Summary
USN-7049-1 fixed vulnerabilities in PHP. This update provides the
corresponding updates for Ubuntu 16.04 LTS and Ubuntu 18.04 LTS.
Original advisory details:
It was discovered that PHP incorrectly handled parsing multipart form
data. A remote attacker could possibly use this issue to inject payloads
and cause PHP to ignore legitimate data. (CVE-2024-8925)
It was discovered that PHP incorrectly handled the cgi.force_redirect
configuration option due to environment variable collisions. In certain
configurations, an attacker could possibly use this issue bypass
force_redirect restrictions. (CVE-2024-8927)
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | php7.0 | 7.0.33-0ubuntu0.16.04.16+esm12 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | php7.2 | 7.2.24-0ubuntu0.18.04.17+esm6 |
Vulnerabilities 2
-
High 7.5
cgi.force_redirect configuration is bypassable due to the environment variable collision
In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, HTTP_REDIRECT_STATUS variable is used to check whether or not CGI binary is being run by the HTTP server. However, in certain scenarios, the content of this variable can be control…
-
Low 3.1
Erroneous parsing of multipart form data
In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, erroneous parsing of multipart form data contained in an HTTP POST request could lead to legitimate data not being processed. This could lead to malicious attacker able to control …