Search CVE reports
11 – 20 of 144 results
Some fixes available 4 of 8
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, when a SOAP server has a typemap configured, the decoding process contains a mistake which checks the wrong variable in case of...
8 affected packages
php5, php7.0, php7.2, php7.4, php8.1...
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| php5 | Not in release | Not in release | Not in release | — | — |
| php7.0 | Not in release | Not in release | Not in release | — | — |
| php7.2 | Not in release | Not in release | Not in release | — | Needs evaluation |
| php7.4 | Not in release | Not in release | Not in release | Needs evaluation | — |
| php8.1 | Not in release | Not in release | Fixed | — | — |
| php8.3 | Not in release | Fixed | Not in release | — | — |
| php8.4 | Not in release | Not in release | Not in release | — | — |
| php8.5 | Fixed | Not in release | Not in release | — | — |
Some fixes available 5 of 8
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, when SoapServer is configured with SOAP_PERSISTENCE_SESSION, the handler object is persisted across requests via session...
8 affected packages
php7.0, php5, php7.2, php7.4, php8.1...
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| php7.0 | Not in release | Not in release | Not in release | — | — |
| php5 | Not in release | Not in release | Not in release | — | — |
| php7.2 | Not in release | Not in release | Not in release | — | Needs evaluation |
| php7.4 | Not in release | Not in release | Not in release | Needs evaluation | — |
| php8.1 | Not in release | Not in release | Fixed | — | — |
| php8.3 | Not in release | Fixed | Not in release | — | — |
| php8.4 | Not in release | Not in release | Not in release | — | — |
| php8.5 | Fixed | Not in release | Not in release | — | — |
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, a mismatch between encoding lists in Oniguruma and mbfl leads to a NULL pointer dereference, resulting in a segmentation fault...
8 affected packages
php5, php7.0, php7.2, php7.4, php8.1...
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| php5 | Not in release | Not in release | Not in release | — | — |
| php7.0 | Not in release | Not in release | Not in release | — | — |
| php7.2 | Not in release | Not in release | Not in release | — | Not affected |
| php7.4 | Not in release | Not in release | Not in release | Not affected | — |
| php8.1 | Not in release | Not in release | Fixed | — | — |
| php8.3 | Not in release | Fixed | Not in release | — | — |
| php8.4 | Not in release | Not in release | Not in release | — | — |
| php8.5 | Fixed | Not in release | Not in release | — | — |
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, some functions, including urldecode(), pass signed char to ctype functions (like isxdigit()). On the systems with default...
8 affected packages
php5, php7.0, php7.2, php7.4, php8.1...
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| php5 | Not in release | Not in release | Not in release | — | — |
| php7.0 | Not in release | Not in release | Not in release | — | — |
| php7.2 | Not in release | Not in release | Not in release | — | Not affected |
| php7.4 | Not in release | Not in release | Not in release | Not affected | — |
| php8.1 | Not in release | Not in release | Not affected | — | — |
| php8.3 | Not in release | Fixed | Not in release | — | — |
| php8.4 | Not in release | Not in release | Not in release | — | — |
| php8.5 | Fixed | Not in release | Not in release | — | — |
Some fixes available 4 of 8
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, 8.5.* before 8.5.6, due to improper sanitation of user data, it allows an attacker to compose an URL, which will cause the target to execute arbitrary...
8 affected packages
php5, php7.0, php7.2, php7.4, php8.1...
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| php5 | Not in release | Not in release | Not in release | — | — |
| php7.0 | Not in release | Not in release | Not in release | — | — |
| php7.2 | Not in release | Not in release | Not in release | — | Needs evaluation |
| php7.4 | Not in release | Not in release | Not in release | Needs evaluation | — |
| php8.1 | Not in release | Not in release | Fixed | — | — |
| php8.3 | Not in release | Fixed | Not in release | — | — |
| php8.4 | Not in release | Not in release | Not in release | — | — |
| php8.5 | Fixed | Not in release | Not in release | — | — |
Some fixes available 5 of 8
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their...
8 affected packages
php7.0, php5, php7.2, php7.4, php8.1...
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| php7.0 | Not in release | Not in release | Not in release | — | — |
| php5 | Not in release | Not in release | Not in release | — | — |
| php7.2 | Not in release | Not in release | Not in release | — | Needs evaluation |
| php7.4 | Not in release | Not in release | Not in release | Needs evaluation | — |
| php8.1 | Not in release | Not in release | Fixed | — | — |
| php8.3 | Not in release | Fixed | Not in release | — | — |
| php8.4 | Not in release | Not in release | Not in release | — | — |
| php8.5 | Fixed | Not in release | Not in release | — | — |
Some fixes available 5 of 8
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a...
8 affected packages
php7.0, php5, php7.2, php7.4, php8.1...
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| php7.0 | Not in release | Not in release | Not in release | — | — |
| php5 | Not in release | Not in release | Not in release | — | — |
| php7.2 | Not in release | Not in release | Not in release | — | Needs evaluation |
| php7.4 | Not in release | Not in release | Not in release | Needs evaluation | — |
| php8.1 | Not in release | Not in release | Fixed | — | — |
| php8.3 | Not in release | Fixed | Not in release | — | — |
| php8.4 | Not in release | Not in release | Not in release | — | — |
| php8.5 | Fixed | Not in release | Not in release | — | — |
In PHP versions 8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1 when using the PDO PostgreSQL driver with PDO::ATTR_EMULATE_PREPARES enabled, an invalid character sequence...
7 affected packages
php5, php7.0, php7.2, php7.4, php8.1...
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| php5 | — | Not in release | Not in release | — | — |
| php7.0 | — | Not in release | Not in release | — | — |
| php7.2 | — | Not in release | Not in release | — | Not affected |
| php7.4 | — | Not in release | Not in release | Not affected | — |
| php8.1 | — | Not in release | Fixed | — | — |
| php8.3 | — | Fixed | Not in release | — | — |
| php8.4 | — | Not in release | Not in release | — | — |
In PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1, a heap buffer overflow occurs in array_merge() when the total element count of packed arrays exceeds 32-bit...
7 affected packages
php5, php7.0, php7.2, php7.4, php8.1...
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| php5 | — | Not in release | Not in release | — | — |
| php7.0 | — | Not in release | Not in release | — | — |
| php7.2 | — | Not in release | Not in release | — | Fixed |
| php7.4 | — | Not in release | Not in release | Fixed | — |
| php8.1 | — | Not in release | Fixed | — | — |
| php8.3 | — | Fixed | Not in release | — | — |
| php8.4 | — | Not in release | Not in release | — | — |
In PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1, the getimagesize() function may leak uninitialized heap memory into the APPn segments (e.g., APP1) when...
7 affected packages
php5, php7.0, php7.2, php7.4, php8.1...
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| php5 | — | Not in release | Not in release | — | — |
| php7.0 | — | Not in release | Not in release | — | — |
| php7.2 | — | Not in release | Not in release | — | Not affected |
| php7.4 | — | Not in release | Not in release | Not affected | — |
| php8.1 | — | Not in release | Not affected | — | — |
| php8.3 | — | Fixed | Not in release | — | — |
| php8.4 | — | Not in release | Not in release | — | — |