Skip to content
OpenAdvisories
High USN-5479-3 1 CVE

php7.2 regression

Published Jul 7, 2022 · Updated Apr 27, 2026

Ecosystem: Ubuntu

Summary

USN-5479-1 fixed vulnerabilities in PHP. Unfortunately that update for
CVE-2022-31625 was incomplete for Ubuntu 18.04 LTS. This update fixes
the problem.

We apologize for the inconvenience.

Original advisory details:

Charles Fol discovered that PHP incorrectly handled initializing certain
arrays when handling the pg_query_params function. A remote attacker could
use this issue to cause PHP to crash, resulting in a denial of service, or
possibly execute arbitrary code. (CVE-2022-31625)

Charles Fol discovered that PHP incorrectly handled passwords in mysqlnd. A
remote attacker could use this issue to cause PHP to crash, resulting in a
denial of service, or possibly execute arbitrary code. (CVE-2022-31626)

Fixed packages 1

ReleasePackageFixed in
Ubuntu · 18.04 LTS 18.04:LTS php7.2 7.2.24-0ubuntu0.18.04.13

Vulnerabilities 1

  • High 8.1
    CVE-2022-31625

    Freeing unallocated memory in php_pgsql_free_params()

    In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when using Postgres database extension, supplying invalid parameters to the parametrized query may lead to PHP attempting to free memory using uninitialized data as pointers. This …

    PHP Group PHP php5 php7.0 Debian Ubuntu Alpine

References

  • report
    https://ubuntu.com/security/CVE-2022-31625