Red Hat Security Advisory

RHSA-2022:7628

php:7.4 security, bug fix, and enhancement update

Released 2022-11-08 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream (v. 8) apcu-panel-5.1.18-1.module+el8.3.0+6678+b09f589e.noarch::php:7.4, libzip-1.6.1-1.module+el8.3.0+6678+b09f589e.aarch64::php:7.4, libzip-1.6.1-1.module+el8.3.0+6678+b09f589e.ppc64le::php:7.4 +47

Fixes 3 records

TI-2021-12279 CVE-2021-32610 · GHSA-p8q8-jfcv-g2h2

In Archive_Tar before 1.4.14, symlinks can refer to targets outside of the extracted…

HIGH 70

In Archive_Tar before 1.4.14, symlinks can refer to targets outside of the extracted archive, a different vulnerability than CVE-2020-36193.

CVSS 3.1HIGH 7.1 Local Low privileges No interaction EPSS 0.73377 Published 2021-07-27 Partial fix · 1.4.14 CWE-59

TI-2021-04788 CVE-2021-21708 · GHSA-g9qg-rg7j-whhx

UAF due to php_filter_float() failing

MEDIUM 48

In PHP versions 7.4.x below 7.4.28, 8.0.x below 8.0.16, and 8.1.x below 8.1.3, when using filter functions with FILTER_VALIDATE_FLOAT filter and min/max limits, if the filter fails, there is a possibility to trigger use…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.03002 Published 2022-02-27 Fixed in 7.4.28, 8.0.16 +1 CWE-416

TI-2021-04787 CVE-2021-21707 · GHSA-qh78-qfw9-93x9

Special characters break path parsing in XML functions

MEDIUM 45

In PHP versions 7.3.x below 7.3.33, 7.4.x below 7.4.26 and 8.0.x below 8.0.13, certain XML parsing functions, like simplexml_load_file(), URL-decode the filename passed to them.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.25315 Published 2021-11-29 Partial fix · 7.3.33, 7.4.26 +1 CWE-159