CVE-2024-1874

In PHP versions 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, when using proc_open() command with array syntax, due to insufficient escaping, if the arguments of the executed command are controlled by a malicious user, the user can supply arguments that would execute arbitrary commands in Windows shell.

In PHP versions 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, when using proc_open() command with array syntax, due to insufficient escaping, if the arguments of the executed command are controlled by a malicious user, the user can supply arguments that would execute arbitrary commands in Windows shell.

In PHP versions 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, when using proc_open() command with array syntax, due to insufficient escaping, if the arguments of the executed command are controlled by a malicious user, the user can supply arguments that would execute arbitrary commands in Windows shell.

In PHP versions 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, when using proc_open() command with array syntax, due to insufficient escaping, if the arguments of the executed command are controlled by a malicious user, the user can supply arguments that would execute arbitrary commands in Windows shell.

Core:

• Corrupted memory in destructor with weak references
• GC does not scale well with a lot of objects created in destructor DOM:
• Add some missing ZPP checks.
• Fix potential memory leak in XPath evaluation results. FPM:
• Fix incorrect check in fpm_shm_free(). Gettext:
• Fixed sigabrt raised with dcgettext/dcngettext calls with gettext 0.22.5 with category set to LC_ALL. MySQLnd:
• Fixed handshake response [mysqlnd]
• Fix incorrect charset length in check_mb_eucjpms(). Opcache:
• JITed QM_ASSIGN may be optimized out when op1 is null
• Segmentation fault for enabled observers when calling trait method of internal trait when opcache is loaded PDO:
• Fix various PDORow bugs. Random:
• Pre-PHP 8.2 compatibility for mt_srand with unknown modes
• Global Mt19937 is not properly reset in-between requests when MT_RAND_PHP is used Session:
• Segfault with session_decode and compilation error Sockets:
• socket_getsockname returns random characters in the end of the socket name SPL:
• Unable to resize SplfixedArray after being unserialized in PHP 8.2.15
• Unexpected null pointer in zend_string.h Standard:
• Added validation of \n in $additional_headers of mail()
• Command injection via array-ish $command parameter of proc_open). (CVE-2024-1874) Fixed bug GHSA-wpj3-hf5j-x4v4 (__Host-/__Secure- cookie bypass due to partial CVE-2022-31629 fix). (CVE-2024-2756)
• password_verify can erroneously return true, opening ATO risk. (CVE-2024-3096)

These are all security issues fixed in the php8-8.3.6-1.1 package on the GA media of openSUSE Tumbleweed.