{"id":"CVE-2015-9253","aliases":["CLSA-2022-1646085834","EUVD-2015-9096","GHSA-p68x-q9g7-4cgg","SUSE-SU-2022:0577-1","SUSE-SU-2022:0679-1","SUSE-SU-2022:4067-1","UBUNTU-CVE-2015-9253","USN-3766-1","USN-4279-1","USN-5300-1"],"status":"published","title":"An issue was discovered in PHP 7.3.x before 7.3.0alpha3, 7.2.x before 7.2.8, and before 7.1.20....","description":"An issue was discovered in PHP 7.3.x before 7.3.0alpha3, 7.2.x before 7.2.8, and before 7.1.20. The php-fpm master process restarts a child process in an endless loop when using program execution functions (e.g., passthru, exec, shell_exec, or system) with a non-blocking STDIN stream, causing this master process to consume 100% of the CPU, and consume disk space with a large volume of error logs, as demonstrated by an attack by a customer of a shared-hosting facility.","severity":{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.04176,"percentile":0.90975,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400"],"published":"2018-02-19T00:00:00Z","modified":"2026-06-25T13:31:02Z","fixes":[{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"php5","fixed_in":["5.5.9+dfsg-1ubuntu4.29+esm10"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"php7.0","fixed_in":["7.0.33-0ubuntu0.16.04.16+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"php7.2","fixed_in":["7.2.10-0ubuntu0.18.04.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libapache2-mod-php7.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.33-0ubuntu0.16.04.17+tuxcare.els2"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libphp7.0-embed","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.33-0ubuntu0.16.04.17+tuxcare.els2"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"php7.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.33-0ubuntu0.16.04.17+tuxcare.els2"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"php7.0-bcmath","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.33-0ubuntu0.16.04.17+tuxcare.els2"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"php7.0-bz2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.33-0ubuntu0.16.04.17+tuxcare.els2"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"php7.0-cgi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.33-0ubuntu0.16.04.17+tuxcare.els2"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"php7.0-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.33-0ubuntu0.16.04.17+tuxcare.els2"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"php7.0-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.33-0ubuntu0.16.04.17+tuxcare.els2"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"php7.0-curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.33-0ubuntu0.16.04.17+tuxcare.els2"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"php7.0-dba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.33-0ubuntu0.16.04.17+tuxcare.els2"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"php7.0-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.33-0ubuntu0.16.04.17+tuxcare.els2"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"php7.0-enchant","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.33-0ubuntu0.16.04.17+tuxcare.els2"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"php7.0-fpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.33-0ubuntu0.16.04.17+tuxcare.els2"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"php7.0-gd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.33-0ubuntu0.16.04.17+tuxcare.els2"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"php7.0-gmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.33-0ubuntu0.16.04.17+tuxcare.els2"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"php7.0-imap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.33-0ubuntu0.16.04.17+tuxcare.els2"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"php7.0-interbase","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.33-0ubuntu0.16.04.17+tuxcare.els2"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"php7.0-intl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.33-0ubuntu0.16.04.17+tuxcare.els2"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"php7.0-json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.33-0ubuntu0.16.04.17+tuxcare.els2"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"php7.0-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.33-0ubuntu0.16.04.17+tuxcare.els2"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"php7.0-mbstring","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.33-0ubuntu0.16.04.17+tuxcare.els2"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"php7.0-mcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.33-0ubuntu0.16.04.17+tuxcare.els2"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"php7.0-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.33-0ubuntu0.16.04.17+tuxcare.els2"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"php7.0-odbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.33-0ubuntu0.16.04.17+tuxcare.els2"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"php7.0-opcache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.33-0ubuntu0.16.04.17+tuxcare.els2"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"php7.0-pgsql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.33-0ubuntu0.16.04.17+tuxcare.els2"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"php7.0-phpdbg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.33-0ubuntu0.16.04.17+tuxcare.els2"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"php7.0-pspell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.33-0ubuntu0.16.04.17+tuxcare.els2"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"php7.0-readline","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.33-0ubuntu0.16.04.17+tuxcare.els2"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"php7.0-recode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.33-0ubuntu0.16.04.17+tuxcare.els2"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"php7.0-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.33-0ubuntu0.16.04.17+tuxcare.els2"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"php7.0-soap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.33-0ubuntu0.16.04.17+tuxcare.els2"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"php7.0-sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.33-0ubuntu0.16.04.17+tuxcare.els2"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"php7.0-sybase","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.33-0ubuntu0.16.04.17+tuxcare.els2"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"php7.0-tidy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.33-0ubuntu0.16.04.17+tuxcare.els2"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"php7.0-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.33-0ubuntu0.16.04.17+tuxcare.els2"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"php7.0-xmlrpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.33-0ubuntu0.16.04.17+tuxcare.els2"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"php7.0-xsl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.33-0ubuntu0.16.04.17+tuxcare.els2"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"php7.0-zip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.33-0ubuntu0.16.04.17+tuxcare.els2"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"php72","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.5-1.75.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"php72","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.5-1.75.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.5-4.89.4"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.5-4.89.4"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.5-4.89.4"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.5-4.89.4"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.5-4.89.4"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.5-4.89.4"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.5-4.89.4"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.5-4.89.4"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.5-4.89.4"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.5-4.89.4"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.34-150000.4.103.1"}]}],"bundled":52},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.34-150000.4.103.1"}]}],"bundled":52},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.34-150000.4.103.1"}]}],"bundled":52},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.34-150000.4.103.1"}]}],"bundled":52},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.34-150000.4.103.1"}]}],"bundled":52},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.34-150000.4.103.1"}]}],"bundled":52},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.34-150000.4.103.1"}]}],"bundled":52},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.34-150000.4.103.1"}]}],"bundled":52},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.34-150000.4.103.1"}]}],"bundled":52},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.34-150000.4.103.1"}]}],"bundled":52},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.34-150000.4.103.1"}]}],"bundled":52},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"php5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.5.9+dfsg-1ubuntu4.29+esm10"}]}],"versions":["5.5.3+dfsg-1ubuntu2","5.5.3+dfsg-1ubuntu3","5.5.6+dfsg-1ubuntu1","5.5.6+dfsg-1ubuntu2","5.5.8+dfsg-2ubuntu1","5.5.9+dfsg-1ubuntu1","5.5.9+dfsg-1ubuntu2","5.5.9+dfsg-1ubuntu3","5.5.9+dfsg-1ubuntu4","5.5.9+dfsg-1ubuntu4.1","5.5.9+dfsg-1ubuntu4.2","5.5.9+dfsg-1ubuntu4.3","5.5.9+dfsg-1ubuntu4.4","5.5.9+dfsg-1ubuntu4.5","5.5.9+dfsg-1ubuntu4.6","5.5.9+dfsg-1ubuntu4.7","5.5.9+dfsg-1ubuntu4.9","5.5.9+dfsg-1ubuntu4.11","5.5.9+dfsg-1ubuntu4.12","5.5.9+dfsg-1ubuntu4.13","5.5.9+dfsg-1ubuntu4.14","5.5.9+dfsg-1ubuntu4.16","5.5.9+dfsg-1ubuntu4.17","5.5.9+dfsg-1ubuntu4.19","5.5.9+dfsg-1ubuntu4.20","5.5.9+dfsg-1ubuntu4.21","5.5.9+dfsg-1ubuntu4.22","5.5.9+dfsg-1ubuntu4.23","5.5.9+dfsg-1ubuntu4.24","5.5.9+dfsg-1ubuntu4.25","5.5.9+dfsg-1ubuntu4.26","5.5.9+dfsg-1ubuntu4.27","5.5.9+dfsg-1ubuntu4.29","5.5.9+dfsg-1ubuntu4.29+esm1","5.5.9+dfsg-1ubuntu4.29+esm2","5.5.9+dfsg-1ubuntu4.29+esm3","5.5.9+dfsg-1ubuntu4.29+esm4","5.5.9+dfsg-1ubuntu4.29+esm5","5.5.9+dfsg-1ubuntu4.29+esm6","5.5.9+dfsg-1ubuntu4.29+esm8"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"php7.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.33-0ubuntu0.16.04.16+esm3"}]}],"versions":["7.0.1-5","7.0.1-6","7.0.2-1","7.0.2-3","7.0.2-4","7.0.2-5","7.0.3-2","7.0.3-3","7.0.3-9ubuntu1","7.0.4-5ubuntu1","7.0.4-5ubuntu2","7.0.4-7ubuntu1","7.0.4-7ubuntu2","7.0.4-7ubuntu2.1","7.0.8-0ubuntu0.16.04.1","7.0.8-0ubuntu0.16.04.2","7.0.8-0ubuntu0.16.04.3","7.0.13-0ubuntu0.16.04.1","7.0.15-0ubuntu0.16.04.1","7.0.15-0ubuntu0.16.04.2","7.0.15-0ubuntu0.16.04.4","7.0.18-0ubuntu0.16.04.1","7.0.22-0ubuntu0.16.04.1","7.0.25-0ubuntu0.16.04.1","7.0.28-0ubuntu0.16.04.1","7.0.30-0ubuntu0.16.04.1","7.0.32-0ubuntu0.16.04.1","7.0.33-0ubuntu0.16.04.1","7.0.33-0ubuntu0.16.04.2","7.0.33-0ubuntu0.16.04.3","7.0.33-0ubuntu0.16.04.4","7.0.33-0ubuntu0.16.04.5","7.0.33-0ubuntu0.16.04.6","7.0.33-0ubuntu0.16.04.7","7.0.33-0ubuntu0.16.04.9","7.0.33-0ubuntu0.16.04.11","7.0.33-0ubuntu0.16.04.12","7.0.33-0ubuntu0.16.04.14","7.0.33-0ubuntu0.16.04.15","7.0.33-0ubuntu0.16.04.16","7.0.33-0ubuntu0.16.04.16+esm1","7.0.33-0ubuntu0.16.04.16+esm2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"php7.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.10-0ubuntu0.18.04.1"}]}],"versions":["7.2.1-1ubuntu2","7.2.2-1ubuntu1","7.2.2-1ubuntu2","7.2.3-1ubuntu1","7.2.5-0ubuntu0.18.04.1","7.2.7-0ubuntu0.18.04.1","7.2.7-0ubuntu0.18.04.2"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"php5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.5.9+dfsg-1ubuntu4.26"}]}],"versions":["5.5.3+dfsg-1ubuntu2","5.5.3+dfsg-1ubuntu3","5.5.6+dfsg-1ubuntu1","5.5.6+dfsg-1ubuntu2","5.5.8+dfsg-2ubuntu1","5.5.9+dfsg-1ubuntu1","5.5.9+dfsg-1ubuntu2","5.5.9+dfsg-1ubuntu3","5.5.9+dfsg-1ubuntu4","5.5.9+dfsg-1ubuntu4.1","5.5.9+dfsg-1ubuntu4.2","5.5.9+dfsg-1ubuntu4.3","5.5.9+dfsg-1ubuntu4.4","5.5.9+dfsg-1ubuntu4.5","5.5.9+dfsg-1ubuntu4.6","5.5.9+dfsg-1ubuntu4.7","5.5.9+dfsg-1ubuntu4.9","5.5.9+dfsg-1ubuntu4.11","5.5.9+dfsg-1ubuntu4.12","5.5.9+dfsg-1ubuntu4.13","5.5.9+dfsg-1ubuntu4.14","5.5.9+dfsg-1ubuntu4.16","5.5.9+dfsg-1ubuntu4.17","5.5.9+dfsg-1ubuntu4.19","5.5.9+dfsg-1ubuntu4.20","5.5.9+dfsg-1ubuntu4.21","5.5.9+dfsg-1ubuntu4.22","5.5.9+dfsg-1ubuntu4.23","5.5.9+dfsg-1ubuntu4.24","5.5.9+dfsg-1ubuntu4.25"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"php7.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.32-0ubuntu0.16.04.1"}]}],"versions":["7.0.1-5","7.0.1-6","7.0.2-1","7.0.2-3","7.0.2-4","7.0.2-5","7.0.3-2","7.0.3-3","7.0.3-9ubuntu1","7.0.4-5ubuntu1","7.0.4-5ubuntu2","7.0.4-7ubuntu1","7.0.4-7ubuntu2","7.0.4-7ubuntu2.1","7.0.8-0ubuntu0.16.04.1","7.0.8-0ubuntu0.16.04.2","7.0.8-0ubuntu0.16.04.3","7.0.13-0ubuntu0.16.04.1","7.0.15-0ubuntu0.16.04.1","7.0.15-0ubuntu0.16.04.2","7.0.15-0ubuntu0.16.04.4","7.0.18-0ubuntu0.16.04.1","7.0.22-0ubuntu0.16.04.1","7.0.25-0ubuntu0.16.04.1","7.0.28-0ubuntu0.16.04.1","7.0.30-0ubuntu0.16.04.1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"php7.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.10-0ubuntu0.18.04.1"}]}],"versions":["7.2.1-1ubuntu2","7.2.2-1ubuntu1","7.2.2-1ubuntu2","7.2.3-1ubuntu1","7.2.5-0ubuntu0.18.04.1","7.2.7-0ubuntu0.18.04.1","7.2.7-0ubuntu0.18.04.2"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"php5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.5.9+dfsg-1ubuntu4.29+esm10"}]}],"versions":["5.5.3+dfsg-1ubuntu2","5.5.3+dfsg-1ubuntu3","5.5.6+dfsg-1ubuntu1","5.5.6+dfsg-1ubuntu2","5.5.8+dfsg-2ubuntu1","5.5.9+dfsg-1ubuntu1","5.5.9+dfsg-1ubuntu2","5.5.9+dfsg-1ubuntu3","5.5.9+dfsg-1ubuntu4","5.5.9+dfsg-1ubuntu4.1","5.5.9+dfsg-1ubuntu4.2","5.5.9+dfsg-1ubuntu4.3","5.5.9+dfsg-1ubuntu4.4","5.5.9+dfsg-1ubuntu4.5","5.5.9+dfsg-1ubuntu4.6","5.5.9+dfsg-1ubuntu4.7","5.5.9+dfsg-1ubuntu4.9","5.5.9+dfsg-1ubuntu4.11","5.5.9+dfsg-1ubuntu4.12","5.5.9+dfsg-1ubuntu4.13","5.5.9+dfsg-1ubuntu4.14","5.5.9+dfsg-1ubuntu4.16","5.5.9+dfsg-1ubuntu4.17","5.5.9+dfsg-1ubuntu4.19","5.5.9+dfsg-1ubuntu4.20","5.5.9+dfsg-1ubuntu4.21","5.5.9+dfsg-1ubuntu4.22","5.5.9+dfsg-1ubuntu4.23","5.5.9+dfsg-1ubuntu4.24","5.5.9+dfsg-1ubuntu4.25","5.5.9+dfsg-1ubuntu4.26","5.5.9+dfsg-1ubuntu4.27","5.5.9+dfsg-1ubuntu4.29","5.5.9+dfsg-1ubuntu4.29+esm1","5.5.9+dfsg-1ubuntu4.29+esm2","5.5.9+dfsg-1ubuntu4.29+esm3","5.5.9+dfsg-1ubuntu4.29+esm4","5.5.9+dfsg-1ubuntu4.29+esm5","5.5.9+dfsg-1ubuntu4.29+esm6","5.5.9+dfsg-1ubuntu4.29+esm8"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"php7.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.33-0ubuntu0.16.04.11"}]}],"versions":["7.0.1-5","7.0.1-6","7.0.2-1","7.0.2-3","7.0.2-4","7.0.2-5","7.0.3-2","7.0.3-3","7.0.3-9ubuntu1","7.0.4-5ubuntu1","7.0.4-5ubuntu2","7.0.4-7ubuntu1","7.0.4-7ubuntu2","7.0.4-7ubuntu2.1","7.0.8-0ubuntu0.16.04.1","7.0.8-0ubuntu0.16.04.2","7.0.8-0ubuntu0.16.04.3","7.0.13-0ubuntu0.16.04.1","7.0.15-0ubuntu0.16.04.1","7.0.15-0ubuntu0.16.04.2","7.0.15-0ubuntu0.16.04.4","7.0.18-0ubuntu0.16.04.1","7.0.22-0ubuntu0.16.04.1","7.0.25-0ubuntu0.16.04.1","7.0.28-0ubuntu0.16.04.1","7.0.30-0ubuntu0.16.04.1","7.0.32-0ubuntu0.16.04.1","7.0.33-0ubuntu0.16.04.1","7.0.33-0ubuntu0.16.04.2","7.0.33-0ubuntu0.16.04.3","7.0.33-0ubuntu0.16.04.4","7.0.33-0ubuntu0.16.04.5","7.0.33-0ubuntu0.16.04.6","7.0.33-0ubuntu0.16.04.7","7.0.33-0ubuntu0.16.04.9"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"php7.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.24-0ubuntu0.18.04.3"}]}],"versions":["7.2.1-1ubuntu2","7.2.2-1ubuntu1","7.2.2-1ubuntu2","7.2.3-1ubuntu1","7.2.5-0ubuntu0.18.04.1","7.2.7-0ubuntu0.18.04.1","7.2.7-0ubuntu0.18.04.2","7.2.10-0ubuntu0.18.04.1","7.2.15-0ubuntu0.18.04.1","7.2.15-0ubuntu0.18.04.2","7.2.17-0ubuntu0.18.04.1","7.2.19-0ubuntu0.18.04.1","7.2.19-0ubuntu0.18.04.2","7.2.24-0ubuntu0.18.04.1","7.2.24-0ubuntu0.18.04.2"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"php7.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.33-0ubuntu0.16.04.16+esm3"}]}],"versions":["7.0.1-5","7.0.1-6","7.0.2-1","7.0.2-3","7.0.2-4","7.0.2-5","7.0.3-2","7.0.3-3","7.0.3-9ubuntu1","7.0.4-5ubuntu1","7.0.4-5ubuntu2","7.0.4-7ubuntu1","7.0.4-7ubuntu2","7.0.4-7ubuntu2.1","7.0.8-0ubuntu0.16.04.1","7.0.8-0ubuntu0.16.04.2","7.0.8-0ubuntu0.16.04.3","7.0.13-0ubuntu0.16.04.1","7.0.15-0ubuntu0.16.04.1","7.0.15-0ubuntu0.16.04.2","7.0.15-0ubuntu0.16.04.4","7.0.18-0ubuntu0.16.04.1","7.0.22-0ubuntu0.16.04.1","7.0.25-0ubuntu0.16.04.1","7.0.28-0ubuntu0.16.04.1","7.0.30-0ubuntu0.16.04.1","7.0.32-0ubuntu0.16.04.1","7.0.33-0ubuntu0.16.04.1","7.0.33-0ubuntu0.16.04.2","7.0.33-0ubuntu0.16.04.3","7.0.33-0ubuntu0.16.04.4","7.0.33-0ubuntu0.16.04.5","7.0.33-0ubuntu0.16.04.6","7.0.33-0ubuntu0.16.04.7","7.0.33-0ubuntu0.16.04.9","7.0.33-0ubuntu0.16.04.11","7.0.33-0ubuntu0.16.04.12","7.0.33-0ubuntu0.16.04.14","7.0.33-0ubuntu0.16.04.15","7.0.33-0ubuntu0.16.04.16","7.0.33-0ubuntu0.16.04.16+esm1","7.0.33-0ubuntu0.16.04.16+esm2"],"bundled":6}],"products":[{"vendor":"php","product":"php"}],"references":[{"url":"https://github.com/php/php-src/blob/PHP-7.1.20/NEWS#L20-L22","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory"]},{"url":"https://bugs.php.net/bug.php?id=70185","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Vendor Advisory"]},{"url":"https://bugs.php.net/bug.php?id=75968","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Vendor Advisory"]},{"url":"https://usn.ubuntu.com/3766-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory"]},{"url":"https://bugs.php.net/bug.php?id=73342https://github.com/php/php-src/pull/3287","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Issue Tracking","Vendor Advisory"]},{"url":"https://github.com/php/php-src/commit/69dee5c732fe982c82edb17d0dbc3e79a47748d8","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory"]},{"url":"https://www.futureweb.at/security/CVE-2015-9253/","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://usn.ubuntu.com/4279-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-9253"},{"url":"https://github.com/advisories/GHSA-p68x-q9g7-4cgg"},{"url":"https://errata.cloudlinux.com/ubuntu16_04/CLSA-2022-1646085834","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20220577-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1038980","tags":["report"]},{"url":"https://bugzilla.suse.com/1081790","tags":["report"]},{"url":"https://bugzilla.suse.com/1193041","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2015-9253","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-8923","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21707","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20220679-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1192050","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21703","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20224067-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1204577","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9120","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1000222","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12882","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-14851","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-17082","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19935","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20783","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11034","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11035","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11036","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11039","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11040","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11041","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11042","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11043","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11045","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11046","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11047","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11048","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11050","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9020","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9021","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9022","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9023","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9024","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9637","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9638","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9640","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9641","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9675","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-7059","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-7060","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-7062","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-7063","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-7064","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-7066","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-7068","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-7069","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-7070","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-7071","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21702","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21704","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21705","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-31625","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-31626","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-31628","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-31629","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-37454","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2015-9253","tags":["report"]},{"url":"https://www.futureweb.at/Futureweb-OG-php-fpm-master-process-restarts-child-process-in-a_pid,54177,type,firmeninfo.html","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3766-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-4279-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-4279-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-5300-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-9253","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-14851","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-14883","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-7059","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-7060","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-8923","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-9118","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-9119","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-9120","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-21707","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2015-9253","description":"An issue was discovered in PHP 7.3.x before 7.3.0alpha3, 7.2.x before 7.2.8, and before 7.1.20. The php-fpm master process restarts a child process in an endless loop when using program execution functions (e.g., passthru, exec, shell_exec, or system) with a non-blocking STDIN stream, causing this master process to consume 100% of the CPU, and consume disk space with a large volume of error logs, as demonstrated by an attack by a customer of a shared-hosting facility.","status":"published","published":"2018-02-19T19:00:00Z","modified":"2024-08-06T08:43:42.253Z","updated_at":"2026-11-02T14:35:40.591596Z"}],"euvd":[{"id":"EUVD-2015-9096","description":"An issue was discovered in PHP 7.3.x before 7.3.0alpha3, 7.2.x before 7.2.8, and before 7.1.20. The php-fpm master process restarts a child process in an endless loop when using program execution functions (e.g., passthru, exec, shell_exec, or system) with a non-blocking STDIN stream, causing this master process to consume 100% of the CPU, and consume disk space with a large volume of error logs, as demonstrated by an attack by a customer of a shared-hosting facility.","status":"published","published":"2018-02-19T19:00:00Z","modified":"2024-08-06T08:43:42Z","updated_at":"2026-11-03T01:57:24.81699Z"}],"ghsa":[{"id":"GHSA-p68x-q9g7-4cgg","title":"An issue was discovered in PHP 7.3.x before 7.3.0alpha3, 7.2.x before 7.2.8, and before 7.1.20....","description":"An issue was discovered in PHP 7.3.x before 7.3.0alpha3, 7.2.x before 7.2.8, and before 7.1.20. The php-fpm master process restarts a child process in an endless loop when using program execution functions (e.g., passthru, exec, shell_exec, or system) with a non-blocking STDIN stream, causing this master process to consume 100% of the CPU, and consume disk space with a large volume of error logs, as demonstrated by an attack by a customer of a shared-hosting facility.","status":"published","published":"2022-05-13T01:28:18Z","modified":"2023-02-01T05:07:59Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:50:39.462624Z"}],"nvd":[{"id":"CVE-2015-9253","description":"An issue was discovered in PHP 7.3.x before 7.3.0alpha3, 7.2.x before 7.2.8, and before 7.1.20. The php-fpm master process restarts a child process in an endless loop when using program execution functions (e.g., passthru, exec, shell_exec, or system) with a non-blocking STDIN stream, causing this master process to consume 100% of the CPU, and consume disk space with a large volume of error logs, as demonstrated by an attack by a customer of a shared-hosting facility.","status":"published","published":"2018-02-19T19:29:00.483Z","modified":"2026-06-17T00:36:08.78Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:L/Au:S/C:N/I:N/A:C","level":"medium","assessor":"primary"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:03:19.244941Z"}],"osv":[{"id":"UBUNTU-CVE-2015-9253","description":"An issue was discovered in PHP 7.3.x before 7.3.0alpha3, 7.2.x before 7.2.8, and before 7.1.20. The php-fpm master process restarts a child process in an endless loop when using program execution functions (e.g., passthru, exec, shell_exec, or system) with a non-blocking STDIN stream, causing this master process to consume 100% of the CPU, and consume disk space with a large volume of error logs, as demonstrated by an attack by a customer of a shared-hosting facility.","status":"published","published":"2018-02-19T00:00:00Z","modified":"2026-04-22T10:24:57.330147Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:54:11.100633Z"},{"id":"CLSA-2022-1646085834","title":"Fix CVE(s): CVE-2017-9118, CVE-2017-9119, CVE-2017-9120, CVE-2021-21707, CVE-2017-8923, CVE-2015-9253","description":"\n   * SECURITY UPDATE: Denial of service\n     - debian/patches/CVE-2015-9253-pre1.patch: include .inc files\n       used in fpm tests in sapi/fpm/tests/ alogin with other .phpt\n       test scripts.\n     - debian/patches/CVE-2015-9253-pre2.patch: close the listening\n       socket on sapi/fpm/fpm/fpm_signals.c and added tests in\n       sapi/fpm/tests/bug77934-reload-process-control.phpt.\n     - debian/patches/CVE-2015-9253.patch: directly listen\n       on socket, instead of dumping it to STDIN in\n       sapi/fpm/fpm/fpm_children.c, sapi/fpm/fpm_stdio.c,\n       and added tests in sapi/fpm/tests/bug73342-nonblocking-stdio.phpt.\n     - CVE-2015-9253\n   * SECURITY UPDATE: Integer overflow\n     - debian/patches/CVE-2017-8923-pre.patch: added ZSTR_MAX_LEN\n       macro in Zend/zend_string.h and make use of it in\n       Zend/zend_operators.c instead of using SIZE_MAX.\n     - debian/patches/CVE-2017-8923.patch: added a length check before\n       calling zend_string_realloc method in Zend/zend_vm_def.h and\n       Zend/zend_vm_execute.h.\n     - CVE-2017-8923\n   * SECURITY UPDATE: Integer overflow\n     - debian/patches/CVE-2017-9118.patch: added ZSTR_MAX_OVERHEAD\n       macro in Zend/zend_string.h that has the the maximal overhead\n       of a zend_string and uses it in ext/pcre/php_pcre.c to assign\n       a zend_string length value.\n     - CVE-2017-9118\n   * SECURITY UPDATE: Use after free\n     - debian/patches/CVE-2017-9119.patch: changed the decrement of\n       refcount to be made once the string allocation has succeeded in\n       Zend/zend_string.h.\n     - CVE-2017-9119\n   * SECURITY UPDATE: Integer overflow\n     - debian/patches/CVE-2017-9120.patch: changed the string allocation\n       from zend_string_alloc to zend_string_safe_alloc in\n       ext/mysqli/mysqli_api.c.\n     - CVE-2017-9120\n   * SECURITY UDPATE: Improper handling of special characters\n     - debian/patches/CVE-2021-21707.patch: added a string validation\n       to check for improper characters in ext/dom/domimplementation.c\n       and in ext/libxml/libxml.c and added tests in\n       ext/simplexml/tests/bug79971_1.phpt and\n       ext/dom/tests/bug79971_2.phpt.\n     - CVE-2021-21707","status":"published","published":"2022-02-28T22:03:54Z","modified":"2026-06-04T10:04:26.496726214Z","updated_at":"2026-11-02T15:43:39.801198Z"},{"id":"SUSE-SU-2022:0577-1","title":"Security update for php72","description":"This update for php72 fixes the following issues:\n\n- CVE-2015-9253: Fixed endless loop when the master process restarts a child process using program execution functions (bsc#1081790).\n- CVE-2017-8923: Fixed denial of service (application crash) when using .= with a long string (zend_string_extend func in Zend/zend_string.h) (bsc#1038980).\n- CVE-2021-21707: Fixed special character handling that broke path in xml parsing (bsc#1193041).\n","status":"published","published":"2022-02-25T19:14:07Z","modified":"2026-02-04T03:19:40.32654Z","updated_at":"2026-11-02T15:53:50.066806Z"},{"id":"SUSE-SU-2022:0679-1","title":"Security update for php7","description":"This update for php7 fixes the following issues:\n\n- CVE-2021-21703: Fixed local privilege escalation via PHP-FPM (bsc#1192050).\n- CVE-2021-21707: Fixed special character breaks path in xml parsing (bsc#1193041).\n- CVE-2017-8923: Fixed denial of service (application crash) when using .= with a long string (zend_string_extend func in Zend/zend_string.h) (bsc#1038980).\n- CVE-2015-9253: Fixed endless loop when the master process restarts a child process using program execution functions (bsc#1081790).\n","status":"published","published":"2022-03-02T18:08:46Z","modified":"2026-02-04T04:20:08.116209Z","updated_at":"2026-11-02T15:53:50.066806Z"},{"id":"SUSE-SU-2022:4067-1","title":"Security update for php7","description":"This update for php7 fixes the following issues:\n\n- Version update to 7.2.34 [jsc#SLE-23639]\n\n- CVE-2022-37454: Fixed SHA-3 buffer overflow (bsc#1204577).\n- Fix integer overflow in PHP_SHA3##bits (bsc#1204577#c26).\n","status":"published","published":"2022-11-18T10:54:18Z","modified":"2026-02-04T04:35:00.387377Z","updated_at":"2026-11-02T15:53:51.440565Z"},{"id":"USN-3766-1","title":"php5, php7.0, php7.2 vulnerabilities","description":"It was discovered that PHP incorrectly handled restarting certain child\nprocesses when php-fpm is used. A remote attacker could possibly use this\nissue to cause a denial of service. This issue was only addressed in Ubuntu\n18.04 LTS. (CVE-2015-9253)\n\nIt was discovered that PHP incorrectly handled certain exif tags in JPEG\nimages. A remote attacker could possibly use this issue to cause PHP to\ncrash, resulting in a denial of service. (CVE-2018-14851, CVE-2018-14883)\n","status":"published","published":"2018-09-18T07:22:11Z","modified":"2026-04-22T09:48:37.800625Z","updated_at":"2026-11-02T16:58:14.019824Z"},{"id":"USN-4279-1","title":"php5, php7.0, php7.2, php7.3 vulnerabilities","description":"It was discovered that PHP incorrectly handled certain scripts.\nAn attacker could possibly use this issue to cause a denial of service.\nThis issue only affected Ubuntu 12.04 ESM, Ubuntu 14.04 ESM and Ubuntu 16.04 LTS.\n(CVE-2015-9253)\n\nIt was discovered that PHP incorrectly handled certain inputs. An attacker\ncould possibly use this issue to expose sensitive information.\n(CVE-2020-7059)\n\nIt was discovered that PHP incorrectly handled certain inputs.\nAn attacker could possibly use this issue to execute arbitrary code.\nThis issue only affected Ubuntu 14.04 ESM, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS\nand Ubuntu 19.10. (CVE-2020-7060)\n","status":"published","published":"2020-02-17T18:13:43Z","modified":"2026-04-22T10:03:37.443568Z","updated_at":"2026-11-02T16:58:14.547547Z"},{"id":"USN-5300-1","title":"php7.0 vulnerabilities","description":"It was discovered that PHP incorrectly handled certain scripts.\nAn attacker could possibly use this issue to cause a denial of service.\n(CVE-2015-9253, CVE-2017-8923, CVE-2017-9118, CVE-2017-9120)\n\nIt was discovered that PHP incorrectly handled certain inputs.\nAn attacker could possibly use this issue to cause a denial of service,\nor possibly obtain sensitive information. (CVE-2017-9119)\n\nIt was discovered that PHP incorrectly handled certain scripts with XML\nparsing functions.\nAn attacker could possibly use this issue to obtain sensitive information.\n(CVE-2021-21707)\n","status":"published","published":"2022-02-22T20:26:05Z","modified":"2026-06-25T13:31:02.106320708Z","updated_at":"2026-11-02T16:58:15.683829Z"}]}}