<html>
<head>
<base href="https://bugzilla.rosalinux.ru/">
</head>
<body><table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Platform</th>
<td>2021.1
</td>
</tr>
<tr>
<th>Bug ID</th>
<td><a class="bz_bug_link
bz_status_CONFIRMED "
title="CONFIRMED - [CVE 21] php 7.4.19 CVEs found"
href="https://bugzilla.rosalinux.ru/show_bug.cgi?id=13642">13642</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>[CVE 21] php 7.4.19 CVEs found
</td>
</tr>
<tr>
<th>Classification</th>
<td>ROSA-based products
</td>
</tr>
<tr>
<th>Product</th>
<td>ROSA Fresh
</td>
</tr>
<tr>
<th>Version</th>
<td>All
</td>
</tr>
<tr>
<th>Hardware</th>
<td>All
</td>
</tr>
<tr>
<th>URL</th>
<td>CVE-2017-8923, CVE-2017-9118, CVE-2017-9120, CVE-2017-9224, CVE-2017-9226, CVE-2017-9227, CVE-2017-9228, CVE-2017-9229, CVE-2021-21703, CVE-2021-21704, CVE-2021-21705, CVE-2021-21707, CVE-2021-21708, CVE-2022-31625, CVE-2022-31626, CVE-2022-31628, CVE-2022-31629, CVE-2022-31630, CVE-2022-37454,
</td>
</tr>
<tr>
<th>OS</th>
<td>Linux
</td>
</tr>
<tr>
<th>Status</th>
<td>CONFIRMED
</td>
</tr>
<tr>
<th>Severity</th>
<td>normal
</td>
</tr>
<tr>
<th>Priority</th>
<td>Normal
</td>
</tr>
<tr>
<th>Component</th>
<td>System (kernel, glibc, systemd, bash, PAM...)
</td>
</tr>
<tr>
<th>Assignee</th>
<td>bugs@lists.rosalinux.ru
</td>
</tr>
<tr>
<th>Reporter</th>
<td>y.tumanov@rosalinux.ru
</td>
</tr>
<tr>
<th>QA Contact</th>
<td>bugs@lists.rosalinux.ru
</td>
</tr>
<tr>
<th>CC</th>
<td>e.kosachev@rosalinux.ru, s.matveev@rosalinux.ru, y.tumanov@rosalinux.ru
</td>
</tr>
<tr>
<th>Target Milestone</th>
<td>---
</td>
</tr>
<tr>
<th>Flags</th>
<td>secteam_verified?
</td>
</tr></table>
<p>
<div>
<pre>Please patch CVEs for package php version 7.4.19
INFO (CVEs are): php 7.4.19 cves found
CVE-2017-8923
Desc: The zend_string_extend function in Zend/zend_string.h in PHP through
7.1.5 does not prevent changes to string objects that result in a negative
length, which allows remote attackers to cause a denial of service (application
crash) or possibly have unspecified other impact by leveraging a script's use
of .= with a long string.
Link: <a href="https://nvd.nist.gov/vuln/detail/CVE-2017-8923">https://nvd.nist.gov/vuln/detail/CVE-2017-8923</a>
Severity: CRITICAL
CVE-2017-9118
Desc: PHP 7.1.5 has an Out of bounds access in php_pcre_replace_impl via a
crafted preg_replace call.
Link: <a href="https://nvd.nist.gov/vuln/detail/CVE-2017-9118">https://nvd.nist.gov/vuln/detail/CVE-2017-9118</a>
Severity: HIGH
CVE-2017-9120
Desc: PHP 7.x through 7.1.5 allows remote attackers to cause a denial of
service (buffer overflow and application crash) or possibly have unspecified
other impact via a long string because of an Integer overflow in
mysqli_real_escape_string.
Link: <a href="https://nvd.nist.gov/vuln/detail/CVE-2017-9120">https://nvd.nist.gov/vuln/detail/CVE-2017-9120</a>
Severity: CRITICAL
CVE-2017-9224
Desc: An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in
Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A stack out-of-bounds
read occurs in match_at() during regular expression searching. A logical error
involving order of validation and access in match_at() could result in an
out-of-bounds read from a stack buffer.
Link: <a href="https://nvd.nist.gov/vuln/detail/CVE-2017-9224">https://nvd.nist.gov/vuln/detail/CVE-2017-9224</a>
Severity: CRITICAL
CVE-2017-9226
Desc: An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in
Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A heap out-of-bounds
write or read occurs in next_state_val() during regular expression compilation.
Octal numbers larger than 0xff are not handled correctly in fetch_token() and
fetch_token_in_cc(). A malformed regular expression containing an octal number
in the form of '\700' would produce an invalid code point value larger than
0xff in next_state_val(), resulting in an out-of-bounds write memory
corruption.
Link: <a href="https://nvd.nist.gov/vuln/detail/CVE-2017-9226">https://nvd.nist.gov/vuln/detail/CVE-2017-9226</a>
Severity: CRITICAL
CVE-2017-9227
Desc: An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in
Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A stack out-of-bounds
read occurs in mbc_enc_len() during regular expression searching. Invalid
handling of reg->dmin in forward_search_range() could result in an invalid
pointer dereference, as an out-of-bounds read from a stack buffer.
Link: <a href="https://nvd.nist.gov/vuln/detail/CVE-2017-9227">https://nvd.nist.gov/vuln/detail/CVE-2017-9227</a>
Severity: CRITICAL
CVE-2017-9228
Desc: An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in
Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A heap out-of-bounds
write occurs in bitset_set_range() during regular expression compilation due to
an uninitialized variable from an incorrect state transition. An incorrect
state transition in parse_char_class() could create an execution path that
leaves a critical local variable uninitialized until it's used as an index,
resulting in an out-of-bounds write memory corruption.
Link: <a href="https://nvd.nist.gov/vuln/detail/CVE-2017-9228">https://nvd.nist.gov/vuln/detail/CVE-2017-9228</a>
Severity: CRITICAL
CVE-2017-9229
Desc: An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in
Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A SIGSEGV occurs in
left_adjust_char_head() during regular expression compilation. Invalid handling
of reg->dmax in forward_search_range() could result in an invalid pointer
dereference, normally as an immediate denial-of-service condition.
Link: <a href="https://nvd.nist.gov/vuln/detail/CVE-2017-9229">https://nvd.nist.gov/vuln/detail/CVE-2017-9229</a>
Severity: HIGH
CVE-2021-21703
Desc: In PHP versions 7.3.x up to and including 7.3.31, 7.4.x below 7.4.25 and
8.0.x below 8.0.12, when running PHP FPM SAPI with main FPM daemon process
running as root and child worker processes running as lower-privileged users,
it is possible for the child processes to access memory shared with the main
process and write to it, modifying it in a way that would cause the root
process to conduct invalid memory reads and writes, which can be used to
escalate privileges from local unprivileged user to the root user.
Link: <a href="https://nvd.nist.gov/vuln/detail/CVE-2021-21703">https://nvd.nist.gov/vuln/detail/CVE-2021-21703</a>
Severity: HIGH
CVE-2021-21704
Desc: In PHP versions 7.3.x below 7.3.29, 7.4.x below 7.4.21 and 8.0.x below
8.0.8, when using Firebird PDO driver extension, a malicious database server
could cause crashes in various database functions, such as getAttribute(),
execute(), fetch() and others by returning invalid response data that is not
parsed correctly by the driver. This can result in crashes, denial of service
or potentially memory corruption.
Link: <a href="https://nvd.nist.gov/vuln/detail/CVE-2021-21704">https://nvd.nist.gov/vuln/detail/CVE-2021-21704</a>
Severity: MEDIUM
CVE-2021-21705
Desc: In PHP versions 7.3.x below 7.3.29, 7.4.x below 7.4.21 and 8.0.x below
8.0.8, when using URL validation functionality via filter_var() function with
FILTER_VALIDATE_URL parameter, an URL with invalid password field can be
accepted as valid. This can lead to the code incorrectly parsing the URL and
potentially leading to other security implications - like contacting a wrong
server or making a wrong access decision.
Link: <a href="https://nvd.nist.gov/vuln/detail/CVE-2021-21705">https://nvd.nist.gov/vuln/detail/CVE-2021-21705</a>
Severity: MEDIUM
CVE-2021-21707
Desc: In PHP versions 7.3.x below 7.3.33, 7.4.x below 7.4.26 and 8.0.x below
8.0.13, certain XML parsing functions, like simplexml_load_file(), URL-decode
the filename passed to them. If that filename contains URL-encoded NUL
character, this may cause the function to interpret this as the end of the
filename, thus interpreting the filename differently from what the user
intended, which may lead it to reading a different file than intended.
Link: <a href="https://nvd.nist.gov/vuln/detail/CVE-2021-21707">https://nvd.nist.gov/vuln/detail/CVE-2021-21707</a>
Severity: MEDIUM
CVE-2021-21708
Desc: In PHP versions 7.4.x below 7.4.28, 8.0.x below 8.0.16, and 8.1.x below
8.1.3, when using filter functions with FILTER_VALIDATE_FLOAT filter and
min/max limits, if the filter fails, there is a possibility to trigger use of
allocated memory after free, which can result it crashes, and potentially in
overwrite of other memory chunks and RCE. This issue affects: code that uses
FILTER_VALIDATE_FLOAT with min/max limits.
Link: <a href="https://nvd.nist.gov/vuln/detail/CVE-2021-21708">https://nvd.nist.gov/vuln/detail/CVE-2021-21708</a>
Severity: CRITICAL
CVE-2022-31625
Desc: In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below
8.1.7, when using Postgres database extension, supplying invalid parameters to
the parametrized query may lead to PHP attempting to free memory using
uninitialized data as pointers. This could lead to RCE vulnerability or denial
of service.
Link: <a href="https://nvd.nist.gov/vuln/detail/CVE-2022-31625">https://nvd.nist.gov/vuln/detail/CVE-2022-31625</a>
Severity: HIGH
CVE-2022-31626
Desc: In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below
8.1.7, when pdo_mysql extension with mysqlnd driver, if the third party is
allowed to supply host to connect to and the password for the connection,
password of excessive length can trigger a buffer overflow in PHP, which can
lead to a remote code execution vulnerability.
Link: <a href="https://nvd.nist.gov/vuln/detail/CVE-2022-31626">https://nvd.nist.gov/vuln/detail/CVE-2022-31626</a>
Severity: HIGH
CVE-2022-31628
Desc: In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the phar uncompressor
code would recursively uncompress "quines" gzip files, resulting in an infinite
loop.
Link: <a href="https://nvd.nist.gov/vuln/detail/CVE-2022-31628">https://nvd.nist.gov/vuln/detail/CVE-2022-31628</a>
Severity: MEDIUM
CVE-2022-31629
Desc: In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the vulnerability
enables network and same-site attackers to set a standard insecure cookie in
the victim's browser which is treated as a `__Host-` or `__Secure-` cookie by
PHP applications.
Link: <a href="https://nvd.nist.gov/vuln/detail/CVE-2022-31629">https://nvd.nist.gov/vuln/detail/CVE-2022-31629</a>
Severity: MEDIUM
CVE-2022-31630
Desc: In PHP versions prior to 7.4.33, 8.0.25 and 8.2.12, when using
imageloadfont() function in gd extension, it is possible to supply a specially
crafted font file, such as if the loaded font is used with imagechar()
function, the read outside allocated buffer will be used. This can lead to
crashes or disclosure of confidential information.
Link: <a href="https://nvd.nist.gov/vuln/detail/CVE-2022-31630">https://nvd.nist.gov/vuln/detail/CVE-2022-31630</a>
Severity: HIGH
CVE-2022-37454
Desc: The Keccak XKCP SHA-3 reference implementation before fdc6fef has an
integer overflow and resultant buffer overflow that allows attackers to execute
arbitrary code or eliminate expected cryptographic properties. This occurs in
the sponge function interface.
Link: <a href="https://nvd.nist.gov/vuln/detail/CVE-2022-37454">https://nvd.nist.gov/vuln/detail/CVE-2022-37454</a>
Severity: CRITICAL</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are the QA Contact for the bug.</li>
<li>You are the assignee for the bug.</li>
</ul>
</body>
</html>