CVE-2021-21707

In PHP versions 7.3.x below 7.3.33, 7.4.x below 7.4.26 and 8.0.x below 8.0.13, certain XML parsing functions, like simplexml_load_file(), URL-decode the filename passed to them. If that filename contains URL-encoded NUL character, this may cause the function to interpret this as the end of the filename, thus interpreting the filename differently from what the user intended, which may lead it to reading a different file than intended.

In PHP versions 7.3.x below 7.3.33, 7.4.x below 7.4.26 and 8.0.x below 8.0.13, certain XML parsing functions, like simplexml_load_file(), URL-decode the filename passed to them. If that filename contains URL-encoded NUL character, this may cause the function to interpret this as the end of the filename, thus interpreting the filename differently from what the user intended, which may lead it to reading a different file than intended.

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts. The php package contains the module (often referred to as mod_php) which adds support for the PHP language to Apache HTTP Server.

Security Fix(es):

In PHP versions 7.3.x below 7.3.33, 7.4.x below 7.4.26 and 8.0.x below 8.0.13, certain XML parsing functions, like simplexml_load_file(), URL-decode the filename passed to them. If that filename contains URL-encoded NUL character, this may cause the function to interpret this as the end of the filename, thus interpreting the filename differently from what the user intended, which may lead it to reading a different file than intended.(CVE-2021-21707)

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

The following packages have been upgraded to a later upstream version: php (7.4.30), php-pear (1.10.13). (BZ#2055422)

Security Fix(es):

• php: Special character breaks path in xml parsing (CVE-2021-21707)

• php: Use after free due to php_filter_float() failing for ints (CVE-2021-21708)

• php-pear: Directory traversal vulnerability (CVE-2021-32610)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.7 Release Notes linked from the References section.

In PHP versions 7.3.x below 7.3.33, 7.4.x below 7.4.26 and 8.0.x below 8.0.13, certain XML parsing functions, like simplexml_load_file(), URL-decode the filename passed to them. If that filename contains URL-encoded NUL character, this may cause the function to interpret this as the end of the filename, thus interpreting the filename differently from what the user intended, which may lead it to reading a different file than intended.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

The following packages have been upgraded to a later upstream version: php (7.4.30), php-pear (1.10.13). (BZ#2055422)

Security Fix(es):

• php: Special character breaks path in xml parsing (CVE-2021-21707)
• php: Use after free due to php_filter_float() failing for ints (CVE-2021-21708)
• php-pear: Directory traversal vulnerability (CVE-2021-32610)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

In PHP versions 7.3.x below 7.3.33, 7.4.x below 7.4.26 and 8.0.x below 8.0.13, certain XML parsing functions, like simplexml_load_file(), URL-decode the filename passed to them. If that filename contains URL-encoded NUL character, this may cause the function to interpret this as the end of the filename, thus interpreting the filename differently from what the user intended, which may lead it to reading a different file than intended.

In PHP versions 7.3.x below 7.3.33, 7.4.x below 7.4.26 and 8.0.x below 8.0.13, certain XML parsing functions, like simplexml_load_file(), URL-decode the filename passed to them. If that filename contains URL-encoded NUL character, this may cause the function to interpret this as the end of the filename, thus interpreting the filename differently from what the user intended, which may lead it to reading a different file than intended.

In PHP versions 7.3.x below 7.3.33, 7.4.x below 7.4.26 and 8.0.x below 8.0.13, certain XML parsing functions, like simplexml_load_file(), URL-decode the filename passed to them. If that filename contains URL-encoded NUL character, this may cause the function to interpret this as the end of the filename, thus interpreting the filename differently from what the user intended, which may lead it to reading a different file than intended.

• SECURITY UPDATE: Denial of service
  • debian/patches/CVE-2015-9253-pre1.patch: include .inc files used in fpm tests in sapi/fpm/tests/ alogin with other .phpt test scripts.
  • debian/patches/CVE-2015-9253-pre2.patch: close the listening socket on sapi/fpm/fpm/fpm_signals.c and added tests in sapi/fpm/tests/bug77934-reload-process-control.phpt.
  • debian/patches/CVE-2015-9253.patch: directly listen on socket, instead of dumping it to STDIN in sapi/fpm/fpm/fpm_children.c, sapi/fpm/fpm_stdio.c, and added tests in sapi/fpm/tests/bug73342-nonblocking-stdio.phpt.
  • CVE-2015-9253
• SECURITY UPDATE: Integer overflow
  • debian/patches/CVE-2017-8923-pre.patch: added ZSTR_MAX_LEN macro in Zend/zend_string.h and make use of it in Zend/zend_operators.c instead of using SIZE_MAX.
  • debian/patches/CVE-2017-8923.patch: added a length check before calling zend_string_realloc method in Zend/zend_vm_def.h and Zend/zend_vm_execute.h.
  • CVE-2017-8923
• SECURITY UPDATE: Integer overflow
  • debian/patches/CVE-2017-9118.patch: added ZSTR_MAX_OVERHEAD macro in Zend/zend_string.h that has the the maximal overhead of a zend_string and uses it in ext/pcre/php_pcre.c to assign a zend_string length value.
  • CVE-2017-9118
• SECURITY UPDATE: Use after free
  • debian/patches/CVE-2017-9119.patch: changed the decrement of refcount to be made once the string allocation has succeeded in Zend/zend_string.h.
  • CVE-2017-9119
• SECURITY UPDATE: Integer overflow
  • debian/patches/CVE-2017-9120.patch: changed the string allocation from zend_string_alloc to zend_string_safe_alloc in ext/mysqli/mysqli_api.c.
  • CVE-2017-9120
• SECURITY UDPATE: Improper handling of special characters
  • debian/patches/CVE-2021-21707.patch: added a string validation to check for improper characters in ext/dom/domimplementation.c and in ext/libxml/libxml.c and added tests in ext/simplexml/tests/bug79971_1.phpt and ext/dom/tests/bug79971_2.phpt.
  • CVE-2021-21707

• CVE-2022-37454: Fix buffer overflow in the Keccak XKCP SHA-3 reference implementation
• CVE-2022-31630: Fix OOB read due to insufficient input validation in imageloadfont()
• CVE-2021-21707: Fix improper handlig of special character which breaks path in xml parsing

• CVE-2022-37454: Fix buffer overflow in the Keccak XKCP SHA-3 reference implementation
• CVE-2022-31630: Fix OOB read due to insufficient input validation in imageloadfont()
• CVE-2021-21707: Fix improper handlig of special character which breaks path in xml parsing

• CVE-2021-21707: fix NUL byte truncation in XML/DOM URI file loading
• CVE-2022-31628: fix phar wrapper denial of service when loading compressed quine archives
• CVE-2022-31629: discard HTTP variables that mangle into __Host- or __Secure- prefixes

• CVE-2021-21707: fix NUL byte truncation in XML/DOM URI file loading
• CVE-2022-31628: fix phar wrapper denial of service when loading compressed quine archives
• CVE-2022-31629: discard HTTP variables that mangle into __Host- or __Secure- prefixes

Header injection via default_mimetype / default_charset mbstring may use pointer from some previous request Unexpected behavior with arrays and JIT Special character is breaking the path in xml function (CVE-2021-21707) XMLReader::getParserProperty may throw with a valid property

This update for php7 fixes the following issues:

• CVE-2021-21703: Fixed local privilege escalation via PHP-FPM (bsc#1192050).

• CVE-2021-21707: Fixed special character breaks path in xml parsing (bsc#1193041).

• Added patch to prevent memory access violation in php7 when running test suite (bsc#1175508)

This update was imported from the SUSE:SLE-15-SP2:Update update project.

This update for php7 fixes the following issues:

• CVE-2021-21703: Fixed local privilege escalation via PHP-FPM (bsc#1192050).

• CVE-2021-21707: Fixed special character breaks path in xml parsing (bsc#1193041).

• Added patch to prevent memory access violation in php7 when running test suite (bsc#1175508)

These are all security issues fixed in the php8-8.0.13-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the php7-7.4.26-1.1 package on the GA media of openSUSE Tumbleweed.

This update for php74 fixes the following issues:

• CVE-2021-21707: Fixed special character breaks path in xml parsing (bsc#1193041).

This update for php7 fixes the following issues:

• CVE-2021-21703: Fixed local privilege escalation via PHP-FPM (bsc#1192050).

• CVE-2021-21707: Fixed special character breaks path in xml parsing (bsc#1193041).

• Added patch to prevent memory access violation in php7 when running test suite (bsc#1175508)

This update for php72 fixes the following issues:

• CVE-2015-9253: Fixed endless loop when the master process restarts a child process using program execution functions (bsc#1081790).
• CVE-2017-8923: Fixed denial of service (application crash) when using .= with a long string (zend_string_extend func in Zend/zend_string.h) (bsc#1038980).
• CVE-2021-21707: Fixed special character handling that broke path in xml parsing (bsc#1193041).

This update for php7 fixes the following issues:

• CVE-2021-21703: Fixed local privilege escalation via PHP-FPM (bsc#1192050).
• CVE-2021-21707: Fixed special character breaks path in xml parsing (bsc#1193041).
• CVE-2017-8923: Fixed denial of service (application crash) when using .= with a long string (zend_string_extend func in Zend/zend_string.h) (bsc#1038980).
• CVE-2015-9253: Fixed endless loop when the master process restarts a child process using program execution functions (bsc#1081790).

This update for php7 fixes the following issues:

• CVE-2021-21707: Fixed a special character breaks path in xml parsing. (bsc#1193041)
• CVE-2022-31625: Fixed uninitialized pointers free in Postgres extension. (bsc#1200645)
• CVE-2022-31626: Fixed buffer overflow via user-supplied password when using pdo_mysql extension with mysqlnd driver. (bsc#1200628)

This update for php8 fixes the following issues:

• CVE-2021-21707: Fixed a special character that breaks path in xml parsing. (bsc#1193041)
• CVE-2022-31625: Fixed uninitialized pointers free in Postgres extension. (bsc#1200645)
• CVE-2022-31626: Fixed buffer overflow via user-supplied password when using pdo_mysql extension with mysqlnd driver. (bsc#1200628)

This update for php7 fixes the following issues:

• Version update to 7.4.33:

• CVE-2022-31630: Fixed out-of-bounds read due to insufficient input validation in imageloadfont() (bsc#1204979).

• CVE-2022-37454: Fixed buffer overflow in hash_update() on long parameter (bsc#1204577).

• Version update to 7.4.32 (jsc#SLE-23639)

• CVE-2022-31628: Fixed an uncontrolled recursion in the phar uncompressor while decompressing 'quines' gzip files. (bsc#1203867)

• CVE-2022-31629: Fixed a bug which could lead an attacker to set an insecure cookie that will treated as secure in the victim's browser. (bsc#1203870)

This update for php7 fixes the following issues:

• Version update to 7.2.34 [jsc#SLE-23639]

• CVE-2022-37454: Fixed SHA-3 buffer overflow (bsc#1204577).

• Fix integer overflow in PHP_SHA3##bits (bsc#1204577#c26).

This update for php74 fixes the following issues:

• Version update to 7.4.33:

• CVE-2022-31630: Fixed out-of-bounds read due to insufficient input validation in imageloadfont() (bsc#1204979).

• CVE-2022-37454: Fixed buffer overflow in hash_update() on long parameter (bsc#1204577).

• Version update to 7.4.32 (jsc#SLE-23639)

• CVE-2022-31628: Fixed an uncontrolled recursion in the phar uncompressor while decompressing 'quines' gzip files. (bsc#1203867)

• CVE-2022-31629: Fixed a bug which could lead an attacker to set an insecure cookie that will treated as secure in the victim's browser. (bsc#1203870)

This update for php7 fixes the following issues:

• Version update to 7.4.33:

• CVE-2022-31630: Fixed out-of-bounds read due to insufficient input validation in imageloadfont() (bsc#1204979).

• CVE-2022-37454: Fixed buffer overflow in hash_update() on long parameter (bsc#1204577).

• Version update to 7.4.32 (jsc#SLE-23639)

• CVE-2022-31628: Fixed an uncontrolled recursion in the phar uncompressor while decompressing 'quines' gzip files. (bsc#1203867)

• CVE-2022-31629: Fixed a bug which could lead an attacker to set an insecure cookie that will treated as secure in the victim's browser. (bsc#1203870)

It was discovered that PHP incorrectly handled certain scripts. An attacker could possibly use this issue to cause a denial of service. (CVE-2015-9253, CVE-2017-8923, CVE-2017-9118, CVE-2017-9120)

It was discovered that PHP incorrectly handled certain inputs. An attacker could possibly use this issue to cause a denial of service, or possibly obtain sensitive information. (CVE-2017-9119)

It was discovered that PHP incorrectly handled certain scripts with XML parsing functions. An attacker could possibly use this issue to obtain sensitive information. (CVE-2021-21707)

USN-5300-1 fixed vulnerabilities in PHP. This update provides the corresponding updates for Ubuntu 18.04 LTS and Ubuntu 20.04 LTS.

Original advisory details:

It was discovered that PHP incorrectly handled certain scripts. An attacker could possibly use this issue to cause a denial of service. (CVE-2015-9253, CVE-2017-8923, CVE-2017-9118, CVE-2017-9120)

It was discovered that PHP incorrectly handled certain inputs. An attacker could possibly use this issue to cause a denial of service, or possibly obtain sensitive information. (CVE-2017-9119)

It was discovered that PHP incorrectly handled certain scripts with XML parsing functions. An attacker could possibly use this issue to obtain sensitive information. (CVE-2021-21707)