Ubuntu 22.10, 22.04 LTS USN-5818-1 High: PHP Input Abuse

ubuntu

January 23, 2023

PHP could be made do crash or execute arbitrary code if it received a specially crafted input.

Summary

PHP could be made do crash or execute arbitrary code if it received

a specially crafted input.

Software Description:

- php8.1: HTML-embedded scripting language interpreter

- php7.4: HTML-embedded scripting language interpreter

- php7.2: HTML-embedded scripting language interpreter

Details:

It was discovered that PHP incorrectly handled certain inputs.

An attacker could possibly use this issue to cause a crash or

execute arbitrary code.

Topics Covered

security advisory critical code execution Ubuntu PHP input handling attack surface

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 22.10:
  libapache2-mod-php7.4           8.1.7-1ubuntu3.2
  libapache2-mod-php8.0           8.1.7-1ubuntu3.2
  libapache2-mod-php8.1           8.1.7-1ubuntu3.2
  php8.1                          8.1.7-1ubuntu3.2
  php8.1-cgi                      8.1.7-1ubuntu3.2
  php8.1-cli                      8.1.7-1ubuntu3.2
  php8.1-sqlite3                  8.1.7-1ubuntu3.2

Ubuntu 22.04 LTS:
  libapache2-mod-php7.4           8.1.2-1ubuntu2.10
  libapache2-mod-php8.0           8.1.2-1ubuntu2.10
  libapache2-mod-php8.1           8.1.2-1ubuntu2.10
  php8.1                          8.1.2-1ubuntu2.10
  php8.1-cgi                      8.1.2-1ubuntu2.10
  php8.1-cli                      8.1.2-1ubuntu2.10
  php8.1-sqlite3                  8.1.2-1ubuntu2.10

Ubuntu 20.04 LTS:
  libapache2-mod-php7.4           7.4.3-4ubuntu2.17
  php7.4                          7.4.3-4ubuntu2.17
  php7.4-cgi                      7.4.3-4ubuntu2.17
  php7.4-cli                      7.4.3-4ubuntu2.17
  php7.4-sqlite3                  7.4.3-4ubuntu2.17

Ubuntu 18.04 LTS:
  libapache2-mod-php7.2           7.2.24-0ubuntu0.18.04.16
  php7.2                          7.2.24-0ubuntu0.18.04.16
  php7.2-cgi                      7.2.24-0ubuntu0.18.04.16
  php7.2-cli                      7.2.24-0ubuntu0.18.04.16
  php7.2-sqlite3                  7.2.24-0ubuntu0.18.04.16

In general, a standard system update will make all the necessary changes.