CVE-2022-45816

CVE-2022-45816 affects the WordPress plugin GD bbPress Attachments (versions ≤ 4.3.1). The vulnerability is an Authenticated Stored Cross-Site Scripting (XSS) flaw caused by insufficient sanitization/escaping of settings, enabling elevated-privilege users (e.g., admins) to inject XSS. Public refe...

PT-2022-27647 · WordPress · Gd Bbpress Attachments

Name of the Vulnerable Software and Affected Versions: GD bbPress Attachments plugin versions = 4.3.1 Description: The issue is related to an Authenticated Stored Cross-Site Scripting XSS vulnerability. This type of vulnerability allows an attacker to inject malicious scripts into the website,...

SUSE SLES15: apache2-mod_php8 / php8 / php8-bcmath / php8-bz2 / php8-calendar / etc (SUSE-SU-2022:4005-1)

The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:4005-1 advisory. - CVE-2022-37454: Fixed buffer overflow in hashupdate on long parameter bug81738 bsc1204577. - CVE-2022-31630: Fixed...

SUSE SLED15: apache2-mod_php7 / php7 / php7-bcmath / php7-bz2 / php7-calendar / etc (SUSE-SU-2022:3997-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3997-1 advisory. - Version update to 7.4.33: - CVE-2022-31630: Fixed out-of-bounds read due to insufficient input...

CVE-2022-31630

In PHP versions prior to 7.4.33, 8.0.25 and 8.1.12, when using imageloadfont function in gd extension, it is possible to supply a specially crafted font file, such as if the loaded font is used with imagechar function, the read outside allocated buffer will be used. This can lead to crashes or...

DEBIAN-CVE-2022-31630

In PHP versions prior to 7.4.33, 8.0.25 and 8.1.12, when using imageloadfont function in gd extension, it is possible to supply a specially crafted font file, such as if the loaded font is used with imagechar function, the read outside allocated buffer will be used. This can lead to crashes or...

Design/Logic Flaw

In PHP versions prior to 7.4.33, 8.0.25 and 8.2.12, when using imageloadfont function in gd extension, it is possible to supply a specially crafted font file, such as if the loaded font is used with imagechar function, the read outside allocated buffer will be used. This can lead to crashes or...

CVE-2022-31630

CVE-2022-31630 is a PHP gd imageloadfont() vulnerability. Connected advisories confirm the issue occurs in PHP versions prior to 7.4.33 and specific 8.x series (e.g., 8.0.25, 8.1.12/8.2.12), where a specially crafted font file used with imagechar() can cause an out-of-bounds read, leading to cras...

CVE-2022-31630

In PHP versions prior to 7.4.33, 8.0.25 and 8.1.12, when using imageloadfont function in gd extension, it is possible to supply a specially crafted font file, such as if the loaded font is used with imagechar function, the read outside allocated buffer will be used. This can lead to crashes or...

CVE-2022-31630 OOB read due to insufficient input validation in imageloadfont()

In PHP versions prior to 7.4.33, 8.0.25 and 8.1.12, when using imageloadfont function in gd extension, it is possible to supply a specially crafted font file, such as if the loaded font is used with imagechar function, the read outside allocated buffer will be used. This can lead to crashes or...

CVE-2022-31630

In PHP versions prior to 7.4.33, 8.0.25 and 8.1.12, when using imageloadfont function in gd extension, it is possible to supply a specially crafted font file, such as if the loaded font is used with imagechar function, the read outside allocated buffer will be used. This can lead to crashes or...

CVE-2022-31630 OOB read due to insufficient input validation in imageloadfont()

In PHP versions prior to 7.4.33, 8.0.25 and 8.1.12, when using imageloadfont function in gd extension, it is possible to supply a specially crafted font file, such as if the loaded font is used with imagechar function, the read outside allocated buffer will be used. This can lead to crashes or...

CentOS 8 : php:8.0 (CESA-2022:7624)

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2022:7624 advisory. - php: Use after free due to phpfilterfloat failing for ints CVE-2021-21708 - php: Uninitialized array in pgqueryparams leading to RCE CVE-2022-31625...

PHP 7.4.x < 7.4.33 Multiple Vulnerabilities

The version of PHP installed on the remote host is prior to 7.4.33. It is, therefore, affected by multiple vulnerabilities as referenced in the Version 7.4.33 advisory. - The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allow...

Mageia: Security Advisory (MGASA-2022-0406)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Updated php packages fix security vulnerability

GD - Fixed bug 81739: OOB read due to insufficient input validation in imageloadfont. Hash - Fixed bug 81738: buffer overflow in hashupdate on long parameter. Session - Fixed bug GH-9583 sessioncreateid fails with user defined save handler that doesn't have a validateId method. Streams - Fixed bu...

Slackware: Security Advisory (SSA:2022-304-02)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Slackware Linux 15.0 / current php80 Multiple Vulnerabilities (SSA:2022-304-02)

The version of php80 installed on the remote host is prior to 8.0.25 / 8.1.12. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2022-304-02 advisory. - The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflo...

[slackware-security] php80/php81

New php80/php81 packages are available for Slackware 15.0 and -current to fix security issues. Here are the details from the Slackware 15.0 ChangeLog: extra/php80/php80-8.0.25-i586-1slack15.0.txz: Upgraded. This update fixes security issues: GD: OOB read due to insufficient input validation in...

UBUNTU-CVE-2022-31630

In PHP versions prior to 7.4.33, 8.0.25 and 8.1.12, when using imageloadfont function in gd extension, it is possible to supply a specially crafted font file, such as if the loaded font is used with imagechar function, the read outside allocated buffer will be used. This can lead to crashes or...