Priority MEDIUM 63
In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, due to a code logic error, filtering functions such as filter_var when validating URLs (FILTER_VALIDATE_URL) for certain types of URLs the fun…
RHSA-2025:7315
php security update
Released 2025-05-13 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream (v. 9) php-8.0.30-2.el9, php-bcmath-8.0.30-2.el9, php-cli-8.0.30-2.el9 +22
Fixes 9 records
Priority MEDIUM 62
Due to an incomplete fix to CVE-2022-31629 https://github.com/advisories/GHSA-c43m-486j-j32p , network and same-site attackers can set a standard insecure cookie in the victim's browser which is treated as a __Host- or _…
TI-2024-08291 CVE-2024-8929
Leak partial content of the heap through heap buffer over-read in mysqlnd
Priority MEDIUM 59
In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, a hostile MySQL server can cause the client to disclose the content of its heap containing data from other SQL requests and possible other da…
TI-2024-08288 CVE-2024-8925
Erroneous parsing of multipart form data
Priority MEDIUM 57
In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, erroneous parsing of multipart form data contained in an HTTP POST request could lead to legitimate data not being processed.
TI-2024-08379 CVE-2024-9026
PHP-FPM logs from children may be altered
Priority MEDIUM 49
In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using PHP-FPM SAPI and it is configured to catch workers output through catch_workers_output = yes, it may be possible to pollute the fi…
TI-2024-08290 CVE-2024-8927
cgi.force_redirect configuration is bypassable due to the environment variable collision
Priority MEDIUM 41
In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, HTTP_REDIRECT_STATUS variable is used to check whether or not CGI binary is being run by the HTTP server.
Priority LOW 39
In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, due to an error in convert.quoted-printable-decode filter certain data can lead to buffer overread by one byte, which can in certain circumst…
TI-2024-10407 CVE-2024-11234
Configuring a proxy in a stream context might allow for CRLF injection in URIs
Priority LOW 34
In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, when using streams with configured proxy and "request_fulluri" option, the URI is not properly sanitized which can lead to HTTP request smugg…
TI-2024-02900 CVE-2024-3096
PHP function password_verify can erroneously return true when argument contains NUL
Priority LOW 34
In PHP version 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, if a password stored with password_hash() starts with a null byte (\x00), testing a blank string as the password via password_verify() will inc…