Ubuntu 22.04 LTS USN-5479-1: Addressing PHP DoS Vulnerabilities and Patches

ubuntu

June 15, 2022

Several security issues were fixed in PHP.

Summary

Several security issues were fixed in PHP.

Software Description:

- php8.1: HTML-embedded scripting language interpreter

- php8.0: HTML-embedded scripting language interpreter

- php7.4: HTML-embedded scripting language interpreter

- php7.2: HTML-embedded scripting language interpreter

Details:

Charles Fol discovered that PHP incorrectly handled initializing certain

arrays when handling the pg_query_params function. A remote attacker could

use this issue to cause PHP to crash, resulting in a denial of service, or

possibly execute arbitrary code. (CVE-2022-31625)

Charles Fol discovered that PHP incorrectly handled passwords in mysqlnd. A

remote attacker could use this issue to cause PHP to crash, resulting in a

denial of service, or possibly execute arbitrary code. (CVE-2022-31626)

Topics Covered

security advisory denial of service security issue remote attack Ubuntu security patch PHP

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 22.04 LTS:
  libapache2-mod-php8.1           8.1.2-1ubuntu2.1
  php8.1-cgi                      8.1.2-1ubuntu2.1
  php8.1-cli                      8.1.2-1ubuntu2.1
  php8.1-fpm                      8.1.2-1ubuntu2.1
  php8.1-mysql                    8.1.2-1ubuntu2.1
  php8.1-pgsql                    8.1.2-1ubuntu2.1

Ubuntu 21.10:
  libapache2-mod-php8.0           8.0.8-1ubuntu0.4
  php8.0-cgi                      8.0.8-1ubuntu0.4
  php8.0-cli                      8.0.8-1ubuntu0.4
  php8.0-fpm                      8.0.8-1ubuntu0.4
  php8.0-mysql                    8.0.8-1ubuntu0.4
  php8.0-pgsql                    8.0.8-1ubuntu0.4

Ubuntu 20.04 LTS:
  libapache2-mod-php7.4           7.4.3-4ubuntu2.12
  php7.4-cgi                      7.4.3-4ubuntu2.12
  php7.4-cli                      7.4.3-4ubuntu2.12
  php7.4-fpm                      7.4.3-4ubuntu2.12
  php7.4-mysql                    7.4.3-4ubuntu2.12
  php7.4-pgsql                    7.4.3-4ubuntu2.12

Ubuntu 18.04 LTS:
  libapache2-mod-php7.2           7.2.24-0ubuntu0.18.04.12
  php7.2-cgi                      7.2.24-0ubuntu0.18.04.12
  php7.2-cli                      7.2.24-0ubuntu0.18.04.12
  php7.2-fpm                      7.2.24-0ubuntu0.18.04.12
  php7.2-mysql                    7.2.24-0ubuntu0.18.04.12
  php7.2-pgsql                    7.2.24-0ubuntu0.18.04.12

In general, a standard system update will make all the necessary changes.