Skip to content
OpenAdvisories
High USN-5479-1 2 CVEs

php7.2, php7.4, php8.0, php8.1 vulnerabilities

Published Jun 15, 2022 · Updated Apr 27, 2026

Ecosystem: Ubuntu

Summary

Charles Fol discovered that PHP incorrectly handled initializing certain
arrays when handling the pg_query_params function. A remote attacker could
use this issue to cause PHP to crash, resulting in a denial of service, or
possibly execute arbitrary code. (CVE-2022-31625)

Charles Fol discovered that PHP incorrectly handled passwords in mysqlnd. A
remote attacker could use this issue to cause PHP to crash, resulting in a
denial of service, or possibly execute arbitrary code. (CVE-2022-31626)

Fixed packages 3

ReleasePackageFixed in
Ubuntu · 18.04 LTS 18.04:LTS php7.2 7.2.24-0ubuntu0.18.04.12
Ubuntu · 20.04 LTS 20.04:LTS php7.4 7.4.3-4ubuntu2.12
Ubuntu · 22.04 LTS 22.04:LTS php8.1 8.1.2-1ubuntu2.1

Vulnerabilities 2

  • High 8.1
    CVE-2022-31625

    Freeing unallocated memory in php_pgsql_free_params()

    In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when using Postgres database extension, supplying invalid parameters to the parametrized query may lead to PHP attempting to free memory using uninitialized data as pointers. This …

    PHP Group PHP php5 php7.0 Debian Ubuntu Alpine
  • High 7.5
    CVE-2022-31626 Public exploit EPSS 58%

    mysqlnd/pdo password buffer overflow

    In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when pdo_mysql extension with mysqlnd driver, if the third party is allowed to supply host to connect to and the password for the connection, password of excessive length can trigg…

    PHP Group PHP php5 php7.0 Debian Ubuntu Alpine

References

  • report
    https://ubuntu.com/security/CVE-2022-31625
  • report
    https://ubuntu.com/security/CVE-2022-31626