164 matches found
USN-5902-1: PHP vulnerabilities
It was discovered that PHP incorrectly handled certain invalid Blowfish password hashes. An invalid password hash could possibly allow applications to accept any password as valid, contrary to expectations. CVE-2023-0567 It was discovered that PHP incorrectly handled resolving long paths. A remot...
Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS : PHP vulnerabilities (USN-5902-1)
The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5902-1 advisory. It was discovered that PHP incorrectly handled certain invalid Blowfish password hashes. An invalid password hash could possibly...
Updated php packages fix security vulnerability
The passwordverify function may accept some invalid Blowfish hashes as valid. If such invalid hash ever ends up in the password database, it may lead to an application allowing any password for this entry as valid. CVE-2023-0567 The core path resolution function allocates a buffer one byte too...
Debian: Security Advisory (DLA-3345-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
[SECURITY] [DSA 5363-1] php7.4 security update
------------------------------------------------------------------------- Debian Security Advisory DSA-5363-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff February 24, 2023 https://www.debian.org/security/faq -...
Fedora 37 : php (2023-452714dbc6)
The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-452714dbc6 advisory. PHP version 8.1.16 14 Feb 2023 Core: Fixed bug php81744 Passwordverify always return true with some hash. CVE-2023-0567. Tim Dsterhus Fixed bug...
Fedora 36 : php (2023-d12ff09d38)
The remote Fedora 36 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-d12ff09d38 advisory. PHP version 8.1.16 14 Feb 2023 Core: Fixed bug php81744 Passwordverify always return true with some hash. CVE-2023-0567. Tim Dsterhus Fixed bug...
SUSE SLES15: apache2-mod_php7 / php7 / php7-bcmath / php7-bz2 / php7-calendar / etc (SUSE-SU-2023:0476-1)
The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:0476-1 advisory. - CVE-2022-31631: Fixed an issue where PDO::quote would return an unquoted string bsc1206958. - CVE-2023-0568: Fixed...
SUSE-SU-2023:0476-1 Security update for php7
This update for php7 fixes the following issues: - CVE-2022-31631: Fixed an issue where PDO::quote would return an unquoted string bsc1206958. - CVE-2023-0568: Fixed NULL byte off-by-one in phpcheckspecificopenbasedir bnc1208366. - CVE-2023-0662: Fixed DoS vulnerability when parsing multipart...
Security fix for the ALT Linux 10 package php8.2 version 8.2.3-alt1
8.2.3-alt1 built Feb. 21, 2023 Anton Farygin in task 315258 Feb. 14, 2023 Anton Farygin - 8.2.2 - 8.2.3 Fixes: CVE-2023-0567, CVE-2023-0568, CVE-2023-0662...
Security fix for the ALT Linux 10 package php8.0 version 8.0.28-alt1
8.0.28-alt1 built Feb. 21, 2023 Anton Farygin in task 315278 Feb. 14, 2023 Anton Farygin - 8.0.27 - 8.0.28 Fixes: CVE-2023-0567, CVE-2023-0568, CVE-2023-0662...
Security fix for the ALT Linux 10 package php8.1 version 8.1.16-alt1
8.1.16-alt1 built Feb. 17, 2023 Anton Farygin in task 315276 Feb. 15, 2023 Anton Farygin - 8.1.15 - 8.1.16 Fixes: CVE-2023-0567, CVE-2023-0568, CVE-2023-0662...
CVE-2023-0567
CVE-2023-0567 affects PHP: 8.0.x before 8.0.28, 8.1.x before 8.1.16, and 8.2.x before 8.2.3. The password_verify() function may treat certain invalid Blowfish hashes as valid, potentially allowing unintended access if such a hash is stored in the password database. Connections in the provided doc...
CVE-2023-0567 password_verify() always returns true for some invalid hashes
In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, passwordverify function may accept some invalid Blowfish hashes as valid. If such invalid hash ever ends up in the password database, it may lead to an application allowing any password for this entry as valid...
PHP 8.0.x < 8.0.28 Multiple Vulnerabilities
According to its self-reported version number, the version of PHP installed on the remote host is 8.0.x prior to 8.0.28, 8.1.x prior to 8.1.16, or 8.2.x prior to 8.2.3. It is, therefore, affected by multiple vulnerabilities: - A denial of service DoS attack due to insufficient validation of...
PHP 8.2.x < 8.2.3 Multiple Vulnerabilities
According to its self-reported version number, the version of PHP installed on the remote host is 8.0.x prior to 8.0.28, 8.1.x prior to 8.1.16, or 8.2.x prior to 8.2.3. It is, therefore, affected by multiple vulnerabilities: - A denial of service DoS attack due to insufficient validation of...
PHP 8.1.x < 8.1.16 Multiple Vulnerabilities
According to its self-reported version number, the version of PHP installed on the remote host is 8.0.x prior to 8.0.28, 8.1.x prior to 8.1.16, or 8.2.x prior to 8.2.3. It is, therefore, affected by multiple vulnerabilities: - A denial of service DoS attack due to insufficient validation of...
PHP < 8.0.28, 8.1.x < 8.1.16, 8.2.x < 8.2.3 Security Update - Windows
PHP is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:php:php"; if description...
PHP < 8.0.28, 8.1.x < 8.1.16, 8.2.x < 8.2.3 Security Update - Linux
PHP is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:php:php"; if description...
