Description
PHP 7.x through 7.1.5 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a long string because of an Integer overflow in mysqli_real_escape_string.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | php7.4 | 7.4.3-4ubuntu2.10 | USN-5300-2 |
| Ubuntu 18.04 LTS | php7.2 | 7.2.24-0ubuntu0.18.04.11 | USN-5300-2 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | php7.0 | 7.0.33-0ubuntu0.16.04.16+esm3 | USN-5300-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 3 | rh-php71-php +27 | 7.1.30-1.el7 | RHSA-2019:2519 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP1 | php7 | 7.2.34-150000.4.103.1 | SUSE-SU-2022:4067-1 |
| SLES 15 | php7 | 7.2.5-4.6.1 | SUSE-SU-2022:4067-1, SUSE-SU-2018:2337-1 |
| SLES 12 SP3 | php7 | 7.0.7-50.44.1 | SUSE-SU-2018:2333-1 |
| SLES 12 | php7 | 7.0.7-50.44.1 | SUSE-SU-2018:2333-1 |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 15 SP1 | php7 | 7.2.34-150000.4.103.1 | SUSE-SU-2022:4067-1 |
| SLES for SAP 15 | php7 | 7.2.34-150000.4.103.1 | SUSE-SU-2022:4067-1 |
| SLE HPC 15 SP1 | php7 | 7.2.34-150000.4.103.1 | SUSE-SU-2022:4067-1 |
| SLE HPC 15 | php7 | 7.2.34-150000.4.103.1 | SUSE-SU-2022:4067-1 |
| SUSE Enterprise Storage 6 | php7 | 7.2.34-150000.4.103.1 | SUSE-SU-2022:4067-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | php7 | 7.4.24-1.1 | openSUSE-SU-2024:11167-1 |
| openSUSE Tumbleweed | php8 | 8.0.11-1.1 | openSUSE-SU-2024:11169-1 |
| openSUSE Leap 15.4 | php7 | 7.2.34-150000.4.103.1 | SUSE-SU-2022:4067-1 |
Advisories 10
- RHSA-2019:2519 Red Hat Security Advisory: rh-php71-php security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- USN-5300-1 php7.0 vulnerabilities Ubuntu Security Notices (USN) · Jun 25, 2026
- USN-5300-2 php7.2, php7.4 vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
- SUSE-SU-2022:4067-1 Security update for php7 SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11167-1 php7-7.4.24-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11169-1 php8-8.0.11-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2018:2337-1 Security update for php7 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2018:2333-1 Security update for php7 SUSE / openSUSE Security Updates · Feb 4, 2026
- ICSA-24-102-04 Siemens RUGGEDCOM APE1808 CISA ICS & IT advisories · May 13, 2025
- SSA-455250 SSA-455250: Multiple Vulnerabilities in Palo Alto Networks Virtual NGFW on RUGGEDCOM APE1808 Devices Before V11.1.2-h3 Siemens ProductCERT · May 13, 2025