security advisoryphpDebian
Multiple security issues were found in PHP, a widely-used open source general purpose scripting language, which could result in execution of arbitrary code, erroneous parsing of invalid URLs or multipart form data, configuration setting bypass, or log pollution. . ------------------------------------------------------------------------- Debian LTS Advisory DLA-3920-1 This email address is being protected from spambots. You need JavaScript enabled to view it. https://www.debian.org/lts/security/ Guilhem Moulin October 14, 2024 https://wiki.debian.org/LTS ------------------------------------------------------------------------- Package : php7.4 Version : 7.4.33-1+deb11u6 CVE ID : CVE-2022-4900 CVE-2024-5458 CVE-2024-8925 CVE-2024-8927 CVE-2024-9026 Debian Bug : 1072885 Multiple security issues were found in PHP, a widely-used open source general purpose scripting language, which could result in execution of arbitrary code, erroneous parsing of invalid URLs or multipart form data, configuration setting bypass, or log pollution. CVE-2022-4900 It was discovered that setting the environment variable PHP_CLI_SERVER_WORKERS to a large value leads to a heap buffer overflow. CVE-2024-5458 Due to a code logic error, filtering functions such as filter_var when validating URLs (FILTER_VALIDATE_URL) for certain types of URLs the function results in invalid user information (username + password part of URLs) being treated as valid user information. This may lead to the downstream code accepting invalid URLs as valid and parsing them incorrectly. This causes the same problems as CVE-2020-7071, but with IPv6 host parts. CVE-2024-8925 Mihail Kirov discovered an erroneous parsing of multipart form data contained in an HTTP POST request, which could lead to legitimate data not being processed thereby violating data integrity. CVE-2024-8927 It was discovered that the `cgi.force_redirect` configuration setting isbypassable due to environment variable collision. CVE-2024-9026 In PHP-FPM, when configured to catch workers output through catch_workers_output = yes configuration, it may be possible to pollute the final log with up to 4 characters from the FPM_STDIO_CMD_FLUSH macro, or remove up to 4 characters from the logs. For Debian 11 bullseye, these problems have been fixed in version 7.4.33-1+deb11u6. We recommend that you upgrade your php7.4 packages. For the detailed security status of php7.4 please refer to its security tracker page at: https://security-tracker.debian.org/tracker/source-package/php7.4 Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS . Ubuntu Security Notice USN-4874-1 fixes significant vulnerabilities in nginx 1.18, enhancing security measures and performance optimizations.. Debian LTS, php7.4, security advisory, code execution, data integrity. . LinuxSecurity.com Team
Oct 15, 2024
Debian LTS
Refine advisories
