[USN-7157-2] PHP regression
[USN-7157-1] PHP vulnerabilities
[USN-7157-2] PHP regression
==========================================================================
Ubuntu Security Notice USN-7157-2
December 13, 2024
php7.4 regression
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 20.04 LTS
Summary:
USN-7157-1 introduced a regression in PHP.
Software Description:
- php7.4: HTML-embedded scripting language interpreter
Details:
USN-7157-1 fixed vulnerabilities in PHP. The patch for
CVE-2024-8932 caused a regression in php7.4. This
update fixes the problem.
Original advisory details:
It was discovered that PHP incorrectly handled certain inputs when
processed with convert.quoted-printable decode filters.
An attacker could possibly use this issue to expose sensitive
information or cause a crash. (CVE-2024-11233)
It was discovered that PHP incorrectly handled certain HTTP requests.
An attacker could possibly use this issue to performing arbitrary
HTTP requests originating from the server, thus potentially
gaining access to resources not normally available to the external
user. (CVE-2024-11234)
It was discovered that PHP incorrectly handled certain inputs.
An attacker could possibly use this issue to cause a crash or
execute arbitrary code. (CVE-2024-11236, CVE-2024-8932)
It was discovered that PHP incorrectly handled certain MySQL requests.
An attacker could possibly use this issue to cause the client to
disclose the content of its heap containing data from other SQL requests
and possible other data belonging to different users of the same server.
(CVE-2024-8929)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 20.04 LTS
libapache2-mod-php7.4 7.4.3-4ubuntu2.28
php7.4 7.4.3-4ubuntu2.28
php7.4-cgi 7.4.3-4ubuntu2.28
php7.4-cli 7.4.3-4ubuntu2.28
php7.4-ldap 7.4.3-4ubuntu2.28
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-7157-2
https://ubuntu.com/security/notices/USN-7157-1
CVE-2024-8932
Package Information:
https://launchpad.net/ubuntu/+source/php7.4/7.4.3-4ubuntu2.28
[USN-7157-1] PHP vulnerabilities
==========================================================================
Ubuntu Security Notice USN-7157-1
December 13, 2024
php7.4, php8.1, php8.3 vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 24.10
- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
Summary:
Several security issues were fixed in PHP.
Software Description:
- php8.3: HTML-embedded scripting language interpreter
- php8.1: HTML-embedded scripting language interpreter
- php7.4: HTML-embedded scripting language interpreter
Details:
It was discovered that PHP incorrectly handled certain inputs when
processed with convert.quoted-printable decode filters.
An attacker could possibly use this issue to expose sensitive
information or cause a crash. (CVE-2024-11233)
It was discovered that PHP incorrectly handled certain HTTP requests.
An attacker could possibly use this issue to performing arbitrary
HTTP requests originating from the server, thus potentially
gaining access to resources not normally available to the external
user. (CVE-2024-11234)
It was discovered that PHP incorrectly handled certain inputs.
An attacker could possibly use this issue to cause a crash or
execute arbitrary code. (CVE-2024-11236, CVE-2024-8932)
It was discovered that PHP incorrectly handled certain MySQL requests.
An attacker could possibly use this issue to cause the client to
disclose the content of its heap containing data from other SQL
requests
and possible other data belonging to different users of the same
server.
(CVE-2024-8929)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 24.10
libapache2-mod-php8.3 8.3.11-0ubuntu0.24.10.4
php8.3 8.3.11-0ubuntu0.24.10.4
php8.3-cgi 8.3.11-0ubuntu0.24.10.4
php8.3-cli 8.3.11-0ubuntu0.24.10.4
php8.3-fpm 8.3.11-0ubuntu0.24.10.4
php8.3-mysql 8.3.11-0ubuntu0.24.10.4
Ubuntu 24.04 LTS
libapache2-mod-php8.3 8.3.6-0ubuntu0.24.04.3
php8.3 8.3.6-0ubuntu0.24.04.3
php8.3-cgi 8.3.6-0ubuntu0.24.04.3
php8.3-cli 8.3.6-0ubuntu0.24.04.3
php8.3-fpm 8.3.6-0ubuntu0.24.04.3
php8.3-mysql 8.3.6-0ubuntu0.24.04.3
Ubuntu 22.04 LTS
libapache2-mod-php7.4 8.1.2-1ubuntu2.20
libapache2-mod-php8.0 8.1.2-1ubuntu2.20
libapache2-mod-php8.1 8.1.2-1ubuntu2.20
php8.1 8.1.2-1ubuntu2.20
php8.1-cgi 8.1.2-1ubuntu2.20
php8.1-cli 8.1.2-1ubuntu2.20
php8.1-enchant 8.1.2-1ubuntu2.20
php8.1-fpm 8.1.2-1ubuntu2.20
php8.1-mysql 8.1.2-1ubuntu2.20
Ubuntu 20.04 LTS
libapache2-mod-php7.4 7.4.3-4ubuntu2.26
php7.4 7.4.3-4ubuntu2.26
php7.4-cgi 7.4.3-4ubuntu2.26
php7.4-cli 7.4.3-4ubuntu2.26
php7.4-fpm 7.4.3-4ubuntu2.26
php7.4-mysql 7.4.3-4ubuntu2.26
In general, a standard system update will make all the necessary
changes.
References:
https://ubuntu.com/security/notices/USN-7157-1
CVE-2024-11233, CVE-2024-11234, CVE-2024-11236, CVE-2024-8929,
CVE-2024-8932
Package Information:
https://launchpad.net/ubuntu/+source/php8.3/8.3.11-0ubuntu0.24.10.4
https://launchpad.net/ubuntu/+source/php8.3/8.3.6-0ubuntu0.24.04.3
https://launchpad.net/ubuntu/+source/php8.1/8.1.2-1ubuntu2.20
https://launchpad.net/ubuntu/+source/php7.4/7.4.3-4ubuntu2.26
