8.php#8.0.25
  • report
    https://access.redhat.com/security/cve/CVE-2022-31631
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2022-31631
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2022-31631
  • article
    https://bugs.php.net/bug.php?id=81740
  • report
    https://access.redhat.com/security/cve/CVE-2022-37454
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2022-37454
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2022-37454