Skip to content
OpenAdvisories
Medium USN-5300-1 6 CVEs

php7.0 vulnerabilities

Published Feb 22, 2022 · Updated Jun 25, 2026

Ecosystem: Ubuntu

Summary

It was discovered that PHP incorrectly handled certain scripts.
An attacker could possibly use this issue to cause a denial of service.
(CVE-2015-9253, CVE-2017-8923, CVE-2017-9118, CVE-2017-9120)

It was discovered that PHP incorrectly handled certain inputs.
An attacker could possibly use this issue to cause a denial of service,
or possibly obtain sensitive information. (CVE-2017-9119)

It was discovered that PHP incorrectly handled certain scripts with XML
parsing functions.
An attacker could possibly use this issue to obtain sensitive information.
(CVE-2021-21707)

Fixed packages 1

ReleasePackageFixed in
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS php7.0 7.0.33-0ubuntu0.16.04.16+esm3

Vulnerabilities 6

  • Medium 5.3
    CVE-2021-21707 Public exploit EPSS 25%

    Special characters break path parsing in XML functions

    In PHP versions 7.3.x below 7.3.33, 7.4.x below 7.4.26 and 8.0.x below 8.0.13, certain XML parsing functions, like simplexml_load_file(), URL-decode the filename passed to them. If that filename contains URL-encoded NUL character, this may cause the function …

    PHP Group PHP php5 php7.0 Debian Ubuntu Alpine
  • Unscored —
    CVE-2015-9253

    An issue was discovered in PHP 7.3.x before 7.3.0alpha3, 7.2.x before 7.2.8, and before 7.1.20. The php-fpm master proc…

    php5 php7.0 php7.2 php7 Ubuntu Alpine
  • Unscored —
    CVE-2017-8923

    The zend_string_extend function in Zend/zend_string.h in PHP through 7.1.5 does not prevent changes to string objects t…

    php5 php7.0 php7.2 php7.4 Ubuntu
  • Unscored —
    CVE-2017-9118

    PHP 7.1.5 has an Out of bounds access in php_pcre_replace_impl via a crafted preg_replace call.

    php5 php7.0 php7.2 php7.4 Ubuntu
  • Unscored —
    CVE-2017-9119

    The i_zval_ptr_dtor function in Zend/zend_variables.h in PHP 7.1.5 allows attackers to cause a denial of service (memor…

    php5 php7.0 php7.2 php7.4 Ubuntu
  • Unscored —
    CVE-2017-9120

    PHP 7.x through 7.1.5 allows remote attackers to cause a denial of service (buffer overflow and application crash) or p…

    php5 php7.0 php7.2 php7.4 Ubuntu

References

  • report
    https://ubuntu.com/security/CVE-2015-9253
  • report
    https://ubuntu.com/security/CVE-2017-8923
  • report
    https://ubuntu.com/security/CVE-2017-9118
  • report
    https://ubuntu.com/security/CVE-2017-9119
  • report
    https://ubuntu.com/security/CVE-2017-9120
  • report
    https://ubuntu.com/security/CVE-2021-21707