CVE-2024-11234

In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, when using streams with configured proxy and "request_fulluri" option, the URI is not properly sanitized which can lead to HTTP request smuggling and allow the attacker to use the proxy to perform arbitrary HTTP requests originating from the server, thus potentially gaining access to resources not normally available to the external user.

In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, when using streams with configured proxy and "request_fulluri" option, the URI is not properly sanitized which can lead to HTTP request smuggling and allow the attacker to use the proxy to perform arbitrary HTTP requests originating from the server, thus potentially gaining access to resources not normally available to the external user.

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts. %if 1 The php package contains the module (often referred to as mod_php) which adds support for the PHP language to Apache HTTP Server when running in prefork mode. This module is deprecated. %endif

Security Fix(es):

(CVE-2024-11233)

(CVE-2024-11234)

(CVE-2024-11236)

(CVE-2024-8929)

(CVE-2024-8932)

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

Security Fix(es):

• php: Leak partial content of the heap through heap buffer over-read in mysqlnd (CVE-2024-8929)

• php: Single byte overread with convert.quoted-printable-decode filter (CVE-2024-11233)

• php: Configuring a proxy in a stream context might allow for CRLF injection in URIs (CVE-2024-11234)

• php: Header parser of http stream wrapper does not handle folded headers (CVE-2025-1217)

• php: Stream HTTP wrapper header check might omit basic auth header (CVE-2025-1736)

• php: Streams HTTP wrapper does not fail for headers with invalid name and no colon (CVE-2025-1734)

• php: libxml streams use wrong content-type header when requesting a redirected resource (CVE-2025-1219)

• php: Stream HTTP wrapper truncates redirect location to 1024 bytes (CVE-2025-1861)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

Security Fix(es):

• php: Leak partial content of the heap through heap buffer over-read in mysqlnd (CVE-2024-8929)

• php: Single byte overread with convert.quoted-printable-decode filter (CVE-2024-11233)

• php: Configuring a proxy in a stream context might allow for CRLF injection in URIs (CVE-2024-11234)

• php: Header parser of http stream wrapper does not handle folded headers (CVE-2025-1217)

• php: Stream HTTP wrapper header check might omit basic auth header (CVE-2025-1736)

• php: Streams HTTP wrapper does not fail for headers with invalid name and no colon (CVE-2025-1734)

• php: libxml streams use wrong content-type header when requesting a redirected resource (CVE-2025-1219)

• php: Stream HTTP wrapper truncates redirect location to 1024 bytes (CVE-2025-1861)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

Security Fix(es):

• php: Leak partial content of the heap through heap buffer over-read in mysqlnd (CVE-2024-8929)

• php: Single byte overread with convert.quoted-printable-decode filter (CVE-2024-11233)

• php: Configuring a proxy in a stream context might allow for CRLF injection in URIs (CVE-2024-11234)

• php: Header parser of http stream wrapper does not handle folded headers (CVE-2025-1217)

• php: Stream HTTP wrapper header check might omit basic auth header (CVE-2025-1736)

• php: Streams HTTP wrapper does not fail for headers with invalid name and no colon (CVE-2025-1734)

• php: libxml streams use wrong content-type header when requesting a redirected resource (CVE-2025-1219)

• php: Stream HTTP wrapper truncates redirect location to 1024 bytes (CVE-2025-1861)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

Security Fix(es):

• php: Leak partial content of the heap through heap buffer over-read in mysqlnd (CVE-2024-8929)

• php: Single byte overread with convert.quoted-printable-decode filter (CVE-2024-11233)

• php: Configuring a proxy in a stream context might allow for CRLF injection in URIs (CVE-2024-11234)

• php: Header parser of http stream wrapper does not handle folded headers (CVE-2025-1217)

• php: Stream HTTP wrapper header check might omit basic auth header (CVE-2025-1736)

• php: Streams HTTP wrapper does not fail for headers with invalid name and no colon (CVE-2025-1734)

• php: libxml streams use wrong content-type header when requesting a redirected resource (CVE-2025-1219)

• php: Stream HTTP wrapper truncates redirect location to 1024 bytes (CVE-2025-1861)

• php: pgsql extension does not check for errors during escaping (CVE-2025-1735)

• php: NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix (CVE-2025-6491)

• php: PHP Hostname Null Character Vulnerability (CVE-2025-1220)

• php: heap-based buffer overflow in array_merge() (CVE-2025-14178)

• php: PHP: Information disclosure via getimagesize() function when reading multi-chunk images (CVE-2025-14177)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, when using streams with configured proxy and "request_fulluri" option, the URI is not properly sanitized which can lead to HTTP request smuggling and allow the attacker to use the proxy to perform arbitrary HTTP requests originating from the server, thus potentially gaining access to resources not normally available to the external user.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

Security Fix(es):

• php: Leak partial content of the heap through heap buffer over-read in mysqlnd (CVE-2024-8929)
• php: Single byte overread with convert.quoted-printable-decode filter (CVE-2024-11233)
• php: Configuring a proxy in a stream context might allow for CRLF injection in URIs (CVE-2024-11234)
• php: Header parser of http stream wrapper does not handle folded headers (CVE-2025-1217)
• php: Stream HTTP wrapper header check might omit basic auth header (CVE-2025-1736)
• php: Streams HTTP wrapper does not fail for headers with invalid name and no colon (CVE-2025-1734)
• php: libxml streams use wrong content-type header when requesting a redirected resource (CVE-2025-1219)
• php: Stream HTTP wrapper truncates redirect location to 1024 bytes (CVE-2025-1861)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

Security Fix(es):

• php: Leak partial content of the heap through heap buffer over-read in mysqlnd (CVE-2024-8929)
• php: Single byte overread with convert.quoted-printable-decode filter (CVE-2024-11233)
• php: Configuring a proxy in a stream context might allow for CRLF injection in URIs (CVE-2024-11234)
• php: Header parser of http stream wrapper does not handle folded headers (CVE-2025-1217)
• php: Stream HTTP wrapper header check might omit basic auth header (CVE-2025-1736)
• php: Streams HTTP wrapper does not fail for headers with invalid name and no colon (CVE-2025-1734)
• php: libxml streams use wrong content-type header when requesting a redirected resource (CVE-2025-1219)
• php: Stream HTTP wrapper truncates redirect location to 1024 bytes (CVE-2025-1861)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

Security Fix(es):

• php: Leak partial content of the heap through heap buffer over-read in mysqlnd (CVE-2024-8929)
• php: Single byte overread with convert.quoted-printable-decode filter (CVE-2024-11233)
• php: Configuring a proxy in a stream context might allow for CRLF injection in URIs (CVE-2024-11234)
• php: Header parser of http stream wrapper does not handle folded headers (CVE-2025-1217)
• php: Stream HTTP wrapper header check might omit basic auth header (CVE-2025-1736)
• php: Streams HTTP wrapper does not fail for headers with invalid name and no colon (CVE-2025-1734)
• php: libxml streams use wrong content-type header when requesting a redirected resource (CVE-2025-1219)
• php: Stream HTTP wrapper truncates redirect location to 1024 bytes (CVE-2025-1861)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

Security Fix(es):

• php: Leak partial content of the heap through heap buffer over-read in mysqlnd (CVE-2024-8929)
• php: Single byte overread with convert.quoted-printable-decode filter (CVE-2024-11233)
• php: Configuring a proxy in a stream context might allow for CRLF injection in URIs (CVE-2024-11234)
• php: Header parser of http stream wrapper does not handle folded headers (CVE-2025-1217)
• php: Stream HTTP wrapper header check might omit basic auth header (CVE-2025-1736)
• php: Streams HTTP wrapper does not fail for headers with invalid name and no colon (CVE-2025-1734)
• php: libxml streams use wrong content-type header when requesting a redirected resource (CVE-2025-1219)
• php: Stream HTTP wrapper truncates redirect location to 1024 bytes (CVE-2025-1861)
• php: pgsql extension does not check for errors during escaping (CVE-2025-1735)
• php: NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix (CVE-2025-6491)
• php: PHP Hostname Null Character Vulnerability (CVE-2025-1220)
• php: heap-based buffer overflow in array_merge() (CVE-2025-14178)
• php: PHP: Information disclosure via getimagesize() function when reading multi-chunk images (CVE-2025-14177)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, when using streams with configured proxy and "request_fulluri" option, the URI is not properly sanitized which can lead to HTTP request smuggling and allow the attacker to use the proxy to perform arbitrary HTTP requests originating from the server, thus potentially gaining access to resources not normally available to the external user.

In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, when using streams with configured proxy and "request_fulluri" option, the URI is not properly sanitized which can lead to HTTP request smuggling and allow the attacker to use the proxy to perform arbitrary HTTP requests originating from the server, thus potentially gaining access to resources not normally available to the external user.

In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, when using streams with configured proxy and "request_fulluri" option, the URI is not properly sanitized which can lead to HTTP request smuggling and allow the attacker to use the proxy to perform arbitrary HTTP requests originating from the server, thus potentially gaining access to resources not normally available to the external user.

• CVE-2024-11234: fix HTTP fulluri CRLF injection

• CVE-2024-11234: Fix possibility of HTTP request smuggling in configured proxy URI by prohibiting CRLF injection

• CVE-2024-11234: fix stream HTTP fulluri CRLF injection

• CVE-2024-11234: fix HTTP fulluri CRLF injection

• SECURITY UPDATE: improper sanitization of URIs leading to HTTP request smuggling
  • debian/patches/CVE-2024-11234.patch: Fix HTTP wrapper full URI path to disallow CR or LF characters
  • CVE-2024-11234

• CVE-2024-11234: fix HTTP fulluri CRLF injection

• SECURITY UPDATE: Security vulnerability
  • debian/patches/CVE-2024-11234.patch: Fix stream HTTP fulluri CRLF injection issue
  • CVE-2024-11234

• CVE-2024-11234: fix stream HTTP fulluri CRLF injection

• CVE-2024-8927: fix bypass of cgi.force_redirect configuration
• CVE-2024-11233: fix single byte overread with convert.quoted-printable-decode filter
• CVE-2024-11234: fix HTTP fulluri CRLF injection

• SECURITY UPDATE: out-of-bounds access
  • debian/patches/CVE-2017-9118.patch: fix out of bounds access in php_pcre_replace_impl
  • CVE-2017-9118
• SECURITY UPDATE: improper validation of HTTP_REDIRECT_STATUS variable in CGI binary
  • debian/patches/CVE-2024-8927.patch: fix Apache server name check; remove references to redirect.so and Netscape; check configuration override first
  • CVE-2024-8927
• SECURITY UPDATE: buffer overread vulnerability
  • debian/patches/CVE-2024-11233.patch: move bound check upwards to fix single byte overread with convert.quoted-printable-decode filter
  • CVE-2024-11233
• SECURITY UPDATE: URI is not properly sanitized
  • debian/patches/CVE-2024-11234.patch: when using streams with configured proxy and "request_fulluri" option, the URI is not properly sanitized which can lead to HTTP request smuggling and allow the attacker to use the proxy to perform arbitrary HTTP requests originating from the server, thus potentially gaining access to resources not normally available to the external user
  • CVE-2024-11234
• SECURITY UPDATE: incomplete check in escaping functions
  • debian/patches/CVE-2025-1735.patch: pgsql and pdo_pgsql escaping functions do not check if the underlying quoting functions returned errors. This could cause crashes if Postgres server rejects the string as invalid.
  • CVE-2025-1735

Some heap errors, segmentation faults and security vulnerabilities have been found and corrected. It is advised to install this update.

These are all security issues fixed in the php8-8.3.14-1.1 package on the GA media of openSUSE Tumbleweed.

This update for php8 fixes the following issues:

• CVE-2024-11233: Single byte overread with convert.quoted-printable-decode filter (bsc#1233702).
• CVE-2024-11234: Configuring a proxy in a stream context might allow for CRLF injection in URIs (bsc#1233703).
• CVE-2024-8929: Leak partial content of the heap through heap buffer over-read (bsc#1233651).

This update for php7 fixes the following issues:

• CVE-2024-11233: Single byte overread with convert.quoted-printable-decode filter (bsc#1233702).
• CVE-2024-11234: Configuring a proxy in a stream context might allow for CRLF injection in URIs (bsc#1233703).
• CVE-2024-8929: Leak partial content of the heap through heap buffer over-read (bsc#1233651).

This update for php8 fixes the following issues:

• CVE-2024-11233: buffer overread when processing input with the convert.quoted-printable-decode filter. (bsc#1233702)
• CVE-2024-11234: possible CRLF injection in URIs when a proxy is configured in a stream context. (bsc#1233703)
• CVE-2024-8929: data exposure on MySQL clients due to heap buffer overread in mysqlnd. (bsc#1233651)

It was discovered that PHP incorrectly handled certain inputs when processed with convert.quoted-printable decode filters. An attacker could possibly use this issue to expose sensitive information or cause a crash. (CVE-2024-11233)

It was discovered that PHP incorrectly handled certain HTTP requests. An attacker could possibly use this issue to performing arbitrary HTTP requests originating from the server, thus potentially gaining access to resources not normally available to the external user. (CVE-2024-11234)

It was discovered that PHP incorrectly handled certain inputs. An attacker could possibly use this issue to cause a crash or execute arbitrary code. (CVE-2024-11236, CVE-2024-8932)

It was discovered that PHP incorrectly handled certain MySQL requests. An attacker could possibly use this issue to cause the client to disclose the content of its heap containing data from other SQL requests and possible other data belonging to different users of the same server. (CVE-2024-8929)

USN-7157-1 fixed vulnerabilities in PHP versions 7.4, 8.1, and 8.3. This update provides the corresponding updates for PHP version 7.0.

Original advisory details:

It was discovered that PHP incorrectly handled certain inputs when processed with convert.quoted-printable decode filters. An attacker could possibly use this issue to expose sensitive information or cause a crash. (CVE-2024-11233)

It was discovered that PHP incorrectly handled certain HTTP requests. An attacker could possibly use this issue to performing arbitrary HTTP requests originating from the server, thus potentially gaining access to resources not normally available to the external user. (CVE-2024-11234)

It was discovered that PHP incorrectly handled certain inputs. An attacker could possibly use this issue to cause a crash or execute arbitrary code. (CVE-2024-8932)

It was discovered that PHP incorrectly handled certain MySQL requests. An attacker could possibly use this issue to cause the client to disclose the content of its heap containing data from other SQL requests and possible other data belonging to different users of the same server. (CVE-2024-8929)