Summary
PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.
The following packages have been upgraded to a later upstream version: php (8.1.14).
Security Fix(es):
* XKCP: buffer overflow in the SHA-3 reference implementation (CVE-2022-37454)
* php: standard insecure cookie could be treated as a '__Host-' or '__Secure-' cookie by PHP applications (CVE-2022-31629)
* php: OOB read due to insufficient input validation in imageloadfont() (CVE-2022-31630)
* php: PDO::quote() may return unquoted string due to an integer overflow (CVE-2022-31631)
* php: phar: infinite loop when decompressing quine gzip file (CVE-2022-31628)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Rocky Linux 9.2 Release Notes linked from the References section.
Fixed packages 6
| Release | Package | Fixed in |
|---|---|---|
| Rocky Linux · 9 | php-pecl-apcu | 0:5.1.21-1.module+el9.7.0+40003+454ed3c4 |
| Rocky Linux · 9 | php-pecl-rrd | 0:2.0.3-4.module+el9.7.0+40005+715283ec |
| Rocky Linux · 9 | php-pecl-rrd | 0:2.0.3-4.module+el9.7.0+40004+bf50a568 |
| Rocky Linux · 9 | php-pecl-rrd | 0:2.0.3-4.module+el9.7.0+40003+454ed3c4 |
| Rocky Linux · 9 | php-pecl-xdebug3 | 0:3.1.4-1.module+el9.7.0+40003+454ed3c4 |
| Rocky Linux · 9 | php-pecl-zip | 0:1.20.1-1.module+el9.7.0+40003+454ed3c4 |
Vulnerabilities 5
-
Critical 9.8
Buffer overflow in sponge queue functions
The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute arbitrary code or eliminate expected cryptographic properties. This occurs in the sponge function interface.
-
Critical 9.1
PDO::quote() may return unquoted string
In PHP versions 8.0.* before 8.0.27, 8.1.* before 8.1.15, 8.2.* before 8.2.2 when using PDO::quote() function to quote user-supplied data for SQLite, supplying an overly long string may cause the driver to incorrectly quote the data, which may further lead to…
-
Medium 6.5
$_COOKIE names string replacement (. -> _): cookie integrity vulnerabilities
In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the vulnerability enables network and same-site attackers to set a standard insecure cookie in the victim's browser which is treated as a `__Host-` or `__Secure-` cookie by PHP applications.
-
Medium 6.5CVE-2022-31630 Public exploit
OOB read due to insufficient input validation in imageloadfont()
In PHP versions prior to 7.4.33, 8.0.25 and 8.1.12, when using imageloadfont() function in gd extension, it is possible to supply a specially crafted font file, such as if the loaded font is used with imagechar() function, the read outside allocated buffer wi…
-
Low 2.3
phar wrapper can occur dos when using quine gzip file
In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the phar uncompressor code would recursively uncompress "quines" gzip files, resulting in an infinite loop.