Multiple vulnerabilities have been discovered in PHP, the worst of which could lead to arbitrary code execution.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-lang/php | * | < 8.2.24:8.2, < 8.3.12:8.3, < 8.1.30:8.1 | >= 8.2.24:8.2, >= 8.3.12:8.3 |
PHP is a widely-used general-purpose scripting language that is especially suited for Web development and can be embedded into HTML.
Multiple vulnerabilities have been discovered in PHP. Please review the CVE identifiers referenced below for details.
Please review the referenced CVE identifiers for details.
There is no known workaround at this time.
All PHP users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-lang/php-8.2.24:8.2" # emerge --ask --oneshot --verbose ">=dev-lang/php-8.3.12:8.3"
Gentoo has discontinued support for php 8.1:
# emerge --ask --verbose --depclean "dev-lang/php:8.1"
Multiple vulnerabilities have been discovered in PHP, the worst of which can lead to a denial of service.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-lang/php | * | < 8.1, < 8.1.29:8.1, < 8.2.20:8.2, < 8.3.8:8.3 | >= 8.1.29:8.1, >= 8.2.20:8.2, >= 8.3.8:8.3 |
PHP is a widely-used general-purpose scripting language that is especially suited for Web development and can be embedded into HTML.
Multiple vulnerabilities have been discovered in PHP. Please review the CVE identifiers referenced below for details.
Please review the referenced CVE identifiers for details.
There is no known workaround at this time.
All PHP users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-lang/php-8.1.29:8.1" # emerge --ask --oneshot --verbose ">=dev-lang/php-8.2.20:8.2" # emerge --ask --oneshot --verbose ">=dev-lang/php-8.3.8:8.3"
Support for older version has been discontinued:
# emerge --ask --verbose --depclean "<dev-lang/php-8.1"
Multiple vulnerabilities have been found in PHP, the worst of which could result in arbitrary code execution.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-lang/php | * | < 8.1.12:8.1, < 8.0.25:8.0, < 7.4.33:7.4 | >= 8.1.12:8.1, >= 8.0.25:8.0, >= 7.4.33:7.4 |
PHP is a widely-used general-purpose scripting language that is especially suited for Web development and can be embedded into HTML.
Multiple vulnerabilities have been discovered in PHP. Please review the CVE identifiers referenced below for details.
Please review the referenced CVE identifiers for details.
There is no known workaround at this time.
All PHP 7.4 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-lang/php-7.4.33"
All PHP 8.0 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-lang/php-8.0.25"
All PHP 8.1 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-lang/php-8.1.12"
Multiple vulnerabilities have been discovered in PHP, the worst of which could result in local root privilege escalation.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-lang/php | * | < 7.4.30:7.4, < 8.0.23:8.0, < 8.1.8:8.1 | >= 7.4.30:7.4, >= 8.0.23:8.0, >= 8.1.8:8.1 |
PHP is a widely-used general-purpose scripting language that is especially suited for Web development and can be embedded into HTML.
Multiple vulnerabilities have been discovered in PHP. Please review the CVE identifiers referenced below for details.
Please review the referenced CVE identifiers for details.
There is no known workaround at this time.
All PHP 7.4 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-lang/php-7.4.30:7.4"
All PHP 8.0 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-lang/php-8.0.23:8.0"
All PHP 8.1 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-lang/php-8.1.8:8.1"
Multiple vulnerabilities have been found in PHP, the worst of which could result in a Denial of Service condition.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-lang/php | * | < 8.0.6 | >= 7.3.28:7.3, >= 7.4.19:7.4, >= 8.0.6:8.0 |
PHP is an open source general-purpose scripting language that is especially suited for web development.
Multiple vulnerabilities have been discovered in PHP. Please review the CVE identifiers and bugs referenced below for details.
Please review the referenced CVE identifiers and bugs for details.
There is no known workaround at this time.
All PHP 7.3.x users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-lang/php-7.3.28:7.3"
All PHP 7.4.x users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-lang/php-7.4.19:7.4"
All PHP 8.0.x users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-lang/php-8.0.6:8.0"
Multiple vulnerabilities have been found in PHP, the worst of which could result in a Denial of Service condition.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-lang/php | * | < 8.0.0 | >= 7.2.34-r1:7.2, >= 7.3.25:7.3, >= 7.4.13:7.4 |
PHP is an open source general-purpose scripting language that is especially suited for web development.
Multiple vulnerabilities have been discovered in PHP. Please review the CVE identifiers and change log referenced below for details.
An attacker could cause a Denial of Service condition or obtain sensitive information.
There is no known workaround at this time.
All PHP 7.2.x users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-lang/php-7.2.34-r1:7.2"
All PHP 7.3.x users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-lang/php-7.3.25:7.3"
All PHP 7.4.x users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-lang/php-7.4.13:7.4"
A vulnerabilities in PHP could lead to a Denial of Service condition.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-lang/php | * | < 7.2.33:7.2, < 7.3.21:7.3, < 7.4.9:7.4 | >= 7.2.33:7.2, >= 7.3.21:7.3, >= 7.4.9:7.4 |
PHP is an open source general-purpose scripting language that is especially suited for web development.
It was discovered that PHP did not properly handle PHAR files.
A remote attacker could entice a user to open a specially crafted PHAR file using PHP, possibly allowing attacker to obtain sensitive information or cause a Denial of Service condition.
There is no known workaround at this time.
All PHP 7.2 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-lang/php-7.2.33"
All PHP 7.3 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-lang/php-7.3.21"
All PHP 7.4 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-lang/php-7.4.9"
Multiple vulnerabilities have been found in PHP, the worst of which could result in the execution of arbitrary shell commands.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-lang/php | * | < 7.2.29:7.2, < 7.3.16:7.3, < 7.4.4:7.4 | >= 7.2.29:7.2, >= 7.3.16:7.3, >= 7.4.4:7.4 |
PHP is an open source general-purpose scripting language that is especially suited for web development.
Multiple vulnerabilities have been discovered in PHP. Please review the CVE identifiers referenced below for details.
An attacker could possibly execute arbitrary shell commands, cause a Denial of Service condition or obtain sensitive information.
There is no known workaround at this time.
All PHP 7.2.x users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-lang/php-7.2.29:7.2"
All PHP 7.3.x users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-lang/php-7.3.16:7.3"
All PHP 7.4.x users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-lang/php-7.4.4:7.4"
A vulnerability in PHP might allow an attacker to execute arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-lang/php | * | < 7.1.33, < 7.2.24, < 7.3.11, < 5.6.40-r7 | >= 7.1.33, >= 7.2.24, >= 7.3.11, >= 5.6.40-r7 |
PHP is an open source general-purpose scripting language that is especially suited for web development.
A underflow in env_path_info in PHP-FPM under certain configurations can be exploited to gain remote code execution.
A remote attacker, by sending special crafted HTTP requests, could possibly execute arbitrary code with the privileges of the process, or cause a Denial of Service condition.
If patching is not feasible, the suggested workaround is to include checks to verify whether or not a file exists before passing to PHP.
All PHP 5.6 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-lang/php-5.6.40-r7"
All PHP 7.1 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-lang/php-7.1.33"
All PHP 7.2 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-lang/php-7.2.24"
All PHP 7.3 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-lang/php-7.3.11"
Multiple vulnerabilities have been found in PHP, the worst of which could result in a Denial of Service condition.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-lang/php | * | < 5.6.38:5.6, < 7.0.32:7.0, < 7.1.22:7.1, < 7.2.10:7.2 | >= 5.6.38:5.6, >= 7.0.32:7.0, >= 7.1.22:7.1, >= 7.2.10:7.2 |
PHP is an open source general-purpose scripting language that is especially suited for web development.
Multiple vulnerabilities have been discovered in PHP. Please review the referenced CVE identifiers for details.
An attacker could cause a Denial of Service condition or obtain sensitive information.
There is no known workaround at this time.
All PHP 5.6.X users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-lang/php-5.6.38"
All PHP 7.0.X users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-lang/php-7.0.32"
All PHP 7.1.X users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-lang/php-7.1.22"
All PHP 7.2.x users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-lang/php-7.2.10"
Multiple vulnerabilities have been found in PHP, the worst of which could result in the execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-lang/php | * | < 5.6.31:5.6, < 7.0.23:7.0 | >= 5.6.31:5.6, >= 7.0.23:7.0 |
PHP is an open source general-purpose scripting language that is especially suited for web development.
Multiple vulnerabilities have been discovered in PHP. Please review the referenced CVE identifiers for details.
A remote attacker could execute arbitrary code with the privileges of the process or cause a Denial of Service condition.
There is no known workaround at this time.
All PHP 5.6.x users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-lang/php-5.6.31"
All PHP 7.0.x users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-lang/php-7.0.23"
Multiple vulnerabilities have been found in PHP, the worst of which could lead to arbitrary code execution or cause a Denial of Service condition.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-lang/php | * | < 5.6.30:5.6 | >= 5.6.30:5.6 |
PHP is a widely-used general-purpose scripting language that is especially suited for Web development and can be embedded into HTML.
Multiple vulnerabilities have been discovered in PHP. Please review the CVE identifiers referenced below for details.
An attacker could possibly execute arbitrary code or create a Denial of Service condition.
There is no known workaround at this time.
All PHP 5.6 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-lang/php-5.6.30:5.6"
Multiple vulnerabilities have been found in PHP, the worst of which could lead to arbitrary code execution or cause a Denial of Service condition.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-lang/php | * | < 5.6.28 | >= 5.6.28 |
PHP is a widely-used general-purpose scripting language that is especially suited for Web development and can be embedded into HTML.
Multiple vulnerabilities have been discovered in PHP. Please review the CVE identifiers referenced below for details.
An attacker can possibly execute arbitrary code or create a Denial of Service condition.
There is no known workaround at this time.
All PHP users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev=lang/php-5.6.28"
Multiple vulnerabilities have been found in PHP, the worst of which could lead to arbitrary code execution, or cause a Denial of Service condition.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-lang/php | * | < 5.6.19 | >= 5.6.19, >= 5.5.33 (revision), >= 5.5.34 (revision), >= 5.5.35 (revision), >= 5.5.36 (revision), >= 5.5.37 (revision), >= 5.5.38 (revision) |
PHP is a widely-used general-purpose scripting language that is especially suited for Web development and can be embedded into HTML.
Multiple vulnerabilities have been discovered in PHP. Please review the CVE identifiers referenced below for details.
An attacker can possibly execute arbitrary code or create a Denial of Service condition.
There is no known workaround at this time.
All PHP 5.4 users should upgrade to the latest 5.5 stable branch, as PHP 5.4 is now masked in Portage:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev=lang/php-5.5.33"
All PHP 5.5 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev=lang/php-5.5.33"
All PHP 5.6 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev=lang/php-5.6.19"
Multiple vulnerabilities have been discovered in PHP, the worst of which could lead to remote execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-lang/php | * | < 5.5.21 | >= 5.5.21, >= 5.4.37 (revision), >= 5.4.38 (revision), >= 5.4.39 (revision), >= 5.4.40 (revision), >= 5.4.41 (revision), >= 5.4.42 (revision), >= 5.4.43 (revision), >= 5.4.44 (revision), >= 5.4.45 (revision) |
PHP is a widely-used general-purpose scripting language that is especially suited for Web development and can be embedded into HTML.
Multiple vulnerabilities have been discovered in PHP. Please review the CVE identifiers referenced below for details.
A remote attacker can leverage these vulnerabilities to execute arbitrary code or cause Denial of Service.
There is no known workaround at this time.
All PHP 5.5 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-lang/php-5.5.21"
All PHP 5.4 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-lang/php-5.4.37"
All PHP 5.3 users should upgrade to the latest version. This branch is currently past the end of life and it will no longer receive security fixes. All PHP 5.3 users are strongly recommended to upgrade to the current stable version of PHP 5.5 or previous stable version of PHP 5.4, which are supported till at least 2016 and 2015 respectively.
Multiple vulnerabilities have been discovered in PHP, the worst of which could lead to remote execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-lang/php | * | < 5.5.18 | >= 5.5.18, >= 5.4.34 (revision), >= 5.3.29 (revision), >= 5.4.36 (revision), >= 5.4.37 (revision), >= 5.4.38 (revision), >= 5.4.39 (revision), >= 5.4.35 (revision), >= 5.4.40 (revision), >= 5.4.41 (revision), >= 5.4.42 (revision), >= 5.4.43 (revision), >= 5.4.44 (revision), >= 5.4.45 (revision), >= 5.4.46 (revision) |
PHP is a widely-used general-purpose scripting language that is especially suited for Web development and can be embedded into HTML.
Multiple vulnerabilities have been discovered in PHP. Please review the CVE identifiers referenced below for details.
A context-dependent attacker can possibly execute arbitrary code or create a Denial of Service condition.
There is no known workaround at this time.
All PHP 5.5 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-lang/php-5.5.18"
All PHP 5.4 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-lang/php-5.4.34"
All PHP 5.3 users should upgrade to the latest version. This release marks the end of life of the PHP 5.3 series. Future releases of this series are not planned. All PHP 5.3 users are encouraged to upgrade to the current stable version of PHP 5.5 or previous stable version of PHP 5.4, which are supported till at least 2016 and 2015 respectively.
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-lang/php-5.3.29"
Multiple vulnerabilities have been discovered in PHP, the worst of which could lead to remote execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-lang/php | * | < 5.5.16 | >= 5.5.16, >= 5.4.32 (revision), >= 5.3.29 (revision), >= 5.4.34 (revision), >= 5.4.35 (revision), >= 5.4.36 (revision), >= 5.4.37 (revision), >= 5.4.38 (revision), >= 5.4.39 (revision), >= 5.4.40 (revision), >= 5.4.41 (revision), >= 5.4.42 (revision), >= 5.4.43 (revision), >= 5.4.44 (revision), >= 5.4.45 (revision), >= 5.4.46 (revision) |
PHP is a widely-used general-purpose scripting language that is especially suited for Web development and can be embedded into HTML.
Multiple vulnerabilities have been discovered in PHP. Please review the CVE identifiers referenced below for details.
A context-dependent attacker can cause arbitrary code execution, create a Denial of Service condition, read or write arbitrary files, impersonate other servers, hijack a web session, or have other unspecified impact. Additionally, a local attacker could gain escalated privileges.
There is no known workaround at this time.
All PHP 5.5 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-lang/php-5.5.16"
All PHP 5.4 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-lang/php-5.4.32"
All PHP 5.3 users should upgrade to the latest version. This release marks the end of life of the PHP 5.3 series. Future releases of this series are not planned. All PHP 5.3 users are encouraged to upgrade to the current stable version of PHP 5.5 or previous stable version of PHP 5.4, which are supported till at least 2016 and 2015 respectively.
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-lang/php-5.3.29"
Multiple vulnerabilities were found in PHP, the worst of which lead to remote execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-lang/php | * | < 5.3.15, < 5.4.5 | >= 5.3.15, >= 5.4.5 |
PHP is a widely-used general-purpose scripting language that is especially suited for Web development and can be embedded into HTML.
Multiple vulnerabilities have been discovered in PHP. Please review the CVE identifiers referenced below for details.
A remote attacker could execute arbitrary code with the privileges of the process, cause a Denial of Service condition, obtain sensitive information, create arbitrary files, conduct directory traversal attacks, bypass protection mechanisms, or perform further attacks with unspecified impact.
There is no known workaround at this time.
All PHP users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-lang/php-5.3.15"
All PHP users on ARM should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-lang/php-5.4.5"
Multiple vulnerabilities were found in PHP, the worst of which leading to remote execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-lang/php | * | < 5.3.8 | >= 5.3.8 |
PHP is a widely-used general-purpose scripting language that is especially suited for Web development and can be embedded into HTML.
Multiple vulnerabilities have been discovered in PHP. Please review the CVE identifiers referenced below for details.
A context-dependent attacker could execute arbitrary code, obtain sensitive information from process memory, bypass intended access restrictions, or cause a Denial of Service in various ways.
A remote attacker could cause a Denial of Service in various ways, bypass spam detections, or bypass open_basedir restrictions.
There is no known workaround at this time.
All PHP users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-lang/php-5.3.8"
Multiple vulnerabilities were found in PHP, the worst of which leading to the remote execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-lang/php | * | < 5.2.12 | >= 5.2.12 |
PHP is a widely-used general-purpose scripting language that is especially suited for Web development and can be embedded into HTML.
Multiple vulnerabilities have been discovered in PHP. Please review the CVE identifiers referenced below and the associated PHP release notes for details.
A context-dependent attacker could execute arbitrary code via a specially crafted string containing an HTML entity when the mbstring extension is enabled. Furthermore a remote attacker could execute arbitrary code via a specially crafted GD graphics file.
A remote attacker could also cause a Denial of Service via a malformed string passed to the json_decode() function, via a specially crafted ZIP file passed to the php_zip_make_relative_path() function, via a malformed JPEG image passed to the exif_read_data() function, or via temporary file exhaustion. It is also possible for an attacker to spoof certificates, bypass various safe_mode and open_basedir restrictions when certain criteria are met, perform Cross-site scripting attacks, more easily perform SQL injection attacks, manipulate settings of other virtual hosts on the same server via a malicious .htaccess entry when running on Apache, disclose memory portions, and write arbitrary files via a specially crafted ZIP archive. Some vulnerabilities with unknown impact and attack vectors have been reported as well.
There is no known workaround at this time.
All PHP users should upgrade to the latest version. As PHP is statically linked against a vulnerable version of the c-client library when the imap or kolab USE flag is enabled (GLSA 200911-03), users should upgrade net-libs/c-client beforehand:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-libs/c-client-2007e" # emerge --ask --oneshot --verbose ">=dev-lang/php-5.2.12"
PHP contains several vulnerabilities including buffer and integer overflows which could lead to the remote execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-lang/php | * | < 5.2.6-r6 | >= 5.2.6-r6 |
PHP is a widely-used general-purpose scripting language that is especially suited for Web development and can be embedded into HTML.
Several vulnerabilitites were found in PHP:
These vulnerabilities might allow a remote attacker to execute arbitrary code, to cause a Denial of Service, to circumvent security restrictions, to disclose information, and to manipulate files.
There is no known workaround at this time.
All PHP users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-lang/php-5.2.6-r6"
PHP contains several vulnerabilities including buffer and integer overflows which could lead to the remote execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-lang/php | * | < 5.2.4_p20070914-r2 | >= 5.2.4_p20070914-r2 |
PHP is a widely-used general-purpose scripting language that is especially suited for Web development and can be embedded into HTML.
Several vulnerabilities were found in PHP. Mattias Bengtsson and Philip Olausson reported integer overflows in the gdImageCreate() and gdImageCreateTrueColor() functions of the GD library which can cause heap-based buffer overflows (CVE-2007-3996). Gerhard Wagner discovered an integer overflow in the chunk_split() function that can lead to a heap-based buffer overflow (CVE-2007-2872). Its incomplete fix caused incorrect buffer size calculation due to precision loss, also resulting in a possible heap-based buffer overflow (CVE-2007-4661 and CVE-2007-4660). A buffer overflow in the sqlite_decode_binary() of the SQLite extension found by Stefan Esser that was addressed in PHP 5.2.1 was not fixed correctly (CVE-2007-1887).
Stefan Esser discovered an error in the zend_alter_ini_entry() function handling a memory_limit violation (CVE-2007-4659). Stefan Esser also discovered a flaw when handling interruptions with userspace error handlers that can be exploited to read arbitrary heap memory (CVE-2007-1883). Disclosure of sensitive memory can also be triggered due to insufficient boundary checks in the strspn() and strcspn() functions, an issue discovered by Mattias Bengtsson and Philip Olausson (CVE-2007-4657)
Stefan Esser reported incorrect validation in the FILTER_VALIDATE_EMAIL filter of the Filter extension allowing arbitrary email header injection (CVE-2007-1900). NOTE: This CVE was referenced, but not fixed in GLSA 200705-19.
Stanislav Malyshev found an error with unknown impact in the money_format() function when processing "%i" and "%n" tokens (CVE-2007-4658). zatanzlatan reported a buffer overflow in the php_openssl_make_REQ() function with unknown impact when providing a manipulated SSL configuration file (CVE-2007-4662). Possible memory corruption when trying to read EXIF data in exif_read_data() and exif_thumbnail() occurred with unknown impact.
Several vulnerabilities that allow bypassing of open_basedir and other restrictions were reported, including the glob() function (CVE-2007-4663), the session_save_path(), ini_set(), and error_log() functions which can allow local command execution (CVE-2007-3378), involving the readfile() function (CVE-2007-3007), via the Session extension (CVE-2007-4652), via the MySQL extension (CVE-2007-3997) and in the dl() function which allows loading extensions outside of the specified directory (CVE-2007-4825).
Multiple Denial of Service vulnerabilities were discovered, including a long "library" parameter in the dl() function (CVE-2007-4887), in several iconv and xmlrpc functions (CVE-2007-4840 and CVE-2007-4783), in the setlocale() function (CVE-2007-4784), in the glob() and fnmatch() function (CVE-2007-4782 and CVE-2007-3806), a floating point exception in the wordwrap() function (CVE-2007-3998), a stack exhaustion via deeply nested arrays (CVE-2007-4670), an infinite loop caused by a specially crafted PNG image in the png_read_info() function of libpng (CVE-2007-2756) and several issues related to array conversion.
Remote attackers might be able to exploit these issues in PHP applications making use of the affected functions, potentially resulting in the execution of arbitrary code, Denial of Service, execution of scripted contents in the context of the affected site, security bypass or information leak.
There is no known workaround at this time.
All PHP users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-lang/php-5.2.4_p20070914-r2"
PHP contains several vulnerabilities including buffer and integer overflows which could under certain conditions lead to the remote execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-lang/php | * | < 5.2.2 | >= 4.4.7 (revision), >= 4.4.8_pre20070816 (revision), >= 5.2.2 |
PHP is a widely-used general-purpose scripting language that is especially suited for Web development and can be embedded into HTML.
Several vulnerabilities were found in PHP, most of them during the Month Of PHP Bugs (MOPB) by Stefan Esser. The most severe of these vulnerabilities are integer overflows in wbmp.c from the GD library (CVE-2007-1001) and in the substr_compare() PHP 5 function (CVE-2007-1375). Ilia Alshanetsky also reported a buffer overflow in the make_http_soap_request() and in the user_filter_factory_create() functions (CVE-2007-2510, CVE-2007-2511), and Stanislav Malyshev discovered another buffer overflow in the bundled XMLRPC library (CVE-2007-1864). Additionally, the session_regenerate_id() and the array_user_key_compare() functions contain a double-free vulnerability (CVE-2007-1484, CVE-2007-1521). Finally, there exist implementation errors in the Zend engine, in the mb_parse_str(), the unserialize() and the mail() functions and other elements.
Remote attackers might be able to exploit these issues in PHP applications making use of the affected functions, potentially resulting in the execution of arbitrary code, Denial of Service, execution of scripted contents in the context of the affected site, security bypass or information leak.
There is no known workaround at this time.
All PHP 5 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-lang/php-5.2.2"
All PHP 4 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-lang/php-4.4.7"
PHP contains several vulnerabilities including a heap buffer overflow, potentially leading to the remote execution of arbitrary code under certain conditions.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-lang/php | * | < 5.2.1-r3 | >= 5.2.1-r3, >= 5.1.6-r11 (revision), >= 4.4.6 (revision), >= 4.4.7 (revision), >= 4.4.8_pre20070816 (revision) |
PHP is a widely-used general-purpose scripting language that is especially suited for Web development and can be embedded into HTML.
Several vulnerabilities were found in PHP by the Hardened-PHP Project and other researchers. These vulnerabilities include a heap-based buffer overflow in htmlentities() and htmlspecialchars() if called with UTF-8 parameters, and an off-by-one error in str_ireplace(). Other vulnerabilities were also found in the PHP4 branch, including possible overflows, stack corruptions and a format string vulnerability in the *print() functions on 64 bit systems.
Remote attackers might be able to exploit these issues in PHP applications making use of the affected functions, potentially resulting in the execution of arbitrary code, Denial of Service, execution of scripted contents in the context of the affected site, security bypass or information leak.
There is no known workaround at this time.
All PHP users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose "dev-lang/php"
PHP is vulnerable to an integer overflow potentially allowing the remote execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-lang/php | * | < 5.1.6-r6 | >= 4.4.4-r6 (revision), >= 4.4.6 (revision), >= 4.4.7 (revision), >= 4.4.8_pre20070816 (revision), >= 5.1.6-r6 |
PHP is a widely-used general-purpose scripting language that is especially suited for Web development and can be embedded into HTML.
A flaw in the PHP memory handling routines allows an unserialize() call to be executed on non-allocated memory due to a previous integer overflow.
An attacker could execute arbitrary code with the rights of the web server user or the user running a vulnerable PHP script.
There is no known workaround at this time.
All PHP 5.x users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-lang/php-5.1.6-r6"
All PHP 4.x users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-lang/php-4.4.4-r6"
PHP contains a function that, when used, could allow a remote attacker to execute arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-lang/php | * | < 5.1.4-r6 | >= 4.4.3-r1 (revision), >= 4.4.4-r4 (revision), >= 4.4.6 (revision), >= 4.4.7 (revision), >= 4.4.8_pre20070816 (revision), >= 5.1.4-r6 |
PHP is a widely-used general-purpose scripting language that is especially suited for Web development and can be embedded into HTML.
The sscanf() PHP function contains an array boundary error that can be exploited to dereference a null pointer. This can possibly allow the bypass of the safe mode protection by executing arbitrary code.
A remote attacker might be able to exploit this vulnerability in PHP applications making use of the sscanf() function, potentially resulting in the execution of arbitrary code or the execution of scripted contents in the context of the affected site.
There is no known workaround at this time.
All PHP 4.x users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-lang/php-4.4.3-r1"
All PHP 5.x users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-lang/php-5.1.4-r6"
PHP is affected by multiple issues, including a buffer overflow in wordwrap() which may lead to execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-lang/php | alpha amd64 ia64 ppc64 | < 5.1.4, < 5.1.4-r4 | >= 5.1.4, >= 4.4.2-r2 (revision), >= 4.4.3-r1 (revision), >= 4.4.4-r4 (revision), >= 4.4.6 (revision), >= 4.4.7, >= 5.1.4-r4, >= 4.4.2-r6 (revision), >= 4.4.3-r1 (revision), >= 4.4.4-r4 (revision), >= 4.4.6 (revision), >= 4.4.7 |
| dev-lang/php | arm hppa ppc s390 sh sparc x86 | < 5.1.4, < 5.1.4-r4 | >= 5.1.4, >= 4.4.2-r2 (revision), >= 4.4.3-r1 (revision), >= 4.4.4-r4 (revision), >= 4.4.6 (revision), >= 4.4.7, >= 5.1.4-r4, >= 4.4.2-r6 (revision), >= 4.4.3-r1 (revision), >= 4.4.4-r4 (revision), >= 4.4.6 (revision), >= 4.4.7 |
PHP is a widely-used general-purpose scripting language that is especially suited for Web development and can be embedded into HTML.
Several vulnerabilities were discovered on PHP4 and PHP5 by Infigo, Tonu Samuel and Maksymilian Arciemowicz. These included a buffer overflow in the wordwrap() function, restriction bypasses in the copy() and tempname() functions, a cross-site scripting issue in the phpinfo() function, a potential crash in the substr_compare() function and a memory leak in the non-binary-safe html_entity_decode() function.
Remote attackers might be able to exploit these issues in PHP applications making use of the affected functions, potentially resulting in the execution of arbitrary code, Denial of Service, execution of scripted contents in the context of the affected site, security bypass or information leak.
There is no known workaround at this point.
All PHP users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose dev-lang/php
Multiple vulnerabilities in PHP allow remote attackers to inject arbitrary HTTP headers, perform cross site scripting or in some cases execute arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-lang/php | * | < 4.4.2, >= 5.1.1 (revision), >= 5.0.5 (revision), >= 5.0.4 (revision) | >= 5.1.2 |
PHP is a general-purpose scripting language widely used to develop web-based applications. It can run on a web server with the mod_php module or the CGI version and also stand-alone in a CLI.
Stefan Esser of the Hardened PHP project has reported a few vulnerabilities found in PHP:
By sending a specially crafted request, a remote attacker can exploit this vulnerability to inject arbitrary HTTP headers, which will be included in the response sent to the user. The format string vulnerability may be exploited to execute arbitrary code.
There is no known workaround at this time.
All PHP 5.x users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-lang/php-5.1.2"
All PHP 4.x users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-lang/php-4.4.2"