Read the docs
Red Hat Security Advisory

RHSA-2023:2417

php:8.1 security update

Released 2023-05-09 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Fixes 5 records

TI-2022-17508 CVE-2022-37454 · GHSA-6w4m-2xhg-2658

The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and…

Priority HIGH 82

The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute arbitrary code or eliminate expected cryptographic properties.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.07413 Published 2022-10-21 Partial fix · 1.0.5 CWE-190
TI-2022-13555 CVE-2022-31631 · GHSA-4qmr-c42j-3wg2

PDO::quote() may return unquoted string

Priority HIGH 80

In PHP versions 8.0.* before 8.0.27, 8.1.* before 8.1.15, 8.2.* before 8.2.2 when using PDO::quote() function to quote user-supplied data for SQLite, supplying an overly long string may cause the driver to incorrectly qu…

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.02189 Published 2025-02-12 Partial fix · 8.0.27, 8.1.15 +1 CWE-74
TI-2022-13553 CVE-2022-31629 · GHSA-c43m-486j-j32p

$_COOKIE names string replacement (. -> _): cookie integrity vulnerabilities

Priority MEDIUM 60

In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the vulnerability enables network and same-site attackers to set a standard insecure cookie in the victim's browser which is treated as a `__Host-` or `__Secure-` cookie…

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.49569 Published 2022-09-28 Partial fix · 7.4.31, 8.0.24 +1 CWE-20
TI-2022-13554 CVE-2022-31630 · GHSA-jw98-jrc9-mrx5

OOB read due to insufficient input validation in imageloadfont()

Priority LOW 34

In PHP versions prior to 7.4.33, 8.0.25 and 8.1.12, when using imageloadfont() function in gd extension, it is possible to supply a specially crafted font file, such as if the loaded font is used with imagechar() functio…

CVSS 3.1HIGH 7.1 Local No auth User interaction EPSS 0.01317 Published 2022-11-14 Fixed in 7.4.33, 8.0.25 +1 CWE-131
TI-2022-13552 CVE-2022-31628 · GHSA-cj46-35hf-rv96

phar wrapper can occur dos when using quine gzip file

Priority LOW 26

In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the phar uncompressor code would recursively uncompress "quines" gzip files, resulting in an infinite loop.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00628 Published 2022-09-28 Partial fix · 7.4.31, 8.0.24 +1 CWE-674