php: password of excessive length triggers buffer overflow leading to RCE

A buffer overflow vulnerability was found in PHP when processing passwords in mysqlnd/pdo in mysqlndwireprotocol.c. When using the pdomysql extension with mysqlnd driver, if the third party is allowed to supply a MySQL database server password in the mysqlnd driver to the host for the connection,...

php: password of excessive length triggers buffer overflow leading to RCE

A buffer overflow vulnerability was found in PHP when processing passwords in mysqlnd/pdo in mysqlndwireprotocol.c. When using the pdomysql extension with mysqlnd driver, if the third party is allowed to supply a MySQL database server password in the mysqlnd driver to the host for the connection,...

SUSE SLES15 Security Update : php7 (SUSE-SU-2022:2185-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:2185-1 advisory. - In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when using Postgres database extension, supplying...

OESA-2022-1721 php security update

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is...

The vulnerability of the mysqlnd/pdo function (mysqlnd_wireprotocol.c) in the PHP programming language interpreter allows a hacker to execute arbitrary code.

The vulnerability of the mysqlnd/pdo function mysqlndwireprotocol.c in the PHP programming language interpreter is related to the copying of buffers without checking the size of the input data. Exploiting this vulnerability allows an attacker to execute arbitrary code remotely...

SUSE-SU-2022:2161-1 Security update for php74

This update for php74 fixes the following issues: - CVE-2022-31625: Fixed uninitialized pointers free in Postgres extension. bsc1200645 - CVE-2022-31626: Fixed buffer overflow via user-supplied password when using pdomysql extension with mysqlnd driver. bsc1200628...

MGASA-2022-0234 Updated php packages fix security vulnerability

CLI -Fixed bug 8575 CLI closes standard streams too early. Core -Fixed Haiku ZTS builds. Date -Fixed bug 8471 Segmentation fault when converting immutable and mutable DateTime instances created using reflection. php-fpm - Fixed bug 72185 writes empty fcgi record causing nginx 502. Mysqlnd - Fixed...

Updated php packages fix security vulnerability

CLI -Fixed bug 8575 CLI closes standard streams too early. Core -Fixed Haiku ZTS builds. Date -Fixed bug 8471 Segmentation fault when converting immutable and mutable DateTime instances created using reflection. php-fpm - Fixed bug 72185 writes empty fcgi record causing nginx 502. Mysqlnd - Fixed...

DEBIAN-CVE-2022-31626

In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when pdomysql extension with mysqlnd driver, if the third party is allowed to supply host to connect to and the password for the connection, password of excessive length can trigger a buffer overflow in PHP, which can...

Remote code execution

In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when pdomysql extension with mysqlnd driver, if the third party is allowed to supply host to connect to and the password for the connection, password of excessive length can trigger a buffer overflow in PHP, which can...

CVE-2022-31626 mysqlnd/pdo password buffer overflow

In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when pdomysql extension with mysqlnd driver, if the third party is allowed to supply host to connect to and the password for the connection, password of excessive length can trigger a buffer overflow in PHP, which can...

Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS : PHP vulnerabilities (USN-5479-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5479-1 advisory. Charles Fol discovered that PHP incorrectly handled initializing certain arrays when handling the pgqueryparams function. A remot...

[slackware-security] php

New php packages are available for Slackware 15.0 and -current to fix security issues. Here are the details from the Slackware 15.0 ChangeLog: patches/packages/php-7.4.30-i586-1slack15.0.txz: Upgraded. This update fixes bugs and security issues: mysqlnd/pdo password buffer overflow. Uninitialized...

UBUNTU-CVE-2022-31626

In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when pdomysql extension with mysqlnd driver, if the third party is allowed to supply host to connect to and the password for the connection, password of excessive length can trigger a buffer overflow in PHP, which can...

PHP 8.1.x < 8.1.7 Multiple Vulnerabilities

The version of PHP installed on the remote host is prior to 8.1.7. It is, therefore, affected by multiple vulnerabilities as referenced in the Version 8.1.7 advisory. - In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when using Postgres database extension, supplying...

PHP 8.0.x < 8.0.20 Multiple Vulnerabilities

The version of PHP installed on the remote host is prior to 8.0.20. It is, therefore, affected by multiple vulnerabilities as referenced in the Version 8.0.20 advisory. - In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when using Postgres database extension, supplyi...

CVE-2022-31626

In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when pdomysql extension with mysqlnd driver, if the third party is allowed to supply host to connect to and the password for the connection, password of excessive length can trigger a buffer overflow in PHP, which can...

PT-2022-3056 · Php +10 · Php +10

Name of the Vulnerable Software and Affected Versions: PHP versions 7.4.x through 7.4.29 PHP versions 8.0.x through 8.0.19 PHP versions 8.1.x through 8.1.6 Description: The issue is related to a buffer overflow vulnerability in the mysqlnd/pdo function of the PHP interpreter, specifically in the...

The vulnerability in the ext/mysqlnd/mysqlnd.c component of the PHP interpreter allows attackers to perform spoofing attacks.

The vulnerability of the ext/mysqlnd/mysqlnd.c component of the PHP programming language interpreter is related to access control deficiencies. Exploiting this vulnerability allows a malicious actor to perform spoofing attacks remotely...

The vulnerability of the ext/mysqlnd/mysqlnd_wireprotocol.c component of the PHP programming language interpreter allows a attacker to cause a service failure or potentially have other adverse effects.

The vulnerability of the ext/mysqlnd/mysqlndwireprotocol.c component of the PHP programming language interpreter is caused by a buffer overflow. Exploiting this vulnerability could allow an attacker to cause service failures or potentially other adverse effects...