Search CVE reports
11 – 20 of 292 results
The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined behaviour and is not guaranteed to trigger. When the check is optimised away, a malicious SOAP server...
7 affected packages
php5, php7.0, php7.2, php7.4, php8.1...
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| php5 | Not in release | Not in release | Not in release | — | — |
| php7.0 | Not in release | Not in release | Not in release | — | — |
| php7.2 | Not in release | Not in release | Not in release | — | Fixed |
| php7.4 | Not in release | Not in release | Not in release | Fixed | — |
| php8.1 | Not in release | Not in release | Fixed | — | — |
| php8.3 | Not in release | Fixed | Not in release | — | — |
| php8.5 | Fixed | Not in release | Not in release | — | — |
Some fixes available 5 of 8
The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them. A malicious or compromised MySQL server can send a truncated packet and make the client read...
7 affected packages
php5, php7.0, php7.2, php7.4, php8.1...
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| php5 | Not in release | Not in release | Not in release | — | — |
| php7.0 | Not in release | Not in release | Not in release | — | — |
| php7.2 | Not in release | Not in release | Not in release | — | Ignored |
| php7.4 | Not in release | Not in release | Not in release | Fixed | — |
| php8.1 | Not in release | Not in release | Fixed | — | — |
| php8.3 | Not in release | Fixed | Not in release | — | — |
| php8.5 | Fixed | Not in release | Not in release | — | — |
When the HTTP stream wrapper follows a redirect and the response carries a Location header with an empty value, the redirect code reads one byte past the end of the heap buffer holding the location. The value of that out-of-bounds...
7 affected packages
php5, php7.0, php7.2, php7.4, php8.1...
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| php5 | Not in release | Not in release | Not in release | — | — |
| php7.0 | Not in release | Not in release | Not in release | — | — |
| php7.2 | Not in release | Not in release | Not in release | — | Fixed |
| php7.4 | Not in release | Not in release | Not in release | Fixed | — |
| php8.1 | Not in release | Not in release | Fixed | — | — |
| php8.3 | Not in release | Fixed | Not in release | — | — |
| php8.5 | Fixed | Not in release | Not in release | — | — |
[Unknown description]
4 affected packages
libgd2, php5, php7.0, php7.2
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| libgd2 | Needs evaluation | Needs evaluation | Needs evaluation | Needs evaluation | Needs evaluation |
| php5 | Not in release | Not in release | Not in release | — | — |
| php7.0 | Not in release | Not in release | Not in release | — | — |
| php7.2 | Not in release | Not in release | Not in release | — | Needs evaluation |
Some fixes available 4 of 7
Circular symbolic links in phar archives could lead to unbounded recursion, exhausting the C stack and crashing the PHP process, in PHP versions from 8.2.* before 8.2.33, from 8.3.* before 8.3.33, from 8.4.* before 8.4.24, and...
7 affected packages
php5, php7.0, php7.2, php7.4, php8.1...
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| php5 | Not in release | Not in release | Not in release | — | — |
| php7.0 | Not in release | Not in release | Not in release | — | — |
| php7.2 | Not in release | Not in release | Not in release | — | Needs evaluation |
| php7.4 | Not in release | Not in release | Not in release | Needs evaluation | — |
| php8.1 | Not in release | Not in release | Fixed | — | — |
| php8.3 | Not in release | Fixed | Not in release | — | — |
| php8.5 | Fixed | Not in release | Not in release | — | — |
Attacker-provided inputs to bccomp() could lead to an out-of-bounds write with stack and heap corruption in PHP versions from 8.4.* before 8.4.24 and from 8.5.* before 8.5.9.
7 affected packages
php5, php7.0, php7.2, php7.4, php8.1...
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| php5 | Not in release | Not in release | Not in release | — | — |
| php7.0 | Not in release | Not in release | Not in release | — | — |
| php7.2 | Not in release | Not in release | Not in release | — | Not affected |
| php7.4 | Not in release | Not in release | Not in release | Not affected | — |
| php8.1 | Not in release | Not in release | Not affected | — | — |
| php8.3 | Not in release | Not affected | Not in release | — | — |
| php8.5 | Fixed | Not in release | Not in release | — | — |
Some fixes available 4 of 7
Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2.* before 8.2.33, from 8.3.* before 8.3.33, from 8.4.* before 8.4.24, and from 8.5.* before 8.5.9.
7 affected packages
php5, php7.0, php7.2, php7.4, php8.1...
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| php5 | Not in release | Not in release | Not in release | — | — |
| php7.0 | Not in release | Not in release | Not in release | — | — |
| php7.2 | Not in release | Not in release | Not in release | — | Needs evaluation |
| php7.4 | Not in release | Not in release | Not in release | Vulnerable | — |
| php8.1 | Not in release | Not in release | Fixed | — | — |
| php8.3 | Not in release | Fixed | Not in release | — | — |
| php8.5 | Fixed | Not in release | Not in release | — | — |
Some fixes available 3 of 7
In PHP versions 8.2.* before 8.2.32, 8.3.* before 8.3.32, 8.4.* before 8.4.23, 8.5.* before 8.5.8, the AES-WRAP-PAD algorithm implementation in OpenSSL extension contains a buffer allocation flaw. The output buffer for the AES...
8 affected packages
php5, php7.0, php7.2, php7.4, php8.1...
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| php5 | Not in release | Not in release | Not in release | — | — |
| php7.0 | Not in release | Not in release | Not in release | — | — |
| php7.2 | Not in release | Not in release | Not in release | — | Needs evaluation |
| php7.4 | Not in release | Not in release | Not in release | Needs evaluation | — |
| php8.1 | Not in release | Not in release | Fixed | — | — |
| php8.3 | Not in release | Fixed | Not in release | — | — |
| php8.4 | Not in release | Not in release | Not in release | — | — |
| php8.5 | Fixed | Not in release | Not in release | — | — |
Some fixes available 1 of 2
PHP: Failure to setup TLS with a remote server can result in a remote DoS
8 affected packages
php5, php7.0, php7.2, php7.4, php8.1...
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| php5 | Not in release | Not in release | Not in release | — | — |
| php7.0 | Not in release | Not in release | Not in release | — | — |
| php7.2 | Not in release | Not in release | Not in release | — | Not affected |
| php7.4 | Not in release | Not in release | Not in release | Not affected | — |
| php8.1 | Not in release | Not in release | Not affected | — | — |
| php8.3 | Not in release | Not affected | Not in release | — | — |
| php8.4 | Not in release | Not in release | Not in release | — | — |
| php8.5 | Fixed | Not in release | Not in release | — | — |
PHP Standard Library (PSL) is set of APIs covering async, collections, networking, I/O, cryptography, terminal UI, etc. In versions 6.1.0, 6.1.1 and 6.2.0, the Psl\H2\ServerConnection does not validate that the total bytes...
8 affected packages
php5, php7.0, php7.2, php7.4, php8.1...
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| php5 | Not in release | Not in release | Not in release | — | — |
| php7.0 | Not in release | Not in release | Not in release | — | — |
| php7.2 | Not in release | Not in release | Not in release | — | Not affected |
| php7.4 | Not in release | Not in release | Not in release | Not affected | — |
| php8.1 | Not in release | Not in release | Not affected | — | — |
| php8.3 | Not in release | Not affected | Not in release | — | — |
| php8.4 | Not in release | Not in release | Not in release | — | — |
| php8.5 | Not affected | Not in release | Not in release | — | — |