[Bugs] [Bug 13642] New: [CVE 21] php 7.4.19 CVEs found

Вт Сен 26 11:25:13 MSK 2023

https://bugzilla.rosalinux.ru/show_bug.cgi?id=13642

          Platform: 2021.1
            Bug ID: 13642
           Summary: [CVE 21] php 7.4.19 CVEs found
    Classification: ROSA-based products
           Product: ROSA Fresh
           Version: All
          Hardware: All
               URL: CVE-2017-8923, CVE-2017-9118, CVE-2017-9120,
                    CVE-2017-9224, CVE-2017-9226, CVE-2017-9227,
                    CVE-2017-9228, CVE-2017-9229, CVE-2021-21703,
                    CVE-2021-21704, CVE-2021-21705, CVE-2021-21707,
                    CVE-2021-21708, CVE-2022-31625, CVE-2022-31626,
                    CVE-2022-31628, CVE-2022-31629, CVE-2022-31630,
                    CVE-2022-37454,
                OS: Linux
            Status: CONFIRMED
          Severity: normal
          Priority: Normal
         Component: System (kernel, glibc, systemd, bash, PAM...)
          Assignee: bugs на lists.rosalinux.ru
          Reporter: y.tumanov на rosalinux.ru
        QA Contact: bugs на lists.rosalinux.ru
                CC: e.kosachev на rosalinux.ru, s.matveev на rosalinux.ru,
                    y.tumanov на rosalinux.ru
  Target Milestone: ---
             Flags: secteam_verified?

Please patch CVEs for package php version 7.4.19  
INFO (CVEs are): php 7.4.19 cves found
CVE-2017-8923
Desc: The zend_string_extend function in Zend/zend_string.h in PHP through
7.1.5 does not prevent changes to string objects that result in a negative
length, which allows remote attackers to cause a denial of service (application
crash) or possibly have unspecified other impact by leveraging a script's use
of .= with a long string.
Link: https://nvd.nist.gov/vuln/detail/CVE-2017-8923
Severity: CRITICAL
CVE-2017-9118
Desc: PHP 7.1.5 has an Out of bounds access in php_pcre_replace_impl via a
crafted preg_replace call.
Link: https://nvd.nist.gov/vuln/detail/CVE-2017-9118
Severity: HIGH
CVE-2017-9120
Desc: PHP 7.x through 7.1.5 allows remote attackers to cause a denial of
service (buffer overflow and application crash) or possibly have unspecified
other impact via a long string because of an Integer overflow in
mysqli_real_escape_string.
Link: https://nvd.nist.gov/vuln/detail/CVE-2017-9120
Severity: CRITICAL
CVE-2017-9224
Desc: An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in
Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A stack out-of-bounds
read occurs in match_at() during regular expression searching. A logical error
involving order of validation and access in match_at() could result in an
out-of-bounds read from a stack buffer.
Link: https://nvd.nist.gov/vuln/detail/CVE-2017-9224
Severity: CRITICAL
CVE-2017-9226
Desc: An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in
Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A heap out-of-bounds
write or read occurs in next_state_val() during regular expression compilation.
Octal numbers larger than 0xff are not handled correctly in fetch_token() and
fetch_token_in_cc(). A malformed regular expression containing an octal number
in the form of '\700' would produce an invalid code point value larger than
0xff in next_state_val(), resulting in an out-of-bounds write memory
corruption.
Link: https://nvd.nist.gov/vuln/detail/CVE-2017-9226
Severity: CRITICAL
CVE-2017-9227
Desc: An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in
Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A stack out-of-bounds
read occurs in mbc_enc_len() during regular expression searching. Invalid
handling of reg->dmin in forward_search_range() could result in an invalid
pointer dereference, as an out-of-bounds read from a stack buffer.
Link: https://nvd.nist.gov/vuln/detail/CVE-2017-9227
Severity: CRITICAL
CVE-2017-9228
Desc: An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in
Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A heap out-of-bounds
write occurs in bitset_set_range() during regular expression compilation due to
an uninitialized variable from an incorrect state transition. An incorrect
state transition in parse_char_class() could create an execution path that
leaves a critical local variable uninitialized until it's used as an index,
resulting in an out-of-bounds write memory corruption.
Link: https://nvd.nist.gov/vuln/detail/CVE-2017-9228
Severity: CRITICAL
CVE-2017-9229
Desc: An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in
Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A SIGSEGV occurs in
left_adjust_char_head() during regular expression compilation. Invalid handling
of reg->dmax in forward_search_range() could result in an invalid pointer
dereference, normally as an immediate denial-of-service condition.
Link: https://nvd.nist.gov/vuln/detail/CVE-2017-9229
Severity: HIGH
CVE-2021-21703
Desc: In PHP versions 7.3.x up to and including 7.3.31, 7.4.x below 7.4.25 and
8.0.x below 8.0.12, when running PHP FPM SAPI with main FPM daemon process
running as root and child worker processes running as lower-privileged users,
it is possible for the child processes to access memory shared with the main
process and write to it, modifying it in a way that would cause the root
process to conduct invalid memory reads and writes, which can be used to
escalate privileges from local unprivileged user to the root user.
Link: https://nvd.nist.gov/vuln/detail/CVE-2021-21703
Severity: HIGH
CVE-2021-21704
Desc: In PHP versions 7.3.x below 7.3.29, 7.4.x below 7.4.21 and 8.0.x below
8.0.8, when using Firebird PDO driver extension, a malicious database server
could cause crashes in various database functions, such as getAttribute(),
execute(), fetch() and others by returning invalid response data that is not
parsed correctly by the driver. This can result in crashes, denial of service
or potentially memory corruption.
Link: https://nvd.nist.gov/vuln/detail/CVE-2021-21704
Severity: MEDIUM
CVE-2021-21705
Desc: In PHP versions 7.3.x below 7.3.29, 7.4.x below 7.4.21 and 8.0.x below
8.0.8, when using URL validation functionality via filter_var() function with
FILTER_VALIDATE_URL parameter, an URL with invalid password field can be
accepted as valid. This can lead to the code incorrectly parsing the URL and
potentially leading to other security implications - like contacting a wrong
server or making a wrong access decision.
Link: https://nvd.nist.gov/vuln/detail/CVE-2021-21705
Severity: MEDIUM
CVE-2021-21707
Desc: In PHP versions 7.3.x below 7.3.33, 7.4.x below 7.4.26 and 8.0.x below
8.0.13, certain XML parsing functions, like simplexml_load_file(), URL-decode
the filename passed to them. If that filename contains URL-encoded NUL
character, this may cause the function to interpret this as the end of the
filename, thus interpreting the filename differently from what the user
intended, which may lead it to reading a different file than intended.
Link: https://nvd.nist.gov/vuln/detail/CVE-2021-21707
Severity: MEDIUM
CVE-2021-21708
Desc: In PHP versions 7.4.x below 7.4.28, 8.0.x below 8.0.16, and 8.1.x below
8.1.3, when using filter functions with FILTER_VALIDATE_FLOAT filter and
min/max limits, if the filter fails, there is a possibility to trigger use of
allocated memory after free, which can result it crashes, and potentially in
overwrite of other memory chunks and RCE. This issue affects: code that uses
FILTER_VALIDATE_FLOAT with min/max limits.
Link: https://nvd.nist.gov/vuln/detail/CVE-2021-21708
Severity: CRITICAL
CVE-2022-31625
Desc: In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below
8.1.7, when using Postgres database extension, supplying invalid parameters to
the parametrized query may lead to PHP attempting to free memory using
uninitialized data as pointers. This could lead to RCE vulnerability or denial
of service.
Link: https://nvd.nist.gov/vuln/detail/CVE-2022-31625
Severity: HIGH
CVE-2022-31626
Desc: In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below
8.1.7, when pdo_mysql extension with mysqlnd driver, if the third party is
allowed to supply host to connect to and the password for the connection,
password of excessive length can trigger a buffer overflow in PHP, which can
lead to a remote code execution vulnerability.
Link: https://nvd.nist.gov/vuln/detail/CVE-2022-31626
Severity: HIGH
CVE-2022-31628
Desc: In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the phar uncompressor
code would recursively uncompress "quines" gzip files, resulting in an infinite
loop.
Link: https://nvd.nist.gov/vuln/detail/CVE-2022-31628
Severity: MEDIUM
CVE-2022-31629
Desc: In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the vulnerability
enables network and same-site attackers to set a standard insecure cookie in
the victim's browser which is treated as a `__Host-` or `__Secure-` cookie by
PHP applications.
Link: https://nvd.nist.gov/vuln/detail/CVE-2022-31629
Severity: MEDIUM
CVE-2022-31630
Desc: In PHP versions prior to 7.4.33, 8.0.25 and 8.2.12, when using
imageloadfont() function in gd extension, it is possible to supply a specially
crafted font file, such as if the loaded font is used with imagechar()
function, the read outside allocated buffer will be used. This can lead to
crashes or disclosure of confidential information.
Link: https://nvd.nist.gov/vuln/detail/CVE-2022-31630
Severity: HIGH
CVE-2022-37454
Desc: The Keccak XKCP SHA-3 reference implementation before fdc6fef has an
integer overflow and resultant buffer overflow that allows attackers to execute
arbitrary code or eliminate expected cryptographic properties. This occurs in
the sponge function interface.
Link: https://nvd.nist.gov/vuln/detail/CVE-2022-37454
Severity: CRITICAL

-- 
You are receiving this mail because:
You are the QA Contact for the bug.
You are the assignee for the bug.
----------- следущая часть -----------
Вложение в формате HTML было извлечено&hellip;
URL: <http://lists.rosalinux.ru/pipermail/bugs/attachments/20230926/d86a98d3/attachment-0001.html>