Ubuntu 21.10 Advisory 5125-1: PHP Input Handling Exploit Severity Moderate

ubuntu

October 27, 2021

PHP-PFM in PHP could be made to run program as an administrator if it received specially crafted input.

Summary

PHP-PFM in PHP could be made to run program as an administrator

if it received specially crafted input.

Software Description:

- php8.0: HTML-embedded scripting language interpreter

- php7.4: HTML-embedded scripting language interpreter

- php7.2: HTML-embedded scripting language interpreter

- php7.0: HTML-embedded scripting language interpreter

- php5: HTML-embedded scripting language interpreter

Details:

It was discovered that PHP-FPM in PHP incorrectly handled certain inputs.

An attacker could possibly use this issue to cause a crash or execute

arbitrary code.

Topics Covered

security advisory moderate ubuntu administrative access php input handling

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 21.10:
  php8.0-fpm                      8.0.8-1ubuntu0.1

Ubuntu 21.04:
  php7.4-fpm                      7.4.16-1ubuntu2.2

Ubuntu 20.04 LTS:
  php7.4-fpm                      7.4.3-4ubuntu2.7

Ubuntu 18.04 LTS:
  php7.2-fpm                      7.2.24-0ubuntu0.18.04.10

Ubuntu 16.04 ESM:
  php7.0-fpm                      7.0.33-0ubuntu0.16.04.16+esm2

Ubuntu 14.04 ESM:
  php5-fpm                        5.5.9+dfsg-1ubuntu4.29+esm15

In general, a standard system update will make all the necessary changes.