USN-6305-3
php7.0 and php7.2 regression
USN-6305-2 fixed a vulnerability in PHP. The update caused a regression in Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. This update fix it.
Original advisory details:
It was discovered that PHP incorrectly handled certain XML files. An attacker could possibly use this issue to expose sensitive information. (CVE-2023-3823)
It was discovered that PHP incorrectly handled certain PHAR files. An attacker could possibly use this issue to cause a crash, expose sensitive information or execute arbitrary code. (CVE-2023-3824)
What each source reports
OSV No score
php7.0 and php7.2 regression
USN-6305-2 fixed a vulnerability in PHP. The update caused a regression in Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. This update fix it.
Original advisory details:
It was discovered that PHP incorrectly handled certain XML files. An attacker could possibly use this issue to expose sensitive information. (CVE-2023-3823)
It was discovered that PHP incorrectly handled certain PHAR files. An attacker could possibly use this issue to cause a crash, expose sensitive information or execute arbitrary code. (CVE-2023-3824)
- Record
USN-6305-3- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
php7.0Ubuntu:Pro:16.04:LTS |
before 7.0.33-0ubuntu0.16.04.16+esm10, plus listed versions 7.0.1-57.0.1-67.0.2-17.0.2-37.0.2-4 Show 44 moreShow less7.0.2-57.0.3-27.0.3-37.0.3-9ubuntu17.0.4-5ubuntu17.0.4-5ubuntu27.0.4-7ubuntu17.0.4-7ubuntu27.0.4-7ubuntu2.17.0.8-0ubuntu0.16.04.17.0.8-0ubuntu0.16.04.27.0.8-0ubuntu0.16.04.37.0.13-0ubuntu0.16.04.17.0.15-0ubuntu0.16.04.17.0.15-0ubuntu0.16.04.27.0.15-0ubuntu0.16.04.47.0.18-0ubuntu0.16.04.17.0.22-0ubuntu0.16.04.17.0.25-0ubuntu0.16.04.17.0.28-0ubuntu0.16.04.17.0.30-0ubuntu0.16.04.17.0.32-0ubuntu0.16.04.17.0.33-0ubuntu0.16.04.17.0.33-0ubuntu0.16.04.27.0.33-0ubuntu0.16.04.37.0.33-0ubuntu0.16.04.47.0.33-0ubuntu0.16.04.57.0.33-0ubuntu0.16.04.67.0.33-0ubuntu0.16.04.77.0.33-0ubuntu0.16.04.97.0.33-0ubuntu0.16.04.117.0.33-0ubuntu0.16.04.127.0.33-0ubuntu0.16.04.147.0.33-0ubuntu0.16.04.157.0.33-0ubuntu0.16.04.167.0.33-0ubuntu0.16.04.16+esm17.0.33-0ubuntu0.16.04.16+esm27.0.33-0ubuntu0.16.04.16+esm37.0.33-0ubuntu0.16.04.16+esm47.0.33-0ubuntu0.16.04.16+esm57.0.33-0ubuntu0.16.04.16+esm67.0.33-0ubuntu0.16.04.16+esm77.0.33-0ubuntu0.16.04.16+esm87.0.33-0ubuntu0.16.04.16+esm9 |
7.0.33-0ubuntu0.16.04.16+esm10 |
php7.2Ubuntu:Pro:18.04:LTS |
before 7.2.24-0ubuntu0.18.04.17+esm4, plus listed versions 7.2.1-1ubuntu27.2.2-1ubuntu17.2.2-1ubuntu27.2.3-1ubuntu17.2.5-0ubuntu0.18.04.1 Show 26 moreShow less7.2.7-0ubuntu0.18.04.17.2.7-0ubuntu0.18.04.27.2.10-0ubuntu0.18.04.17.2.15-0ubuntu0.18.04.17.2.15-0ubuntu0.18.04.27.2.17-0ubuntu0.18.04.17.2.19-0ubuntu0.18.04.17.2.19-0ubuntu0.18.04.27.2.24-0ubuntu0.18.04.17.2.24-0ubuntu0.18.04.27.2.24-0ubuntu0.18.04.37.2.24-0ubuntu0.18.04.47.2.24-0ubuntu0.18.04.67.2.24-0ubuntu0.18.04.77.2.24-0ubuntu0.18.04.87.2.24-0ubuntu0.18.04.97.2.24-0ubuntu0.18.04.107.2.24-0ubuntu0.18.04.117.2.24-0ubuntu0.18.04.127.2.24-0ubuntu0.18.04.137.2.24-0ubuntu0.18.04.157.2.24-0ubuntu0.18.04.167.2.24-0ubuntu0.18.04.177.2.24-0ubuntu0.18.04.17+esm17.2.24-0ubuntu0.18.04.17+esm27.2.24-0ubuntu0.18.04.17+esm3 |
7.2.24-0ubuntu0.18.04.17+esm4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
USN-6305-3 is a vulnerability with no CVSS score yet in php7.0, published July 3, 2024. No source lists public exploit code. Fixed in php7.0 7.0.33-0ubuntu0.16.04.16+esm10.