CVE-2022-31625

In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when using Postgres database extension, supplying invalid parameters to the parametrized query may lead to PHP attempting to free memory using uninitialized data as pointers. This could lead to RCE vulnerability or denial of service.

In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when using Postgres database extension, supplying invalid parameters to the parametrized query may lead to PHP attempting to free memory using uninitialized data as pointers. This could lead to RCE vulnerability or denial of service.

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts. The php package contains the module (often referred to as mod_php) which adds support for the PHP language to Apache HTTP Server.

Security Fix(es):

In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when pdo_mysql extension with mysqlnd driver, if the third party is allowed to supply host to connect to and the password for the connection, password of excessive length can trigger a buffer overflow in PHP, which can lead to a remote code execution vulnerability.(CVE-2022-31626)

In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when using Postgres database extension, supplying invalid parameters to the parametrized query may lead to PHP attempting to free memory using uninitialized data as pointers. This could lead to RCE vulnerability or denial of service.(CVE-2022-31625)

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

Security Fix(es):

• php: uninitialized array in pg_query_params() leading to RCE (CVE-2022-31625)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

The following packages have been upgraded to a later upstream version: php (8.0.20). (BZ#2100876)

Security Fix(es):

• php: Use after free due to php_filter_float() failing for ints (CVE-2021-21708)

• php: Uninitialized array in pg_query_params() leading to RCE (CVE-2022-31625)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.7 Release Notes linked from the References section.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

The following packages have been upgraded to a later upstream version: php (8.0.20). (BZ#2095752)

Security Fix(es):

• php: Use after free due to php_filter_float() failing for ints (CVE-2021-21708)

• php: Uninitialized array in pg_query_params() leading to RCE (CVE-2022-31625)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 9.1 Release Notes linked from the References section.

In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when using Postgres database extension, supplying invalid parameters to the parametrized query may lead to PHP attempting to free memory using uninitialized data as pointers. This could lead to RCE vulnerability or denial of service.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fix(es):

• php: uninitialized array in pg_query_params() leading to RCE (CVE-2022-31625) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

The following packages have been upgraded to a later upstream version: php (8.0.20). (BZ#2100876)

Security Fix(es):

• php: Use after free due to php_filter_float() failing for ints (CVE-2021-21708)
• php: Uninitialized array in pg_query_params() leading to RCE (CVE-2022-31625)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

The following packages have been upgraded to a later upstream version: php (8.0.20). (BZ#2095752)

Security Fix(es):

• php: Use after free due to php_filter_float() failing for ints (CVE-2021-21708)
• php: Uninitialized array in pg_query_params() leading to RCE (CVE-2022-31625)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when using Postgres database extension, supplying invalid parameters to the parametrized query may lead to PHP attempting to free memory using uninitialized data as pointers. This could lead to RCE vulnerability or denial of service.

In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when using Postgres database extension, supplying invalid parameters to the parametrized query may lead to PHP attempting to free memory using uninitialized data as pointers. This could lead to RCE vulnerability or denial of service.

In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when using Postgres database extension, supplying invalid parameters to the parametrized query may lead to PHP attempting to free memory using uninitialized data as pointers. This could lead to RCE vulnerability or denial of service.

• CVE-2022-31626: php: password of excessive length triggers buffer overflow leading to RCE
• CVE-2022-31625: don't free uninitialized parameters that have led to RCE

• CVE-2022-31626: php: password of excessive length triggers buffer overflow leading to RCE
• CVE-2022-31625: don't free uninitialized parameters that have led to RCE

• SECURITY UPDATE: RCE via Uninitialized array in pg_query_params()
  • debian/patches/CVE-2022-31625.patch: don't free parameters which haven't initialized yet in ext/pgsql/pgsql.c, ext/pgsql/tests/bug81720.phpt.
  • CVE-2022-31625
• SECURITY UPDATE: RCE via mysqlnd/pdo password buffer overflow
  • debian/patches/CVE-2022-31626.patch: properly calculate size in ext/mysqlnd/mysqlnd_wireprotocol.c.
  • CVE-2022-31626

• ELS-189: Fix for Harden PHP
• CVE-2022-31625: Fix freeing of uninitialized memory leading to RCE

• CVE-2022-31625: fix free of uninitialized memory leading to RCE

• CVE-2021-21702: Fix null pointer crash because of malformed SOAP server response
• CVE-2021-21703: Fix error in php fpm shared memory organization leading to privilage escalation
• CVE-2022-31625: Fix freeing of uninitialized memory leading to RCE
• CVE-2022-31626: Fix buffer overflow in mysqlnd driver leading to RCE
• CVE-2023-0568: Fix array overrun when appending slash to paths in DOM and XML cases
• CVE-2023-0662: Fix DOS vulnerabality by limiting number of parsed multipart body parts and printing upload limit exceed error message only once
• CVE-2023-3823: Fix external entity loading in XML without enabling it, by sanitizing libxml2 globals before parsing
• CVE-2023-3824: Fix buffer mismanagement in phar_dir_read()

• CVE-2021-21702: fix NULL pointer dereference in SoapClient
• CVE-2021-21703: fix OOB R/W in root process leading to privilege escalation
• CVE-2022-31625: don't free uninitialized parameters in pg_query_params/pg_send_execute that have led to RCE
• CVE-2022-31626: fix mysqlnd/pdo password of excessive length triggering buffer overflow leading to RCE
• CVE-2022-31630: fix OOB read due to insufficient input validation in imageloadfont()
• CVE-2022-37454: fix buffer overflow in the Keccak XKCP SHA-3 reference implementation
• CVE-2023-0662: fix DoS vulnerability when parsing multipart request body

CLI -Fixed bug #8575 (CLI closes standard streams too early). Core -Fixed Haiku ZTS builds. Date -Fixed bug #8471 (Segmentation fault when converting immutable and mutable DateTime instances created using reflection). php-fpm - Fixed bug #72185 writes empty fcgi record causing nginx 502. Mysqlnd - Fixed bug #81719: mysqlnd/pdo password buffer overflow. (CVE-2022-31626) OPcache - Fixed bug #8466 (ini_get() is optimized out when the option does not exist). Pcntl - Fixed Haiku build. Pgsql - Fixed bug #81720: Uninitialized array in pg_query_params(). (CVE-2022-31625) Soap - Fixed bug #8578 (Error on wrong parameter on SoapHeader constructor). Fixed bug #8538 (SoapClient may strip parts of nmtokens). SPL - Fixed bug #8235 (iterator_count() may run indefinitely). Zip - Fixed type for index in ZipArchive::replaceFile.

These are all security issues fixed in the php8-8.2.10-3.1 package on the GA media of openSUSE Tumbleweed.

This update for php74 fixes the following issues:

• CVE-2022-31625: Fixed uninitialized pointers free in Postgres extension. (bsc#1200645)
• CVE-2022-31626: Fixed buffer overflow via user-supplied password when using pdo_mysql extension with mysqlnd driver. (bsc#1200628).

This update for php72 fixes the following issues:

• CVE-2022-31625: Fixed uninitialized pointers free in Postgres extension. (bsc#1200645)
• CVE-2022-31626: Fixed buffer overflow via user-supplied password when using pdo_mysql extension with mysqlnd driver. (bsc#1200628)

This update for php7 fixes the following issues:

• CVE-2022-31625: Fixed uninitialized pointers free in Postgres extension. (bsc#1200645)
• CVE-2022-31626: Fixed buffer overflow via user-supplied password when using pdo_mysql extension with mysqlnd driver. (bsc#1200628).

This update for php7 fixes the following issues:

• CVE-2022-31625: Fixed uninitialized pointers free in Postgres extension. (bsc#1200645)
• CVE-2022-31626: Fixed buffer overflow via user-supplied password when using pdo_mysql extension with mysqlnd driver. (bsc#1200628).

This update for php7 fixes the following issues:

• CVE-2021-21707: Fixed a special character breaks path in xml parsing. (bsc#1193041)
• CVE-2022-31625: Fixed uninitialized pointers free in Postgres extension. (bsc#1200645)
• CVE-2022-31626: Fixed buffer overflow via user-supplied password when using pdo_mysql extension with mysqlnd driver. (bsc#1200628)

This update for php8 fixes the following issues:

• CVE-2021-21707: Fixed a special character that breaks path in xml parsing. (bsc#1193041)
• CVE-2022-31625: Fixed uninitialized pointers free in Postgres extension. (bsc#1200645)
• CVE-2022-31626: Fixed buffer overflow via user-supplied password when using pdo_mysql extension with mysqlnd driver. (bsc#1200628)

This update for php7 fixes the following issues:

• Version update to 7.4.33:

• CVE-2022-31630: Fixed out-of-bounds read due to insufficient input validation in imageloadfont() (bsc#1204979).

• CVE-2022-37454: Fixed buffer overflow in hash_update() on long parameter (bsc#1204577).

• Version update to 7.4.32 (jsc#SLE-23639)

• CVE-2022-31628: Fixed an uncontrolled recursion in the phar uncompressor while decompressing 'quines' gzip files. (bsc#1203867)

• CVE-2022-31629: Fixed a bug which could lead an attacker to set an insecure cookie that will treated as secure in the victim's browser. (bsc#1203870)

This update for php7 fixes the following issues:

• Version update to 7.2.34 [jsc#SLE-23639]

• CVE-2022-37454: Fixed SHA-3 buffer overflow (bsc#1204577).

• Fix integer overflow in PHP_SHA3##bits (bsc#1204577#c26).

This update for php74 fixes the following issues:

• Version update to 7.4.33:

• CVE-2022-31630: Fixed out-of-bounds read due to insufficient input validation in imageloadfont() (bsc#1204979).

• CVE-2022-37454: Fixed buffer overflow in hash_update() on long parameter (bsc#1204577).

• Version update to 7.4.32 (jsc#SLE-23639)

• CVE-2022-31628: Fixed an uncontrolled recursion in the phar uncompressor while decompressing 'quines' gzip files. (bsc#1203867)

• CVE-2022-31629: Fixed a bug which could lead an attacker to set an insecure cookie that will treated as secure in the victim's browser. (bsc#1203870)

This update for php7 fixes the following issues:

• Version update to 7.4.33:

• CVE-2022-31630: Fixed out-of-bounds read due to insufficient input validation in imageloadfont() (bsc#1204979).

• CVE-2022-37454: Fixed buffer overflow in hash_update() on long parameter (bsc#1204577).

• Version update to 7.4.32 (jsc#SLE-23639)

• CVE-2022-31628: Fixed an uncontrolled recursion in the phar uncompressor while decompressing 'quines' gzip files. (bsc#1203867)

• CVE-2022-31629: Fixed a bug which could lead an attacker to set an insecure cookie that will treated as secure in the victim's browser. (bsc#1203870)

Charles Fol discovered that PHP incorrectly handled initializing certain arrays when handling the pg_query_params function. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2022-31625)

Charles Fol discovered that PHP incorrectly handled passwords in mysqlnd. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2022-31626)

USN-5479-1 fixed vulnerabilities in PHP. This update provides the corresponding updates for Ubuntu 16.04 ESM.

Original advisory details:

Charles Fol discovered that PHP incorrectly handled initializing certain arrays when handling the pg_query_params function. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2022-31625)

Charles Fol discovered that PHP incorrectly handled passwords in mysqlnd. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2022-31626)

USN-5479-1 fixed vulnerabilities in PHP. Unfortunately that update for CVE-2022-31625 was incomplete for Ubuntu 18.04 LTS. This update fixes the problem.

We apologize for the inconvenience.

Original advisory details:

Charles Fol discovered that PHP incorrectly handled initializing certain arrays when handling the pg_query_params function. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2022-31625)

Charles Fol discovered that PHP incorrectly handled passwords in mysqlnd. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2022-31626)