Red Hat Security Advisory

RHSA-2022:8197

php security, bug fix, and enhancement update

Released 2022-11-15 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream (v. 9) php-8.0.20-3.el9, php-bcmath-8.0.20-3.el9, php-cli-8.0.20-3.el9 +22

Fixes 2 records

TI-2021-04788 CVE-2021-21708 · GHSA-g9qg-rg7j-whhx

UAF due to php_filter_float() failing

MEDIUM 48

In PHP versions 7.4.x below 7.4.28, 8.0.x below 8.0.16, and 8.1.x below 8.1.3, when using filter functions with FILTER_VALIDATE_FLOAT filter and min/max limits, if the filter fails, there is a possibility to trigger use…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.03002 Published 2022-02-27 Fixed in 7.4.28, 8.0.16 +1 CWE-416

TI-2022-13549 CVE-2022-31625 · GHSA-wg63-8xjw-5wvx

Freeing unallocated memory in php_pgsql_free_params()

MEDIUM 42

In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when using Postgres database extension, supplying invalid parameters to the parametrized query may lead to PHP attempting to free memory usin…

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.0379 Published 2022-06-16 Fixed in 7.4.30, 8.0.20 +1 CWE-590