Lucene search

K
osvGoogleOSV:ALSA-2023:0848
HistoryFeb 21, 2023 - 12:00 a.m.

Moderate: php:8.0 security update

2023-02-2100:00:00
Google
osv.dev
14
php
apache http server
buffer overflow
sha-3
cve-2022-37454
insecure cookie
imageloadfont()
integer overflow
pdo::quote()
phar wrapper
dos

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

8.6

Confidence

Low

EPSS

0.031

Percentile

91.2%

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

The following packages have been upgraded to a later upstream version: php (8.0). (BZ#2161666)

Security Fix(es):

  • XKCP: buffer overflow in the SHA-3 reference implementation (CVE-2022-37454)
  • php: standard insecure cookie could be treated as a __Host- or __Secure- cookie by PHP applications (CVE-2022-31629)
  • php: OOB read due to insufficient input validation in imageloadfont() (CVE-2022-31630)
  • php: Due to an integer overflow PDO::quote() may return unquoted string (CVE-2022-31631)
  • php: phar wrapper can occur dos when using quine gzip file (CVE-2022-31628)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

8.6

Confidence

Low

EPSS

0.031

Percentile

91.2%