CVE-2022-31628

In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the phar uncompressor code would recursively uncompress "quines" gzip files, resulting in an infinite loop.

In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the phar uncompressor code would recursively uncompress "quines" gzip files, resulting in an infinite loop.

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts.The php package contains the module (often referred to as mod_php) which adds support for the PHP language to Apache HTTP Server.

Security Fix(es):

In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the vulnerability enables network and same-site attackers to set a standard insecure cookie in the victim's browser which is treated as a __Host- or __Secure- cookie by PHP applications.(CVE-2022-31629)

In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the phar uncompressor code would recursively uncompress "quines" gzip files, resulting in an infinite loop.(CVE-2022-31628)

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts.The php package contains the module (often referred to as mod_php) which adds support for the PHP language to Apache HTTP Server.

Security Fix(es):

In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the vulnerability enables network and same-site attackers to set a standard insecure cookie in the victim's browser which is treated as a __Host- or __Secure- cookie by PHP applications.(CVE-2022-31629)

In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the phar uncompressor code would recursively uncompress "quines" gzip files, resulting in an infinite loop.(CVE-2022-31628)

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts.

Security Fix(es):

In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the phar uncompressor code would recursively uncompress "quines" gzip files, resulting in an infinite loop.(CVE-2022-31628)

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

The following packages have been upgraded to a later upstream version: php (8.0). (BZ#2161666)

Security Fix(es):

• XKCP: buffer overflow in the SHA-3 reference implementation (CVE-2022-37454)

• php: standard insecure cookie could be treated as a __Host- or __Secure- cookie by PHP applications (CVE-2022-31629)

• php: OOB read due to insufficient input validation in imageloadfont() (CVE-2022-31630)

• php: Due to an integer overflow PDO::quote() may return unquoted string (CVE-2022-31631)

• php: phar wrapper can occur dos when using quine gzip file (CVE-2022-31628)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

The following packages have been upgraded to a later upstream version: php (8.0.27). (BZ#2161667)

Security Fix(es):

• XKCP: buffer overflow in the SHA-3 reference implementation (CVE-2022-37454)

• php: standard insecure cookie could be treated as a __Host- or __Secure- cookie by PHP applications (CVE-2022-31629)

• php: OOB read due to insufficient input validation in imageloadfont() (CVE-2022-31630)

• php: Due to an integer overflow PDO::quote() may return unquoted string (CVE-2022-31631)

• php: phar wrapper can occur dos when using quine gzip file (CVE-2022-31628)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

The following packages have been upgraded to a later upstream version: php (8.1.14).

Security Fix(es):

• XKCP: buffer overflow in the SHA-3 reference implementation (CVE-2022-37454)

• php: standard insecure cookie could be treated as a '__Host-' or '__Secure-' cookie by PHP applications (CVE-2022-31629)

• php: OOB read due to insufficient input validation in imageloadfont() (CVE-2022-31630)

• php: PDO::quote() may return unquoted string due to an integer overflow (CVE-2022-31631)

• php: phar: infinite loop when decompressing quine gzip file (CVE-2022-31628)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 9.2 Release Notes linked from the References section.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

The following packages have been upgraded to a later upstream version: php (7.4.33).

Security Fix(es):

• XKCP: buffer overflow in the SHA-3 reference implementation (CVE-2022-37454)

• php: standard insecure cookie could be treated as a '__Host-' or '__Secure-' cookie by PHP applications (CVE-2022-31629)

• php: OOB read due to insufficient input validation in imageloadfont() (CVE-2022-31630)

• php: PDO::quote() may return unquoted string due to an integer overflow (CVE-2022-31631)

• php: phar: infinite loop when decompressing quine gzip file (CVE-2022-31628)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.8 Release Notes linked from the References section.

In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the phar uncompressor code would recursively uncompress "quines" gzip files, resulting in an infinite loop.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

The following packages have been upgraded to a later upstream version: php (8.0). (BZ#2161666)

Security Fix(es):

• XKCP: buffer overflow in the SHA-3 reference implementation (CVE-2022-37454)
• php: standard insecure cookie could be treated as a __Host- or __Secure- cookie by PHP applications (CVE-2022-31629)
• php: OOB read due to insufficient input validation in imageloadfont() (CVE-2022-31630)
• php: Due to an integer overflow PDO::quote() may return unquoted string (CVE-2022-31631)
• php: phar wrapper can occur dos when using quine gzip file (CVE-2022-31628)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

The following packages have been upgraded to a later upstream version: php (8.0.27). (BZ#2161667)

Security Fix(es):

• XKCP: buffer overflow in the SHA-3 reference implementation (CVE-2022-37454)
• php: standard insecure cookie could be treated as a __Host- or __Secure- cookie by PHP applications (CVE-2022-31629)
• php: OOB read due to insufficient input validation in imageloadfont() (CVE-2022-31630)
• php: Due to an integer overflow PDO::quote() may return unquoted string (CVE-2022-31631)
• php: phar wrapper can occur dos when using quine gzip file (CVE-2022-31628)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

The following packages have been upgraded to a later upstream version: php (8.1.14).

Security Fix(es):

• XKCP: buffer overflow in the SHA-3 reference implementation (CVE-2022-37454)
• php: standard insecure cookie could be treated as a '__Host-' or '__Secure-' cookie by PHP applications (CVE-2022-31629)
• php: OOB read due to insufficient input validation in imageloadfont() (CVE-2022-31630)
• php: PDO::quote() may return unquoted string due to an integer overflow (CVE-2022-31631)
• php: phar: infinite loop when decompressing quine gzip file (CVE-2022-31628)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

The following packages have been upgraded to a later upstream version: php (7.4.33).

Security Fix(es):

• XKCP: buffer overflow in the SHA-3 reference implementation (CVE-2022-37454)
• php: standard insecure cookie could be treated as a '__Host-' or '__Secure-' cookie by PHP applications (CVE-2022-31629)
• php: OOB read due to insufficient input validation in imageloadfont() (CVE-2022-31630)
• php: PDO::quote() may return unquoted string due to an integer overflow (CVE-2022-31631)
• php: phar: infinite loop when decompressing quine gzip file (CVE-2022-31628)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the phar uncompressor code would recursively uncompress "quines" gzip files, resulting in an infinite loop.

In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the phar uncompressor code would recursively uncompress "quines" gzip files, resulting in an infinite loop.

In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the phar uncompressor code would recursively uncompress "quines" gzip files, resulting in an infinite loop.

• SECURITY UPDATE: Denial of service
  • debian/patches/CVE-2022-31628.patch: Fix potential infinite recursion in phar wrapper when using quine gzip file
  • CVE-2022-31628
• SECURITY UPDATE: Cookie injection
  • debian/patches/CVE-2022-31629.patch: Add cookie integrity validation
  • CVE-2022-31629
• SECURITY UPDATE: Integer overflow
  • debian/patches/CVE-2022-31631.patch: Fix integer overflow that could cause PDO::quote() to return an improperly quoted string
  • CVE-2022-31631

• CVE-2022-31628: Fix potential infinite recursion in phar wrapper when using quine gzip file
• CVE-2022-31629: Add cookie integrity validation
• CVE-2022-31631: Fix integer overflow that could cause PDO::quote() to return an improperly quoted string

• CVE-2022-31628: Fix potential infinite recursion in phar wrapper when using quine gzip file
• CVE-2022-31629: Add cookie integrity validation
• CVE-2022-31631: Fix integer overflow that could cause PDO::quote() to return an improperly quoted string

• CVE-2021-21707: fix NUL byte truncation in XML/DOM URI file loading
• CVE-2022-31628: fix phar wrapper denial of service when loading compressed quine archives
• CVE-2022-31629: discard HTTP variables that mangle into __Host- or __Secure- prefixes

• CVE-2021-21707: fix NUL byte truncation in XML/DOM URI file loading
• CVE-2022-31628: fix phar wrapper denial of service when loading compressed quine archives
• CVE-2022-31629: discard HTTP variables that mangle into __Host- or __Secure- prefixes

Core Fixed bug GH-9323 (Crash in ZEND_RETURN/GC/zend_call_function) Fixed bug GH-9361 (Segmentation fault on script exit #9379). Fixed bug GH-9407 (LSP error in eval'd code refers to wrong class for static type). Fixed bug #81727: Don't mangle HTTP variable names that clash with ones that have a specific semantic meaning. (CVE-2022-31629)

DOM Fixed bug #79451 (DOMDocument->replaceChild on doctype causes double free).

FPM Fixed bug GH-8885 (FPM access.log with stderr begins to write logs to error_log after daemon reload). Fixed bug #77780 ("Headers already sent..." when previous connection was aborted).

GMP Fixed bug GH-9308 (GMP throws the wrong error when a GMP object is passed to gmp_init()).

Intl Fixed bug GH-9421 (Incorrect argument number for ValueError in NumberFormatter).

Phar Fixed bug #81726: phar wrapper: DOS when using quine gzip file. (CVE-2022-31628)

PDO_PGSQL Fixed bug GH-9411 (PgSQL large object resource is incorrectly closed).

Reflection Fixed bug GH-8932 (ReflectionFunction provides no way to get the called class of a Closure). Fixed bug GH-9409 (Private method is incorrectly dumped as "overwrites").

Streams Fixed bug GH-9316 ($http_response_header is wrong for long status line).

These are all security issues fixed in the php7-7.4.32-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the php8-8.1.11-1.1 package on the GA media of openSUSE Tumbleweed.

This update for php8 fixes the following issues:

• php8 was updated to version 8.0.24
• php8 was updated to version 8.0.23 (jsc#SLE-23639).
• CVE-2021-21703: Fixed a local privilege escalation via PHP-FPM. (bsc#1192050)
• CVE-2022-31628: Fixed an uncontrolled recursion in the phar uncompressor while decompressing 'quines' gzip files. (bsc#1203867)
• CVE-2022-31629: Fixed a bug which could lead an attacker to set an insecure cookie that will treated as secure in the victim's browser. (bsc#1203870)
• Fixed missing devel package requires pear and pecl extensions (jsc#SLE-24723, bsc#1200772).

This update for php7 fixes the following issues:

• CVE-2022-31628: Fixed an uncontrolled recursion in the phar uncompressor while decompressing 'quines' gzip files. (bsc#1203867)
• CVE-2022-31629: Fixed a bug which could lead an attacker to set an insecure cookie that will treated as secure in the victim's browser. (bsc#1203870)

This update for php72 fixes the following issues:

• CVE-2022-31628: Fixed an uncontrolled recursion in the phar uncompressor while decompressing 'quines' gzip files. (bsc#1203867)
• CVE-2022-31629: Fixed a bug which could lead an attacker to set an insecure cookie that will treated as secure in the victim's browser. (bsc#1203870)

This update for php7 fixes the following issues:

• Version update to 7.4.33:

• CVE-2022-31630: Fixed out-of-bounds read due to insufficient input validation in imageloadfont() (bsc#1204979).

• CVE-2022-37454: Fixed buffer overflow in hash_update() on long parameter (bsc#1204577).

• Version update to 7.4.32 (jsc#SLE-23639)

• CVE-2022-31628: Fixed an uncontrolled recursion in the phar uncompressor while decompressing 'quines' gzip files. (bsc#1203867)

• CVE-2022-31629: Fixed a bug which could lead an attacker to set an insecure cookie that will treated as secure in the victim's browser. (bsc#1203870)

This update for php7 fixes the following issues:

• Version update to 7.2.34 [jsc#SLE-23639]

• CVE-2022-37454: Fixed SHA-3 buffer overflow (bsc#1204577).

• Fix integer overflow in PHP_SHA3##bits (bsc#1204577#c26).

This update for php74 fixes the following issues:

• Version update to 7.4.33:

• CVE-2022-31630: Fixed out-of-bounds read due to insufficient input validation in imageloadfont() (bsc#1204979).

• CVE-2022-37454: Fixed buffer overflow in hash_update() on long parameter (bsc#1204577).

• Version update to 7.4.32 (jsc#SLE-23639)

• CVE-2022-31628: Fixed an uncontrolled recursion in the phar uncompressor while decompressing 'quines' gzip files. (bsc#1203867)

• CVE-2022-31629: Fixed a bug which could lead an attacker to set an insecure cookie that will treated as secure in the victim's browser. (bsc#1203870)

This update for php7 fixes the following issues:

• Version update to 7.4.33:

• CVE-2022-31630: Fixed out-of-bounds read due to insufficient input validation in imageloadfont() (bsc#1204979).

• CVE-2022-37454: Fixed buffer overflow in hash_update() on long parameter (bsc#1204577).

• Version update to 7.4.32 (jsc#SLE-23639)

• CVE-2022-31628: Fixed an uncontrolled recursion in the phar uncompressor while decompressing 'quines' gzip files. (bsc#1203867)

• CVE-2022-31629: Fixed a bug which could lead an attacker to set an insecure cookie that will treated as secure in the victim's browser. (bsc#1203870)

It was discovered that PHP incorrectly handled certain gzip files. An attacker could possibly use this issue to cause a denial of service. (CVE-2022-31628)

It was discovered that PHP incorrectly handled certain cookies. An attacker could possibly use this issue to compromise the data (CVE-2022-31629)

It was discovered that PHP incorrectly handled certain image fonts. An attacker could possibly use this issue to expose sensitive information. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.10, and Ubuntu 22.04 LTS. (CVE-2022-31630)

Nicky Mouha discovered that PHP incorrectly handled certain SHA-3 operations. An attacker could possibly use this issue to cause a crash or execute arbitrary code. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.10, and Ubuntu 22.04 LTS. (CVE-2022-37454)

It was discovered that PHP incorrectly handled certain gzip files. An attacker could possibly use this issue to cause a denial of service. (CVE-2022-31628)

It was discovered that PHP incorrectly handled certain cookies. An attacker could possibly use this issue to compromise data integrity. (CVE-2022-31629)

It was discovered that PHP incorrectly handled certain inputs. An attacker could possibly use this issue to cause a crash or execute arbitrary code. (CVE-2022-31631)

It was discovered that PHP incorrectly handled resolving long paths. A remote attacker could possibly use this issue to obtain or modify sensitive information. (CVE-2023-0568)

It was discovered that PHP incorrectly handled a large number of field and file parts in HTTP form uploads. A remote attacker could possibly use this issue to cause PHP to consume resources, leading to a denial of service. (CVE-2023-0662)