{"id":"CVE-2020-7070","aliases":["ALPINE-CVE-2020-7070","ALSA-2021:4213","BELL-CVE-2020-7070","BIT-libphp-2020-7070","BIT-php-2020-7070","BIT-php-min-2020-7070","CLSA-2020-1605798462","CLSA-2022-1643747494","DEBIAN-CVE-2020-7070","DLA-2397-1","DSA-4856-1","EUVD-2020-28204","GHSA-j7r5-hm2w-qqf9","MGASA-2020-0387","OESA-2021-1056","OESA-2021-1065","RHSA-2021:2992","RHSA-2021:4213","RLSA-2021:4213","SUSE-SU-2020:14516-1","SUSE-SU-2020:2894-1","SUSE-SU-2020:2896-1","SUSE-SU-2020:2920-1","SUSE-SU-2020:2941-1","SUSE-SU-2020:2943-1","SUSE-SU-2020:2997-1","SUSE-SU-2022:4067-1","SUSE-SU-2022:4068-1","SUSE-SU-2022:4069-1","UBUNTU-CVE-2020-7070","USN-4583-1","openSUSE-SU-2020:1703-1","openSUSE-SU-2020:1767-1"],"status":"published","title":"PHP parses encoded cookie names so malicious `__Host-` cookies can be sent","description":"In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when PHP is processing incoming HTTP cookie values, the cookie names are url-decoded. This may lead to cookies with prefixes like __Host confused with cookies that decode to such prefix, thus leading to an attacker being able to forge cookie which is supposed to be secure. See also CVE-2020-8184 for more information.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.05029,"percentile":0.92333,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20","CWE-565"],"published":"2020-10-02T14:14:45Z","modified":"2026-11-03T06:32:26Z","fixes":[{"ecosystem":"Alpine:v3.12","package":"php7","fixed_in":["7.3.23-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"php7","fixed_in":["7.4.11-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"php7","fixed_in":["7.4.11-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"php7","fixed_in":["7.4.11-r0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"libphp","fixed_in":["7.2.34","7.3.23","7.4.11"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"php","fixed_in":["7.2.34","7.3.23","7.4.11"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"php-min","fixed_in":["7.2.34","7.3.23","7.4.11"],"sources":["osv"]},{"ecosystem":"Debian:11","package":"php7.4","fixed_in":["7.4.11-1"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"php7.0","fixed_in":["7.0.33-0+deb9u10"],"sources":["osv"]},{"ecosystem":"Mageia:7","package":"php","fixed_in":["7.3.23-1.mga7"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"php53","fixed_in":["5.3.17-112.93.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"php53","fixed_in":["5.3.17-112.93.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"php5","fixed_in":["5.5.14-109.82.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"php7","fixed_in":["7.0.7-50.102.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"php7","fixed_in":["7.0.7-50.102.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"php5","fixed_in":["5.5.9+dfsg-1ubuntu4.29+esm13"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"php7.0","fixed_in":["7.0.33-0ubuntu0.16.04.16"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"php7.2","fixed_in":["7.2.24-0ubuntu0.18.04.7"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"php7.4","fixed_in":["7.4.3-4ubuntu2.4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.12","package":"php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.3.23-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.11-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.11-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.11-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"apcu-panel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.18-1.module_el8.6.0+2750+78feabcb"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-1.module_el8.6.0+2750+78feabcb"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libzip-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-1.module_el8.6.0+2750+78feabcb"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libzip-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-1.module_el8.6.0+2750+78feabcb"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"php","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.19-3.module_el8.6.0+2976+8b9a0d08"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"php-bcmath","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.19-3.module_el8.6.0+2976+8b9a0d08"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"php-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.19-3.module_el8.6.0+2976+8b9a0d08"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"php-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.19-3.module_el8.6.0+2976+8b9a0d08"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"php-dba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.19-3.module_el8.6.0+2976+8b9a0d08"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"php-dbg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.19-3.module_el8.6.0+2976+8b9a0d08"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"php-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.19-3.module_el8.6.0+2976+8b9a0d08"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"php-embedded","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.19-3.module_el8.6.0+2976+8b9a0d08"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"php-enchant","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.19-3.module_el8.6.0+2976+8b9a0d08"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"php-ffi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.19-3.module_el8.6.0+2976+8b9a0d08"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"php-fpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.19-3.module_el8.6.0+2976+8b9a0d08"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"php-gd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.19-3.module_el8.6.0+2976+8b9a0d08"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"php-gmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.19-3.module_el8.6.0+2976+8b9a0d08"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"php-intl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.19-3.module_el8.6.0+2976+8b9a0d08"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"php-json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.19-3.module_el8.6.0+2976+8b9a0d08"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"php-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.19-3.module_el8.6.0+2976+8b9a0d08"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"php-mbstring","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.19-3.module_el8.6.0+2976+8b9a0d08"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"php-mysqlnd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.19-3.module_el8.6.0+2976+8b9a0d08"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"php-odbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.19-3.module_el8.6.0+2976+8b9a0d08"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"php-opcache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.19-3.module_el8.6.0+2976+8b9a0d08"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"php-pdo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.19-3.module_el8.6.0+2976+8b9a0d08"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"php-pear","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.10.12-1.module_el8.6.0+2750+78feabcb"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"php-pecl-apcu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.18-1.module_el8.6.0+2750+78feabcb"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"php-pecl-apcu-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.18-1.module_el8.6.0+2750+78feabcb"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"php-pecl-rrd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.1-1.module_el8.6.0+2750+78feabcb"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"php-pecl-rrd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.1-1.module_el8.4.0+2229+b272fdef"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"php-pecl-rrd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.1-1.module_el8.3.0+2009+b272fdef"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"php-pecl-xdebug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.5-1.module_el8.6.0+2750+78feabcb"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"php-pecl-zip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.2-1.module_el8.6.0+2750+78feabcb"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"php-pgsql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.19-3.module_el8.6.0+2976+8b9a0d08"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"php-process","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.19-3.module_el8.6.0+2976+8b9a0d08"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"php-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.19-3.module_el8.6.0+2976+8b9a0d08"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"php-soap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.19-3.module_el8.6.0+2976+8b9a0d08"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"php-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.19-3.module_el8.6.0+2976+8b9a0d08"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"php-xmlrpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.19-3.module_el8.6.0+2976+8b9a0d08"}]}],"bundled":5},{"source":"osv","ecosystem":"Bitnami","package":"libphp","ranges":[{"type":"SEMVER","events":[{"introduced":"7.2.0"},{"fixed":"7.2.34"},{"introduced":"7.3.0"},{"fixed":"7.3.23"},{"introduced":"7.4.0"},{"fixed":"7.4.11"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"php","ranges":[{"type":"SEMVER","events":[{"introduced":"7.2.0"},{"fixed":"7.2.34"},{"introduced":"7.3.0"},{"fixed":"7.3.23"},{"introduced":"7.4.0"},{"fixed":"7.4.11"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"php-min","ranges":[{"type":"SEMVER","events":[{"introduced":"7.2.0"},{"fixed":"7.2.34"},{"introduced":"7.3.0"},{"fixed":"7.3.23"},{"introduced":"7.4.0"},{"fixed":"7.4.11"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"php","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.3-51.el6.cloudlinux"}]}],"bundled":70},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"php-bcmath","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.3-51.el6.cloudlinux"}]}],"bundled":70},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"php-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.3-51.el6.cloudlinux"}]}],"bundled":70},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"php-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.3-51.el6.cloudlinux"}]}],"bundled":70},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"php-dba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.3-51.el6.cloudlinux"}]}],"bundled":70},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"php-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.3-51.el6.cloudlinux"}]}],"bundled":70},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"php-embedded","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.3-51.el6.cloudlinux"}]}],"bundled":70},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"php-enchant","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.3-51.el6.cloudlinux"}]}],"bundled":70},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"php-fpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.3-51.el6.cloudlinux"}]}],"bundled":70},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"php-gd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.3-51.el6.cloudlinux"}]}],"bundled":70},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"php-imap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.3-51.el6.cloudlinux"}]}],"bundled":70},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"php-intl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.3-51.el6.cloudlinux"}]}],"bundled":70},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"php-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.3-51.el6.cloudlinux"}]}],"bundled":70},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"php-mbstring","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.3-51.el6.cloudlinux"}]}],"bundled":70},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"php-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.3-51.el6.cloudlinux"}]}],"bundled":70},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"php-odbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.3-51.el6.cloudlinux"}]}],"bundled":70},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"php-pdo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.3-51.el6.cloudlinux"}]}],"bundled":70},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"php-pgsql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.3-51.el6.cloudlinux"}]}],"bundled":70},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"php-process","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.3-51.el6.cloudlinux"}]}],"bundled":70},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"php-pspell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.3-51.el6.cloudlinux"}]}],"bundled":70},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"php-recode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.3-51.el6.cloudlinux"}]}],"bundled":70},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"php-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.3-51.el6.cloudlinux"}]}],"bundled":70},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"php-soap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.3-51.el6.cloudlinux"}]}],"bundled":70},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"php-tidy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.3-51.el6.cloudlinux"}]}],"bundled":70},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"php-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.3-51.el6.cloudlinux"}]}],"bundled":70},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"php-xmlrpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.3-51.el6.cloudlinux"}]}],"bundled":70},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"php-zts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.3-51.el6.cloudlinux"}]}],"bundled":70},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"apcu-panel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.18-1.module_el8.4.0+2001+2eb69d76"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"libzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-1.module_el8.4.0+2001+2eb69d76"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"libzip-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-1.module_el8.4.0+2001+2eb69d76"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"libzip-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-1.module_el8.4.0+2001+2eb69d76"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"php","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.6-4.module_el8.4.0+2001+2eb69d76.tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"php-bcmath","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.6-4.module_el8.4.0+2001+2eb69d76.tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"php-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.6-4.module_el8.4.0+2001+2eb69d76.tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"php-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.6-4.module_el8.4.0+2001+2eb69d76.tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"php-dba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.6-4.module_el8.4.0+2001+2eb69d76.tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"php-dbg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.6-4.module_el8.4.0+2001+2eb69d76.tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"php-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.6-4.module_el8.4.0+2001+2eb69d76.tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"php-embedded","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.6-4.module_el8.4.0+2001+2eb69d76.tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"php-enchant","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.6-4.module_el8.4.0+2001+2eb69d76.tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"php-ffi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.6-4.module_el8.4.0+2001+2eb69d76.tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"php-fpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.6-4.module_el8.4.0+2001+2eb69d76.tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"php-gd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.6-4.module_el8.4.0+2001+2eb69d76.tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"php-gmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.6-4.module_el8.4.0+2001+2eb69d76.tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"php-intl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.6-4.module_el8.4.0+2001+2eb69d76.tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"php-json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.6-4.module_el8.4.0+2001+2eb69d76.tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"php-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.6-4.module_el8.4.0+2001+2eb69d76.tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"php-mbstring","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.6-4.module_el8.4.0+2001+2eb69d76.tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"php-mysqlnd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.6-4.module_el8.4.0+2001+2eb69d76.tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"php-odbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.6-4.module_el8.4.0+2001+2eb69d76.tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"php-opcache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.6-4.module_el8.4.0+2001+2eb69d76.tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"php-pdo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.6-4.module_el8.4.0+2001+2eb69d76.tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"php-pear","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.10.12-1.module_el8.4.0+2001+2eb69d76"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"php-pecl-apcu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.18-1.module_el8.4.0+2001+2eb69d76"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"php-pecl-apcu-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.18-1.module_el8.4.0+2001+2eb69d76"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"php-pecl-rrd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.1-1.module_el8.4.0+2001+2eb69d76"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"php-pecl-xdebug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.5-1.module_el8.4.0+2001+2eb69d76"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"php-pecl-zip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.2-1.module_el8.4.0+2001+2eb69d76"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"php-pgsql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.6-4.module_el8.4.0+2001+2eb69d76.tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"php-process","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.6-4.module_el8.4.0+2001+2eb69d76.tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"php-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.6-4.module_el8.4.0+2001+2eb69d76.tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"php-soap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.6-4.module_el8.4.0+2001+2eb69d76.tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"php-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.6-4.module_el8.4.0+2001+2eb69d76.tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"php-xmlrpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.6-4.module_el8.4.0+2001+2eb69d76.tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"Debian:11","package":"php7.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.11-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"php7.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.33-0+deb9u10"}]}],"versions":["7.0.19-1","7.0.20-1","7.0.20-2","7.0.22-1","7.0.22-2","7.0.22-3","7.0.25-1","7.0.26-1","7.0.27-0+deb9u1","7.0.27-1","7.0.28-1","7.0.29-1","7.0.30-0+deb9u1","7.0.30-1","7.0.30-2","7.0.31-1","7.0.32-1","7.0.33-0+deb9u1","7.0.33-0+deb9u2","7.0.33-0+deb9u3","7.0.33-0+deb9u5","7.0.33-0+deb9u6","7.0.33-0+deb9u7","7.0.33-0+deb9u8","7.0.33-0+deb9u9"]},{"source":"osv","ecosystem":"Debian:10","package":"php7.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.3.27-1~deb10u1"}]}],"versions":["7.3.10-1","7.3.11-1~deb10u1","7.3.12-1","7.3.14-1~deb10u1","7.3.15-1","7.3.15-2","7.3.15-3","7.3.19-1~deb10u1","7.3.4-2","7.3.6-1","7.3.8-1","7.3.9-1","7.3.9-1~deb10u1"],"bundled":5},{"source":"osv","ecosystem":"Mageia:7","package":"php","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.3.23-1.mga7"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"php","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.10-13.oe1"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:20.03-LTS","package":"php","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.10-12.oe1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-php73-php","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.29-1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-php73-php-bcmath","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.29-1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-php73-php-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.29-1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-php73-php-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.29-1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-php73-php-dba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.29-1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-php73-php-dbg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.29-1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-php73-php-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.29-1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-php73-php-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.29-1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-php73-php-embedded","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.29-1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-php73-php-enchant","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.29-1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-php73-php-fpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.29-1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-php73-php-gd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.29-1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-php73-php-gmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.29-1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-php73-php-intl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.29-1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-php73-php-json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.29-1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-php73-php-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.29-1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-php73-php-mbstring","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.29-1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-php73-php-mysqlnd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.29-1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-php73-php-odbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.29-1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-php73-php-opcache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.29-1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-php73-php-pdo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.29-1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-php73-php-pgsql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.29-1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-php73-php-process","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.29-1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-php73-php-pspell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.29-1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-php73-php-recode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.29-1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-php73-php-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.29-1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-php73-php-soap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.29-1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-php73-php-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.29-1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-php73-php-xmlrpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.29-1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-php73-php-zip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.29-1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"apcu-panel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.18-1.module+el8.3.0+6678+b09f589e"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-1.module+el8.3.0+6678+b09f589e"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libzip-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-1.module+el8.3.0+6678+b09f589e"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libzip-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-1.module+el8.3.0+6678+b09f589e"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libzip-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-1.module+el8.3.0+6678+b09f589e"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libzip-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-1.module+el8.3.0+6678+b09f589e"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libzip-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-1.module+el8.3.0+6678+b09f589e"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-1.module+el8.5.0+11143+cc873159"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-bcmath","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-1.module+el8.5.0+11143+cc873159"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-bcmath-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-1.module+el8.5.0+11143+cc873159"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-1.module+el8.5.0+11143+cc873159"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-cli-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-1.module+el8.5.0+11143+cc873159"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-1.module+el8.5.0+11143+cc873159"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-common-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-1.module+el8.5.0+11143+cc873159"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-dba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-1.module+el8.5.0+11143+cc873159"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-dba-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-1.module+el8.5.0+11143+cc873159"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-dbg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-1.module+el8.5.0+11143+cc873159"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-dbg-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-1.module+el8.5.0+11143+cc873159"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-1.module+el8.5.0+11143+cc873159"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-1.module+el8.5.0+11143+cc873159"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-1.module+el8.5.0+11143+cc873159"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-embedded","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-1.module+el8.5.0+11143+cc873159"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-embedded-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-1.module+el8.5.0+11143+cc873159"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-enchant","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-1.module+el8.5.0+11143+cc873159"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-enchant-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-1.module+el8.5.0+11143+cc873159"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-ffi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-1.module+el8.5.0+11143+cc873159"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-ffi-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-1.module+el8.5.0+11143+cc873159"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-fpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-1.module+el8.5.0+11143+cc873159"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-fpm-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-1.module+el8.5.0+11143+cc873159"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-gd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-1.module+el8.5.0+11143+cc873159"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-gd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-1.module+el8.5.0+11143+cc873159"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-gmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-1.module+el8.5.0+11143+cc873159"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-gmp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-1.module+el8.5.0+11143+cc873159"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-intl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-1.module+el8.5.0+11143+cc873159"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-intl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-1.module+el8.5.0+11143+cc873159"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-1.module+el8.5.0+11143+cc873159"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-json-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-1.module+el8.5.0+11143+cc873159"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-1.module+el8.5.0+11143+cc873159"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-ldap-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-1.module+el8.5.0+11143+cc873159"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-mbstring","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-1.module+el8.5.0+11143+cc873159"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-mbstring-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-1.module+el8.5.0+11143+cc873159"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-mysqlnd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-1.module+el8.5.0+11143+cc873159"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-mysqlnd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-1.module+el8.5.0+11143+cc873159"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-odbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-1.module+el8.5.0+11143+cc873159"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-odbc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-1.module+el8.5.0+11143+cc873159"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-opcache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-1.module+el8.5.0+11143+cc873159"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-opcache-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-1.module+el8.5.0+11143+cc873159"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-pdo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-1.module+el8.5.0+11143+cc873159"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-pdo-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-1.module+el8.5.0+11143+cc873159"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-pear","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.10.12-1.module+el8.3.0+6678+b09f589e"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-pecl-apcu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.18-1.module+el8.3.0+6678+b09f589e"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-pecl-apcu-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.18-1.module+el8.3.0+6678+b09f589e"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-pecl-apcu-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.18-1.module+el8.3.0+6678+b09f589e"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-pecl-apcu-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.18-1.module+el8.3.0+6678+b09f589e"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-pecl-rrd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.1-1.module+el8.3.0+6678+b09f589e"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-pecl-rrd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.1-1.module+el8.3.0+6678+b09f589e"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-pecl-rrd-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.1-1.module+el8.3.0+6678+b09f589e"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-pecl-xdebug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.5-1.module+el8.3.0+6678+b09f589e"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-pecl-xdebug-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.5-1.module+el8.3.0+6678+b09f589e"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-pecl-xdebug-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.5-1.module+el8.3.0+6678+b09f589e"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-pecl-zip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.2-1.module+el8.3.0+6678+b09f589e"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-pecl-zip-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.2-1.module+el8.3.0+6678+b09f589e"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-pecl-zip-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.2-1.module+el8.3.0+6678+b09f589e"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-pgsql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-1.module+el8.5.0+11143+cc873159"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-pgsql-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-1.module+el8.5.0+11143+cc873159"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-process","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-1.module+el8.5.0+11143+cc873159"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-process-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-1.module+el8.5.0+11143+cc873159"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-1.module+el8.5.0+11143+cc873159"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-snmp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-1.module+el8.5.0+11143+cc873159"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-soap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-1.module+el8.5.0+11143+cc873159"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-soap-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-1.module+el8.5.0+11143+cc873159"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-1.module+el8.5.0+11143+cc873159"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-xml-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-1.module+el8.5.0+11143+cc873159"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-xmlrpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-1.module+el8.5.0+11143+cc873159"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-xmlrpc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-1.module+el8.5.0+11143+cc873159"}]}],"bundled":5},{"source":"osv","ecosystem":"Rocky Linux:8","package":"libzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-1.module+el8.6.0+789+2130c178"}]}],"bundled":5},{"source":"osv","ecosystem":"Rocky Linux:8","package":"libzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-1.module+el8.4.0+415+e936cba3"}]}],"bundled":5},{"source":"osv","ecosystem":"Rocky Linux:8","package":"php","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-1.module+el8.5.0+696+61e7c9ba"}]}],"bundled":5},{"source":"osv","ecosystem":"Rocky Linux:8","package":"php-pear","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.10.12-1.module+el8.4.0+415+e936cba3"}]}],"bundled":5},{"source":"osv","ecosystem":"Rocky Linux:8","package":"php-pear","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.10.12-1.module+el8.6.0+789+2130c178"}]}],"bundled":5},{"source":"osv","ecosystem":"Rocky Linux:8","package":"php-pecl-apcu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.18-1.module+el8.6.0+789+2130c178"}]}],"bundled":5},{"source":"osv","ecosystem":"Rocky Linux:8","package":"php-pecl-apcu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.18-1.module+el8.4.0+415+e936cba3"}]}],"bundled":5},{"source":"osv","ecosystem":"Rocky Linux:8","package":"php-pecl-rrd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.1-1.module+el8.4.0+414+2e7afcdd"}]}],"bundled":5},{"source":"osv","ecosystem":"Rocky Linux:8","package":"php-pecl-xdebug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.5-1.module+el8.4.0+415+e936cba3"}]}],"bundled":5},{"source":"osv","ecosystem":"Rocky Linux:8","package":"php-pecl-zip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.2-1.module+el8.6.0+789+2130c178"}]}],"bundled":5},{"source":"osv","ecosystem":"Rocky Linux:8","package":"php-pecl-zip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.2-1.module+el8.4.0+415+e936cba3"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"php53","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.17-112.93.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"php53","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.17-112.93.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"php5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.5.14-109.82.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"php74","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.6-1.13.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"php74","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.6-1.13.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.7-50.102.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.7-50.102.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP2","package":"php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.6-3.11.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP2","package":"php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.6-3.11.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"php72","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.5-1.54.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"php72","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.5-1.54.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP1","package":"php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.5-4.67.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP1","package":"php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.5-4.67.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.5-4.67.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.5-4.67.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.5-4.67.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.5-4.67.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.34-150000.4.103.1"}]}],"bundled":52},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.34-150000.4.103.1"}]}],"bundled":52},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.34-150000.4.103.1"}]}],"bundled":52},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.34-150000.4.103.1"}]}],"bundled":52},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.34-150000.4.103.1"}]}],"bundled":52},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.34-150000.4.103.1"}]}],"bundled":52},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.34-150000.4.103.1"}]}],"bundled":52},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.34-150000.4.103.1"}]}],"bundled":52},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.34-150000.4.103.1"}]}],"bundled":52},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.34-150000.4.103.1"}]}],"bundled":52},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.34-150000.4.103.1"}]}],"bundled":52},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"php74","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.33-1.47.2"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"php74","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.33-1.47.2"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP3","package":"php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.33-150200.3.46.2"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP3","package":"php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.33-150200.3.46.2"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS","package":"php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.33-150200.3.46.2"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.33-150200.3.46.2"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-BCL","package":"php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.33-150200.3.46.2"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.33-150200.3.46.2"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.33-150200.3.46.2"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.1","package":"php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.33-150200.3.46.2"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.1","package":"php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.33-150200.3.46.2"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Manager Server 4.1","package":"php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.33-150200.3.46.2"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7","package":"php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.33-150200.3.46.2"}]}],"bundled":18},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.33-150200.3.46.2"}]}],"bundled":18},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"php7-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.33-150200.3.46.2"}]}],"bundled":18},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.33-150200.3.46.2"}]}],"bundled":18},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"php5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.5.9+dfsg-1ubuntu4.29+esm13"}]}],"versions":["5.5.3+dfsg-1ubuntu2","5.5.3+dfsg-1ubuntu3","5.5.6+dfsg-1ubuntu1","5.5.6+dfsg-1ubuntu2","5.5.8+dfsg-2ubuntu1","5.5.9+dfsg-1ubuntu1","5.5.9+dfsg-1ubuntu2","5.5.9+dfsg-1ubuntu3","5.5.9+dfsg-1ubuntu4","5.5.9+dfsg-1ubuntu4.1","5.5.9+dfsg-1ubuntu4.2","5.5.9+dfsg-1ubuntu4.3","5.5.9+dfsg-1ubuntu4.4","5.5.9+dfsg-1ubuntu4.5","5.5.9+dfsg-1ubuntu4.6","5.5.9+dfsg-1ubuntu4.7","5.5.9+dfsg-1ubuntu4.9","5.5.9+dfsg-1ubuntu4.11","5.5.9+dfsg-1ubuntu4.12","5.5.9+dfsg-1ubuntu4.13","5.5.9+dfsg-1ubuntu4.14","5.5.9+dfsg-1ubuntu4.16","5.5.9+dfsg-1ubuntu4.17","5.5.9+dfsg-1ubuntu4.19","5.5.9+dfsg-1ubuntu4.20","5.5.9+dfsg-1ubuntu4.21","5.5.9+dfsg-1ubuntu4.22","5.5.9+dfsg-1ubuntu4.23","5.5.9+dfsg-1ubuntu4.24","5.5.9+dfsg-1ubuntu4.25","5.5.9+dfsg-1ubuntu4.26","5.5.9+dfsg-1ubuntu4.27","5.5.9+dfsg-1ubuntu4.29","5.5.9+dfsg-1ubuntu4.29+esm1","5.5.9+dfsg-1ubuntu4.29+esm2","5.5.9+dfsg-1ubuntu4.29+esm3","5.5.9+dfsg-1ubuntu4.29+esm4","5.5.9+dfsg-1ubuntu4.29+esm5","5.5.9+dfsg-1ubuntu4.29+esm6","5.5.9+dfsg-1ubuntu4.29+esm8","5.5.9+dfsg-1ubuntu4.29+esm10","5.5.9+dfsg-1ubuntu4.29+esm11","5.5.9+dfsg-1ubuntu4.29+esm12"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"php7.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.33-0ubuntu0.16.04.16"}]}],"versions":["7.0.1-5","7.0.1-6","7.0.2-1","7.0.2-3","7.0.2-4","7.0.2-5","7.0.3-2","7.0.3-3","7.0.3-9ubuntu1","7.0.4-5ubuntu1","7.0.4-5ubuntu2","7.0.4-7ubuntu1","7.0.4-7ubuntu2","7.0.4-7ubuntu2.1","7.0.8-0ubuntu0.16.04.1","7.0.8-0ubuntu0.16.04.2","7.0.8-0ubuntu0.16.04.3","7.0.13-0ubuntu0.16.04.1","7.0.15-0ubuntu0.16.04.1","7.0.15-0ubuntu0.16.04.2","7.0.15-0ubuntu0.16.04.4","7.0.18-0ubuntu0.16.04.1","7.0.22-0ubuntu0.16.04.1","7.0.25-0ubuntu0.16.04.1","7.0.28-0ubuntu0.16.04.1","7.0.30-0ubuntu0.16.04.1","7.0.32-0ubuntu0.16.04.1","7.0.33-0ubuntu0.16.04.1","7.0.33-0ubuntu0.16.04.2","7.0.33-0ubuntu0.16.04.3","7.0.33-0ubuntu0.16.04.4","7.0.33-0ubuntu0.16.04.5","7.0.33-0ubuntu0.16.04.6","7.0.33-0ubuntu0.16.04.7","7.0.33-0ubuntu0.16.04.9","7.0.33-0ubuntu0.16.04.11","7.0.33-0ubuntu0.16.04.12","7.0.33-0ubuntu0.16.04.14","7.0.33-0ubuntu0.16.04.15"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"php7.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.24-0ubuntu0.18.04.7"}]}],"versions":["7.2.1-1ubuntu2","7.2.2-1ubuntu1","7.2.2-1ubuntu2","7.2.3-1ubuntu1","7.2.5-0ubuntu0.18.04.1","7.2.7-0ubuntu0.18.04.1","7.2.7-0ubuntu0.18.04.2","7.2.10-0ubuntu0.18.04.1","7.2.15-0ubuntu0.18.04.1","7.2.15-0ubuntu0.18.04.2","7.2.17-0ubuntu0.18.04.1","7.2.19-0ubuntu0.18.04.1","7.2.19-0ubuntu0.18.04.2","7.2.24-0ubuntu0.18.04.1","7.2.24-0ubuntu0.18.04.2","7.2.24-0ubuntu0.18.04.3","7.2.24-0ubuntu0.18.04.4","7.2.24-0ubuntu0.18.04.6"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"php7.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.3-4ubuntu2.4"}]}],"versions":["7.4.3-4build1","7.4.3-4build2","7.4.3-4ubuntu1","7.4.3-4ubuntu1.1","7.4.3-4ubuntu2.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"php5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.5.9+dfsg-1ubuntu4.29+esm13"}]}],"versions":["5.5.3+dfsg-1ubuntu2","5.5.3+dfsg-1ubuntu3","5.5.6+dfsg-1ubuntu1","5.5.6+dfsg-1ubuntu2","5.5.8+dfsg-2ubuntu1","5.5.9+dfsg-1ubuntu1","5.5.9+dfsg-1ubuntu2","5.5.9+dfsg-1ubuntu3","5.5.9+dfsg-1ubuntu4","5.5.9+dfsg-1ubuntu4.1","5.5.9+dfsg-1ubuntu4.2","5.5.9+dfsg-1ubuntu4.3","5.5.9+dfsg-1ubuntu4.4","5.5.9+dfsg-1ubuntu4.5","5.5.9+dfsg-1ubuntu4.6","5.5.9+dfsg-1ubuntu4.7","5.5.9+dfsg-1ubuntu4.9","5.5.9+dfsg-1ubuntu4.11","5.5.9+dfsg-1ubuntu4.12","5.5.9+dfsg-1ubuntu4.13","5.5.9+dfsg-1ubuntu4.14","5.5.9+dfsg-1ubuntu4.16","5.5.9+dfsg-1ubuntu4.17","5.5.9+dfsg-1ubuntu4.19","5.5.9+dfsg-1ubuntu4.20","5.5.9+dfsg-1ubuntu4.21","5.5.9+dfsg-1ubuntu4.22","5.5.9+dfsg-1ubuntu4.23","5.5.9+dfsg-1ubuntu4.24","5.5.9+dfsg-1ubuntu4.25","5.5.9+dfsg-1ubuntu4.26","5.5.9+dfsg-1ubuntu4.27","5.5.9+dfsg-1ubuntu4.29","5.5.9+dfsg-1ubuntu4.29+esm1","5.5.9+dfsg-1ubuntu4.29+esm2","5.5.9+dfsg-1ubuntu4.29+esm3","5.5.9+dfsg-1ubuntu4.29+esm4","5.5.9+dfsg-1ubuntu4.29+esm5","5.5.9+dfsg-1ubuntu4.29+esm6","5.5.9+dfsg-1ubuntu4.29+esm8","5.5.9+dfsg-1ubuntu4.29+esm10","5.5.9+dfsg-1ubuntu4.29+esm11","5.5.9+dfsg-1ubuntu4.29+esm12"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"php7.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.33-0ubuntu0.16.04.16"}]}],"versions":["7.0.1-5","7.0.1-6","7.0.2-1","7.0.2-3","7.0.2-4","7.0.2-5","7.0.3-2","7.0.3-3","7.0.3-9ubuntu1","7.0.4-5ubuntu1","7.0.4-5ubuntu2","7.0.4-7ubuntu1","7.0.4-7ubuntu2","7.0.4-7ubuntu2.1","7.0.8-0ubuntu0.16.04.1","7.0.8-0ubuntu0.16.04.2","7.0.8-0ubuntu0.16.04.3","7.0.13-0ubuntu0.16.04.1","7.0.15-0ubuntu0.16.04.1","7.0.15-0ubuntu0.16.04.2","7.0.15-0ubuntu0.16.04.4","7.0.18-0ubuntu0.16.04.1","7.0.22-0ubuntu0.16.04.1","7.0.25-0ubuntu0.16.04.1","7.0.28-0ubuntu0.16.04.1","7.0.30-0ubuntu0.16.04.1","7.0.32-0ubuntu0.16.04.1","7.0.33-0ubuntu0.16.04.1","7.0.33-0ubuntu0.16.04.2","7.0.33-0ubuntu0.16.04.3","7.0.33-0ubuntu0.16.04.4","7.0.33-0ubuntu0.16.04.5","7.0.33-0ubuntu0.16.04.6","7.0.33-0ubuntu0.16.04.7","7.0.33-0ubuntu0.16.04.9","7.0.33-0ubuntu0.16.04.11","7.0.33-0ubuntu0.16.04.12","7.0.33-0ubuntu0.16.04.14","7.0.33-0ubuntu0.16.04.15"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"php7.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.24-0ubuntu0.18.04.7"}]}],"versions":["7.2.1-1ubuntu2","7.2.2-1ubuntu1","7.2.2-1ubuntu2","7.2.3-1ubuntu1","7.2.5-0ubuntu0.18.04.1","7.2.7-0ubuntu0.18.04.1","7.2.7-0ubuntu0.18.04.2","7.2.10-0ubuntu0.18.04.1","7.2.15-0ubuntu0.18.04.1","7.2.15-0ubuntu0.18.04.2","7.2.17-0ubuntu0.18.04.1","7.2.19-0ubuntu0.18.04.1","7.2.19-0ubuntu0.18.04.2","7.2.24-0ubuntu0.18.04.1","7.2.24-0ubuntu0.18.04.2","7.2.24-0ubuntu0.18.04.3","7.2.24-0ubuntu0.18.04.4","7.2.24-0ubuntu0.18.04.6"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"php7.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.3-4ubuntu2.4"}]}],"versions":["7.4.3-4build1","7.4.3-4build2","7.4.3-4ubuntu1","7.4.3-4ubuntu1.1","7.4.3-4ubuntu2.2"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.6-lp152.2.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"php7-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.6-lp152.2.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.5-lp151.6.36.7"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"php7-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.5-lp151.6.36.7"}]}],"bundled":2}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"netapp","product":"clustered_data_ontap"},{"vendor":"opensuse","product":"leap"},{"vendor":"php","product":"php"},{"vendor":"php group","product":"php"},{"vendor":"tenable","product":"tenable.sc"}],"references":[{"url":"https://hackerone.com/reports/895727","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","advisory","evidence","report"]},{"url":"https://bugs.php.net/bug.php?id=79699","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Vendor Advisory","advisory","report"]},{"url":"http://cve.circl.lu/cve/CVE-2020-8184","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RRU57N3OSYZPOMFWPRDNVH7EMYOTSZ66/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/10/msg00008.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7EVDN7D3IB4EAI4D3ZOM2OJKQ5SD7K4E/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/P2J3ZZDHCSX65T5QWV4AHBN7MOJXBEKG/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00045.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://usn.ubuntu.com/4583-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00067.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://security.gentoo.org/glsa/202012-16","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.debian.org/security/2021/dsa-4856","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20201016-0001/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.oracle.com/security-alerts/cpuoct2021.html","tags":["x_refsource_MISC","x_transferred","Not Applicable","Third Party Advisory","advisory"]},{"url":"https://www.tenable.com/security/tns-2021-14","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-7070","tags":["web","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7EVDN7D3IB4EAI4D3ZOM2OJKQ5SD7K4E/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P2J3ZZDHCSX65T5QWV4AHBN7MOJXBEKG/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RRU57N3OSYZPOMFWPRDNVH7EMYOTSZ66/"},{"url":"https://github.com/advisories/GHSA-j7r5-hm2w-qqf9"},{"url":"https://security.alpinelinux.org/vuln/CVE-2020-7070","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2021-4213.html","tags":["advisory"]},{"url":"https://vulners.com/cve/CVE-2020-7068","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2020-7069","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2020-7070","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2020-7071","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2021-21702","tags":["report"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2020-7070","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/els6/CLSA-2020-1605798462.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/centos8.4-els/CLSA-2022-1643747494.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-7070","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2020-0387.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=27239","tags":["report"]},{"url":"https://www.php.net/ChangeLog-7.php#PHP_7_3_23","tags":["web"]},{"url":"https://www.php.net/ChangeLog-7.php#PHP_7_3_22","tags":["web"]},{"url":"https://www.php.net/ChangeLog-7.php#PHP_7_3_21","tags":["web"]},{"url":"https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1056","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-7069","tags":["advisory"]},{"url":"https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1065","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:2992","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1868109","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1885735","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1885738","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1913846","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1925272","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1977764","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1978755","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_2992.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-7068","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-7068","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-7068","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-7069","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-7069","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-7070","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-7070","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-7071","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-7071","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-7071","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-21702","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-21702","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21702","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-21705","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-21705","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21705","tags":["advisory"]},{"url":"https://bugs.php.net/bug.php?id=81122","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2021:4213","tags":["advisory"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.5_release_notes/","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_4213.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2021:4213","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-202014516-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1177352","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-7070","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20202894-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20202896-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1173786","tags":["report"]},{"url":"https://bugzilla.suse.com/1177351","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-7069","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20202920-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20202941-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20202943-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20202997-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20224067-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1204577","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2015-9253","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-8923","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9120","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1000222","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12882","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-14851","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-17082","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19935","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20783","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11034","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11035","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11036","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11039","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11040","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11041","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11042","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11043","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11045","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11046","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11047","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11048","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11050","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9020","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9021","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9022","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9023","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9024","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9637","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9638","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9640","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9641","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9675","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-7059","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-7060","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-7062","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-7063","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-7064","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-7066","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-7068","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-7071","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21702","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21703","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21704","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21705","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21707","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-31625","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-31626","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-31628","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-31629","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-37454","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20224068-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1203867","tags":["report"]},{"url":"https://bugzilla.suse.com/1203870","tags":["report"]},{"url":"https://bugzilla.suse.com/1204979","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21706","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21708","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-31630","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20224069-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2020-7070","tags":["report"]},{"url":"https://git.php.net/?p=php-src.git;a=commit;h=6559fe912661ca5ce5f0eeeb591d928451428ed0","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4583-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-4583-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2020-7069","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/4CIBZMPAQTIYCAHXU3LMPKR765GUY27C/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/TQG2SBPQEPGAA3GOJALR6TIDULOGA2OE/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2020-7070","title":"PHP parses encoded cookie names so malicious `__Host-` cookies can be sent","description":"In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when PHP is processing incoming HTTP cookie values, the cookie names are url-decoded. This may lead to cookies with prefixes like __Host confused with cookies that decode to such prefix, thus leading to an attacker being able to forge cookie which is supposed to be secure. See also CVE-2020-8184 for more information.","status":"published","published":"2020-10-02T14:14:45.406Z","modified":"2024-09-16T16:28:36.773Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:35:58.787905Z"}],"euvd":[{"id":"EUVD-2020-28204","description":"In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when PHP is processing incoming HTTP cookie values, the cookie names are url-decoded. This may lead to cookies with prefixes like __Host confused with cookies that decode to such prefix, thus leading to an attacker being able to forge cookie which is supposed to be secure. See also CVE-2020-8184 for more information.","status":"published","published":"2020-10-02T14:14:45Z","modified":"2024-09-16T16:28:36Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T00:55:51.136895Z"}],"ghsa":[{"id":"GHSA-j7r5-hm2w-qqf9","title":"In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when PHP is...","description":"In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when PHP is processing incoming HTTP cookie values, the cookie names are url-decoded. This may lead to cookies with prefixes like __Host confused with cookies that decode to such prefix, thus leading to an attacker being able to forge cookie which is supposed to be secure. See also CVE-2020-8184 for more information.","status":"published","published":"2022-05-24T17:30:05Z","modified":"2023-01-29T05:04:46Z","cwes":["CWE-565"],"updated_at":"2026-11-02T14:45:37.901426Z"}],"nvd":[{"id":"CVE-2020-7070","description":"In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when PHP is processing incoming HTTP cookie values, the cookie names are url-decoded. This may lead to cookies with prefixes like __Host confused with cookies that decode to such prefix, thus leading to an attacker being able to forge cookie which is supposed to be secure. See also CVE-2020-8184 for more information.","status":"published","published":"2020-10-02T15:15:12.747Z","modified":"2026-06-17T03:24:18.537Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-20","CWE-565"],"updated_at":"2026-11-02T14:06:17.70091Z"}],"osv":[{"id":"ALPINE-CVE-2020-7070","description":"In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when PHP is processing incoming HTTP cookie values, the cookie names are url-decoded. This may lead to cookies with prefixes like __Host confused with cookies that decode to such prefix, thus leading to an attacker being able to forge cookie which is supposed to be secure. See also CVE-2020-8184 for more information.","status":"published","published":"2020-10-02T15:15:12.747Z","modified":"2026-11-03T06:32:26.475325144Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T07:17:57.723967Z"},{"id":"BELL-CVE-2020-7070","title":"CVE-2020-7070 does not affect BellSoft software","status":"withdrawn","published":"2020-10-02T15:15:00Z","modified":"2026-01-26T09:47:53.004108Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:15.925958Z"},{"id":"CVE-2020-7070","description":"In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when PHP is processing incoming HTTP cookie values, the cookie names are url-decoded. This may lead to cookies with prefixes like __Host confused with cookies that decode to such prefix, thus leading to an attacker being able to forge cookie which is supposed to be secure. See also CVE-2020-8184 for more information.","status":"published","published":"2020-10-02T15:15:12.747Z","modified":"2026-10-24T10:30:40.709997643Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:17.34531Z"},{"id":"DEBIAN-CVE-2020-7070","description":"In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when PHP is processing incoming HTTP cookie values, the cookie names are url-decoded. This may lead to cookies with prefixes like __Host confused with cookies that decode to such prefix, thus leading to an attacker being able to forge cookie which is supposed to be secure. See also CVE-2020-8184 for more information.","status":"published","published":"2020-10-02T15:15:12.747Z","modified":"2026-08-27T13:03:15.806269691Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:34.311861Z"},{"id":"OESA-2021-1056","title":"php security update","description":"PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts. The php package contains the module (often referred to as mod_php) which adds support for the PHP language to Apache HTTP Server.\r\n\r\nSecurity Fix(es):\n\nWhen using certain mbstring functions to convert multibyte encodings, in PHP versions 7.2.x below 7.2.27, 7.3.x below 7.3.14 and 7.4.x below 7.4.2 it is possible to supply data that will cause function mbfl_filt_conv_big5_wchar to read past the allocated buffer. This may lead to information disclosure or crash.(CVE-2020-7060)\r\n\r\nIn PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when PHP is processing incoming HTTP cookie values, the cookie names are url-decoded. This may lead to cookies with prefixes like __Host confused with cookies that decode to such prefix, thus leading to an attacker being able to forge cookie which is supposed to be secure. See also CVE-2020-8184 for more information.(CVE-2020-7070)\r\n\r\nIn PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when AES-CCM mode is used with openssl_encrypt() function with 12 bytes IV, only first 7 bytes of the IV is actually used. This can lead to both decreased security and incorrect encryption data.(CVE-2020-7069)","status":"published","published":"2021-03-05T11:04:17Z","modified":"2026-08-18T01:15:14.410052292Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:38.987987Z"},{"id":"OESA-2021-1065","title":"php security update","description":"PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts. The php package contains the module (often referred to as mod_php) which adds support for the PHP language to Apache HTTP Server.\r\n\r\nSecurity Fix(es):\r\n\r\nIn PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when PHP is processing incoming HTTP cookie values, the cookie names are url-decoded. This may lead to cookies with prefixes like __Host confused with cookies that decode to such prefix, thus leading to an attacker being able to forge cookie which is supposed to be secure. See also CVE-2020-8184 for more information.(CVE-2020-7070)\r\n\r\nIn PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when AES-CCM mode is used with openssl_encrypt() function with 12 bytes IV, only first 7 bytes of the IV is actually used. This can lead to both decreased security and incorrect encryption data.(CVE-2020-7069)","status":"published","published":"2021-03-05T11:04:17Z","modified":"2026-08-18T01:15:16.863106531Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:38.987987Z"},{"id":"RHSA-2021:2992","title":"Red Hat Security Advisory: rh-php73-php security, bug fix, and enhancement update","status":"published","published":"2024-09-13T22:45:17Z","modified":"2026-06-29T10:36:28Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:08.619234Z"},{"id":"RHSA-2021:4213","title":"Red Hat Security Advisory: php:7.4 security, bug fix, and enhancement update","status":"published","published":"2024-09-13T22:46:32Z","modified":"2026-06-29T10:37:56Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:08.619234Z"},{"id":"RLSA-2021:4213","title":"Moderate: php:7.4 security, bug fix, and enhancement update","description":"PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.\n\nThe following packages have been upgraded to a later upstream version: php (7.4.19). (BZ#1944110)\n\nSecurity Fix(es):\n\n* php: Wrong ciphertext/tag in AES-CCM encryption for a 12 bytes IV (CVE-2020-7069)\n\n* php: FILTER_VALIDATE_URL accepts URLs with invalid userinfo (CVE-2020-7071)\n\n* php: Use of freed hash key in the phar_parse_zipfile function (CVE-2020-7068)\n\n* php: URL decoding of cookie names can lead to different interpretation of cookies between browser and server (CVE-2020-7070)\n\n* php: NULL pointer dereference in SoapClient (CVE-2021-21702)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 8.5 Release Notes linked from the References section.","status":"published","published":"2021-11-09T08:42:20Z","modified":"2026-02-05T05:00:13.521189Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"UBUNTU-CVE-2020-7070","description":"In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when PHP is processing incoming HTTP cookie values, the cookie names are url-decoded. This may lead to cookies with prefixes like __Host confused with cookies that decode to such prefix, thus leading to an attacker being able to forge cookie which is supposed to be secure. See also CVE-2020-8184 for more information.","status":"published","published":"2020-10-02T15:15:00Z","modified":"2026-04-22T12:43:13.314004Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"},{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:25.728622Z"},{"id":"ALSA-2021:4213","title":"Moderate: php:7.4 security, bug fix, and enhancement update","description":"PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.\n\nThe following packages have been upgraded to a later upstream version: php (7.4.19). (BZ#1944110)\n\nSecurity Fix(es):\n\n* php: Wrong ciphertext/tag in AES-CCM encryption for a 12 bytes IV (CVE-2020-7069)\n\n* php: FILTER_VALIDATE_URL accepts URLs with invalid userinfo (CVE-2020-7071)\n\n* php: Use of freed hash key in the phar_parse_zipfile function (CVE-2020-7068)\n\n* php: URL decoding of cookie names can lead to different interpretation of cookies between browser and server (CVE-2020-7070)\n\n* php: NULL pointer dereference in SoapClient (CVE-2021-21702)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2021-11-09T08:42:20Z","modified":"2026-10-29T11:01:09.380175591Z","updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"BIT-libphp-2020-7070","title":"PHP parses encoded cookie names so malicious `__Host-` cookies can be sent","description":"In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when PHP is processing incoming HTTP cookie values, the cookie names are url-decoded. This may lead to cookies with prefixes like __Host confused with cookies that decode to such prefix, thus leading to an attacker being able to forge cookie which is supposed to be secure. See also CVE-2020-8184 for more information.","status":"published","published":"2025-08-11T13:53:17.298Z","modified":"2026-09-08T08:48:07.91852472Z","updated_at":"2026-11-02T15:28:32.162822Z"},{"id":"BIT-php-2020-7070","title":"PHP parses encoded cookie names so malicious `__Host-` cookies can be sent","description":"In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when PHP is processing incoming HTTP cookie values, the cookie names are url-decoded. This may lead to cookies with prefixes like __Host confused with cookies that decode to such prefix, thus leading to an attacker being able to forge cookie which is supposed to be secure. See also CVE-2020-8184 for more information.","status":"published","published":"2024-03-06T11:05:57.987Z","modified":"2026-09-08T08:48:18.281485634Z","updated_at":"2026-11-02T15:28:34.343258Z"},{"id":"BIT-php-min-2020-7070","title":"PHP parses encoded cookie names so malicious `__Host-` cookies can be sent","description":"In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when PHP is processing incoming HTTP cookie values, the cookie names are url-decoded. This may lead to cookies with prefixes like __Host confused with cookies that decode to such prefix, thus leading to an attacker being able to forge cookie which is supposed to be secure. See also CVE-2020-8184 for more information.","status":"published","published":"2025-01-14T19:23:10.221Z","modified":"2026-09-08T08:48:24.766721079Z","updated_at":"2026-11-02T15:28:34.343258Z"},{"id":"CLSA-2020-1605798462","title":"Fix of 227 CVE","description":"- Fix bug #69720: Null pointer dereference in phar_get_fp_offset()\n- Fix bug #70728: Type Confusion Vulnerability in PHP_to_XMLRPC_worker()\n- Fix bug #70661: Use After Free Vulnerability in WDDX Packet Deserialization\n- Fix bug #70741: Session WDDX Packet Deserialization Type Confusion Vulnerability\n- Fix bug #71459: Integer overflow in iptcembed()\n- Fix bug #71039: exec functions ignore length but look for NULL termination\n- Fix bug #71354: Heap corruption in tar/zip/phar parser.\n- Fix bug #71391: NULL Pointer Dereference in phar_tar_setupmetadata()\n- Fix bug #71323: Output of stream_get_meta_data can be falsified by its input\n- Fix bug #71498: Out-of-Bound Read in phar_parse_zipfile()\n- Fix bug #71587: Use-After-Free / Double-Free in WDDX Deserialize\n- Fix bug #71860: Invalid memory write in phar on filename with \\0 in name\n- Fix bug #71798: Integer Overflow in php_raw_url_encode\n- Fix bug #72837: integer overflow in bzdecompress caused heap corruption\n- Fix bug #72681: PHP Session Data Injection Vulnerability\n- Fix bug #72807: integer overflow in curl_escape caused heap corruption\n- Fix bug #72838: Integer overflow lead to heap corruption in sql_regcase\n- Fix bug #72697: select_colors write out-of-bounds\n- Fix bug #72730: imagegammacorrect allows arbitrary write access\n- Fix bug #72836: integer overflow in base64_decode caused heap corruption\n- Fix bug #72848: integer overflow in quoted_printable_encode caused heap corruption\n- Fix bug #72849: integer overflow in urlencode caused heap corruption\n- Fix bug #72850: integer overflow in php_uuencode caused heap corruption\n- Fix bug #72771: ftps:// wrapper is vulnerable to protocol downgrade attack\n- Fix bug #72749: wddx_deserialize allows illegal memory access\n- Fix bug #72750: wddx_deserialize null dereference\n- Fix bug #72790: wddx_deserialize null dereference with invalid xml\n- Fix bug #72799: wddx_deserialize null dereference in php_wddx_pop_element\n- Fix bug #73189: Memcpy negative size parameter php_resolve_path\n- Fix bug #73150: missing NULL check in dom_document_save_html\n- Fix bug #73284: heap overflow in php_ereg_replace function\n- Fix bug #73218: stack-buffer-overflow through \u0026quot;ResourceBundle\u0026quot; methods\n- Fix bug #73208: integer overflow in imap_8bit caused heap corruption\n- Fix bug #73082: string length overflow in mb_encode_* function\n- Fix bug #73174: heap overflow in php_pcre_replace_impl\n- Fix bug #73276: crash in openssl_random_pseudo_bytes function\n- Fix bug #73275: crash in openssl_encrypt function\n- Fix bug #73017: memory corruption in wordwrap function\n- Fix bug #73240: Write out of bounds at number_format\n- Fix bug #73073: CachingIterator null dereference when convert to string\n- Fix bug #73293: NULL pointer dereference in SimpleXMLElement::asXML()\n- Fix bug #73356: crash in bzcompress function\n- Fix bug #72696: imagefilltoborder stackoverflow on truecolor images\n- Fix bug #73418: Integer Overflow in \u0026quot;_php_imap_mail\u0026quot; leads Heap Overflow\n- Fix bug #73144: Use-after-free in ArrayObject Deserialization\n- Fix bug #73192: parse_url return wrong hostname\n- Fix bug #73331: NULL Pointer Dereference in WDDX Packet Deserialization with PDORow\n- Fix bug #73452: Segfault (Regression for #69152)\n- Fix bug #73631: Invalid read when wddx decodes empty boolean element\n- Fix bug #67587: Redirection loop on nginx with FPM\n- Fix bug #71465: PHAR doesn't know about litespeed\n- Fix bug #73737: FPE when parsing a tag format\n- Fix bug #73868: Fix DOS vulnerability in gdImageCreateFromGd2Ctx()\n- Fix bug #73869: Signed Integer Overflow gd_io.c\n- Fix bug #73773: Seg fault when loading hostile phar\n- Fix bug #70436: Use After Free Vulnerability in unserialize()\n- Fix bug #74603: PHP INI Parsing Stack Buffer Overflow Vulnerability\n- Fix bug #72535: arcfour encryption stream filter crashes php\n- Fix bug #72434: ZipArchive class Use After Free Vulnerability in PHP's\n  GC algorithm and unseria\n- Fix bug #72455: Heap Overflow due to integer overflows\n- Fix bug #74782: Reflected XSS in .phar 404 page\n- Fix bug #71335: Type Confusion in WDDX Packet Deserialization\n- Fix bug #76130: Heap Buffer Overflow (READ: 1786) in exif_iif_add_value\n- Fix bug #76249: stream filter convert.iconv leads to infinite loop on\n  invalid sequence\n- Fix bug #76248: Malicious LDAP-Server Response causes Crash\n- Fix bug #76129: fix for CVE-2018-5712 may not be complete\n- Fix bug #75981: stack-buffer-overflow while parsing HTTP response\n- Fix bug #74385: Locale::parseLocale() broken with some arguments\n- Fix bug #76335: \u0026quot;link(): Bad file descriptor\u0026quot; with non-ASCII path\n- Fix bug #76383: array_map on $GLOBALS returns IS_INDIRECT\n- Fix bug #73342: Vulnerability in php-fpm by changing stdin to non-blocking\n- Fix bug #76505: array_merge_recursive() is duplicating sub-array keys\n- Fix bug #76532: Integer overflow and excessive memory usage in mb_strimwidth\n- Fix bug #76548: pg_fetch_result did not fetch the next row\n- Fix bug #76488: Memory leak when fetching a BLOB field\n- Fix bug #76665: SQLite3Stmt::bindValue() with SQLITE3_FLOAT doesn't juggle\n- Fix bug #75402: Possible Memory Leak using PDO::CURSOR_SCROLL option\n- Fix bug #76517: --with-gettext= causes configure to misjudges there is no getcwd\n- Fix bug #72443: Installing shared extensions: cp: cannot stat 'modules/*':\n  No such file or dire\n- Fix bug #68175: RegexIterator pregFlags are NULL instead of 0\n- Fix bug #55146: iconv_mime_decode_headers() skips some headers\n- Fix bug #63839: iconv_mime_decode_headers function is skipping headers\n- Fix bug #60494: iconv_mime_decode does ignore special characters\n- Fix bug #68180: iconv_mime_decode can return extra characters in a header\n- Fix bug #73457: Wrong error message when fopen FTP wrapped fails to open\n  data connection\n- Fix bug #74454: Wrong exception being thrown when using ReflectionMethod\n- Fix bug #74764: Bindto IPv6 works with file_get_contents but fails with\n  stream_socket_client\n- Fix bug #75273: php_zlib_inflate_filter() may not update bytes_consumed\n- Fix bug #75696: posix_getgrnam fails to print details of group\n- Fix bug #76480: Use curl_multi_wait() so that timeouts are respected\n- Fix bug #76800: foreach inconsistent if array modified during loop\n- Fix bug #76886: Can't build xmlrpc with expat\n- Fix bug #76901: method_exists on SPL iterator passthrough method corrupts memory\n- Fix bug #77242: heap out of bounds read in xmlrpc_decode()\n- Fix bug #77247: heap buffer overflow in phar_detect_phar_fname_ext\n- Fix bug #77270: imagecolormatch Out Of Bounds Write on Heap\n- Fix bug #77370: Buffer overflow on mb regex functions - fetch_token\n- Fix bug #77380: Global out of bounds read in xmlrpc base64 code\n- Fix bug #77630: rename() across the device may allow unwanted access\n  during processing\n- Fix bug #77494: Disabling class causes segfault on member access\n- Fix bug #77431: openFile() silently truncates after a null byte\n- Fix bug #51068: DirectoryIterator glob:// don't support current path\n  relative queries\n- Fix bug #77396: Null Pointer Dereference in phar_create_or_parse_filename\n- Fix bug #77540: Invalid Read on exif_process_SOFn\n- Fix bug #77390: feof might hang on TLS streams in case of fragmented TLS records\n- Fix bug #77586: phar_tar_writeheaders_int() buffer overflow\n- Fix bug #77546: iptcembed broken function\n- Fix bug #77563: Uninitialized read in exif_process_IFD_in_MAKERNOTE\n- Fix bug #76557: heap-buffer-overflow (READ of size 48) while reading exif data\n- Fix bug #77024: SplFileObject::__toString() may return array\n- Fix bug #77945: Segmentation fault when constructing SoapClient with WSDL_CACHE_BOTH\n- Fix bug #77697: Crash on Big_Endian platform\n- Fix bug #77943: imageantialias($image, false); does not work\n- Fix bug #77944: Wrong meta pdo_type for bigint on LLP64\n- Fix bug #76717: var_export() does not create a parsable value for PHP_INT_MIN\n- Fix bug #77921: static.php.net doesn't work anymore\n- Fix bug #77934: php-fpm kill -USR2 not working\n- Fix bug #77700: Writing truecolor images as GIF ignores interlace flag\n- Fix bug #77765: FTP stream wrapper should set the directory as executable\n- Fix bug #50020: DateInterval:createDateFromString() silently fails\n- Fix bug #77742: bcpow() implementation related to gcc compiler optimization\n- Fix bug #77967: Bypassing open_basedir restrictions via file uris\n- Fix bug #77973: Uninitialized read in gdImageCreateFromXbm\n- Fix bug #77988: heap-buffer-overflow on php_jpg_get16\n- Fix bug #78192: SegFault when reuse statement after schema has changed\n- Fix bug #77124: FTP with SSL memory leak\n- Fix bug #78256: heap-buffer-overflow on exif_process_user_comment\n- Fix bug #78222: heap-buffer-overflow on exif_scan_thumbnail\n- Fix bug #77946: Bad cURL resources returned by curl_multi_info_read()\n- Fix bug #78333: Exif crash (bus error) due to wrong alignment and invalid cast\n- Fix bug #69100: Bus error from stream_copy_to_stream (file -\u0026gt; SSL stream)\n  with invalid length\n- Fix bug #76342: file_get_contents waits twice specified timeout\n- Fix bug #76859: stream_get_line skips data if used with data-generating filter\n- Fix bug #78579: mb_decode_numericentity: args number inconsistency\n- Fix bug #78910: Heap-buffer-overflow READ in exif\n- Fix bug #78878: Buffer underflow in bc_shift_addsub\n- Fix bug #78793: Use-after-free in exif parsing under memory sanitizer\n- Fix bug #78863: DirectoryIterator class silently truncates after a null byte\n- Fix bug #79099: OOB read in php_strip_tags_ex\n- Fix bug #79082: Files added to tar with Phar::buildFromIterator have\n  all-access permissions\n- Fix bug #79329: get_headers() silently truncates after a null byte\n- Fix bug #79282: Use-of-uninitialized-value in exif\n- Fix bug #61597: SimpleXMLElement doesn't include both @attributes and\n  textContent in properties\n- Fix bug #74940: DateTimeZone loose comparison always true until properties\n  are initialized.\n- Fix bug #79296: ZipArchive::open fails on empty file (libzip 1.6.0)\n- Fix bug #79330: shell_exec() silently truncates after a null byte\n- Fix bug #79364: When copy empty array, next key is unspecified.\n- Fix bug #79396: DateTime hour incorrect during DST jump forward using setTime\n- Fix bug #79410: system() swallows last chunk if it is exactly 4095 bytes\n  without newline\n- Fix bug #79424: php_zip_glob uses gl_pathc after call to globfree\n- Fix bug #79465: OOB Read in urldecode() (CVE-2020-7067)\n- Fix bug #78221: DOMNode::normalize() doesn't remove empty text nodes\n- Fix bug #78875: Long filenames cause OOM and temp files are not cleaned\n  (CVE-2019-11048)\n- Fix bug #78876: Long variables in multipart/form-data cause OOM and temp\n  files are not cleaned (CVE-2019-11048)\n- Fix bug #79514: Memory leaks while including unexistent file\n- Fix bug #79528: Different object of the same xml between 7.4.5 and 7.4.4\n- Fix bug #62890: default_socket_timeout=-1 causes connection to timeout\n- Fix bug #70362: Can't copy() large 'data://' with open_basedir\n- Fix bug #73527: Invalid memory access in php_filter_strip\n- Fix bug #74267: segfault with streams and invalid data\n- Fix bug #79787: mb_strimwidth does not trim string\n- Fix bug #79877: getimagesize function silently truncates after a null byte\n- Fix bug #68447: grapheme_extract take an extra trailing character\n- Fix bug #68825: Inconsistent exception in DirectoryIterator::getLinkTarget()\n- Fix bug #74145: wddx parsing empty boolean tag leads to SIGSEGV (CVE-2017-11143)\n- Fix bug #74651: negative-size-param (-1) in memcpy in zif_openssl_seal()\n  (CVE-2017-11144)\n- Fix bug #74435: Buffer over-read into uninitialized memory (CVE-2017-7890)\n- Fix bug #73093: Unserialize Exception object can lead to infinite loop\n  (CVE-2016-7478)\n- Fix bug #72520: Stack-based buffer overflow vulnerability in php_stream_zip_opener\n  (CVE-2016-6297)\n- Fix bug #73825: Heap out of bounds read on unserialize in finish_nested_data()\n  (CVE-2016-10161)\n- Fix bug #60491: Session module is adoptive (CVE-2011-4718)\n- Fix bug #69253: ZIP Integer Overflow leads to writing past heap boundary\n  (CVE-2015-2331)\n- Fix bug #69418: CVE-2006-7243 fix regressions in 5.4+ (CVE-2015-4025)\n- Fix bug #68598: pcntl_exec() should not allow null char (CVE-2015-4026)\n- Fix bug #69207: move_uploaded_file allows nulls in path (CVE-2015-2348)\n- Fix bug #69218: potential remote code execution with apache 2.4 apache2handler\n  (CVE-2015-3330)\n- Fix bug #69719: Incorrect handling of paths with NULs, related to bug 69353\n  (CVE-2015-4598)\n- Fix bug #69353: Missing null byte checks for paths in various PHP extensions\n  (CVE-2015-3411)\n- Fix bugs #70168, #70169, #70166, #70155: Use After Free Vulnerability in\n  unserialize() with\n  SplObjectStorage, SplDoublyLinkedList, SPLArrayObject, SPLArrayObject (CVE-2015-6831)\n- Fix bug #70019: Files extracted from archive may be placed outside of\n  destination directory (CVE-2015-6833)\n- Fix bug #70388: SOAP serialize_function_call() type confusion / RCE (CVE-2015-6836)\n- Fix bug #69782: NULL pointer dereference (CVE-2015-6837, CVE-2015-6838)\n- Fix bug #70433: Uninitialized pointer in phar_make_dirstream when zip entry\n  filename is \"/\" (CVE-2015-7804)\n- Fix bug #69923: Buffer overflow and stack smashing error in phar_fix_filepath\n  (CVE-2015-5590)\n- Fix bug #71488: Stack overflow when decompressing tar archives (CVE-2016-2554)\n- Fix bug #72061: Out-of-bounds reads in zif_grapheme_stripos with negative offset\n  (CVE-2016-4541, CVE-2016-4540)\n- Fix bug #72094: Out of bounds heap read access in exif header processing\n  (CVE-2016-4542)\n- Fix bug #72093: bcpowmod accepts negative scale and corrupts _one_ definition\n  (CVE-2016-4537)\n- Fix bug #71331: Uninitialized pointer in phar_make_dirstream() (CVE-2016-4343)\n- Fix bug #72241: get_icu_value_internal out-of-bounds read (CVE-2016-5093)\n- Fix bug #72135: Integer Overflow in php_html_entities() (CVE-2016-5094)\n- Fix bug #72114: Integer underflow / arbitrary null write in fread/gzread\n  (CVE-2016-5096)\n- Fix bug #72339: Integer Overflow in _gd2GetHeader() resulting in heap overflow\n  (CVE-2016-5766)\n- Fix bug #72340: Double Free Courruption in wddx_deserialize (CVE-2016-5772)\n- Fix bug #72613: Inadequate error handling in bzread() (CVE-2016-5399)\n- Fix bug #70480: php_url_parse_ex() buffer overflow read (CVE-2016-6288)\n- Fix bug #72513: Stack-based buffer overflow vulnerability in virtual_file_ex\n  (CVE-2016-6289)\n- Fix bug #72562: Use After Free in unserialize() with Unexpected Session\n  Deserialization (CVE-2016-6290)\n- Fix bug #72603: Out of bound read in exif_process_IFD_in_MAKERNOTE (CVE-2016-6291)\n- Fix bug #72533: locale_accept_from_http out-of-bounds access (CVE-2016-6294)\n- Fix bug #69975: PHP segfaults when accessing nvarchar(max) defined columns\n  (CVE-2015-8879)\n- Fix bug #72606: heap-buffer-overflow (write) simplestring_addn simplestring.c\n  (CVE-2016-6296)\n- Fix bug #72293: Heap overflow in mysqlnd related to BIT fields (CVE-2016-7412)\n- Fix bug #72860: wddx_deserialize use-after-free (CVE-2016-7413)\n- Fix bug #72928: Out of bound when verify signature of zip phar in phar_parse_zipfile\n  (CVE-2016-7414)\n- Fix bug #73007: SEH buffer overflow msgfmt_format_message (CVE-2016-7416)\n- Fix bug #73029: Missing type check when unserializing SplArray (CVE-2016-7417)\n- Fix bug #73065: Out-Of-Bounds Read in php_wddx_push_element of wddx.c (CVE-2016-7418)\n- Fix bug #73280: Stack Buffer Overflow in GD dynamicGetbuf (CVE-2016-8670)\n- Fix bug #73764: Crash while loading hostile phar archive (CVE-2016-10159)\n- Fix bug #73768: Memory corruption when loading hostile phar (CVE-2016-10160)\n- Fix bug #72627: Memory Leakage In exif_process_IFD_in_TIFF (CVE-2016-7128)\n- Fix bug #70350: ZipArchive::extractTo allows for directory traversal when\n  creating directories (CVE-2014-9767)\n- Fix bug #70081: SoapClient info leak / null pointer dereference via multiple\n  type confusions (CVE-2015-8835)\n- Fix bug #70121: unserialize() could lead to unexpected methods execution / NULL\n  pointer deref (CVE-2015-8876)\n- Fix bug #71906: AddressSanitizer: negative-size-param (-1) in mbfl_strcut\n  (CVE-2016-4073)\n- Fix bug #70014: openssl_random_pseudo_bytes() is not cryptographically secure\n  (CVE-2015-8867)\n- Fix bug #77371: heap buffer overflow in mb regex functions - compile_string_node\n  (CVE-2019-9023)\n- Fix bug #77381: heap buffer overflow in multibyte match_at (CVE-2019-9023)\n- Fix bug #77382: heap buffer overflow due to incorrect length in expand_case_fold_string\n  (CVE-2019-9023)\n- Fix bug #77385: buffer overflow in fetch_token (CVE-2019-9023)\n- Fix bug #77394: Buffer overflow in multibyte case folding - unicode (CVE-2019-9023)\n- Fix vulnerabilities with oniguruma: CVE-2017-9226, CVE-2017-9224, CVE-2017-9227,\n  CVE-2017-9228, CVE-2019-13224\n- Fix general vulneravilities: CVE-2014-9653, CVE-2015-0235, CVE-2015-3152,\n  CVE-2016-3074\n- Fix bug #79699: PHP parses encoded cookie names so malicious `__Host-` cookies\n  can be sent (CVE-2020-7070)\n- Fix bug #80007: Potential type confusion in unixtojd() parameter parsing","status":"published","published":"2020-10-15T12:00:00Z","modified":"2026-10-21T10:47:12.66349831Z","updated_at":"2026-11-02T15:43:39.801198Z"},{"id":"CLSA-2022-1643747494","title":"Fix of CVE: CVE-2020-7071, CVE-2020-7068, CVE-2020-7069, CVE-2020-7070, CVE-2021-21702","description":"\n- CVE-2020-7068: php: Use of freed hash key in the phar_parse_zipfile function\n- CVE-2020-7069: php: Wrong ciphertext/tag in AES-CCM encryption for a 12 bytes IV\n- CVE-2020-7070: php: URL decoding of cookie names can lead to different interpretation of cookies between browser and server\n- CVE-2020-7071: php: FILTER_VALIDATE_URL accepts URLs with invalid userinfo\n- CVE-2021-21702: php: NULL pointer dereference in SoapClient","status":"published","published":"2022-02-01T20:31:34Z","modified":"2026-10-21T10:47:07.602318461Z","updated_at":"2026-11-02T15:43:39.801198Z"},{"id":"DLA-2397-1","title":"php7.0 - security update","status":"published","published":"2020-10-06T00:00:00Z","modified":"2026-03-09T01:20:39.534255Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"DSA-4856-1","title":"php7.3 - security update","status":"published","published":"2021-02-17T00:00:00Z","modified":"2026-03-09T02:11:01.702115Z","updated_at":"2026-11-02T15:46:17.19998Z"},{"id":"MGASA-2020-0387","title":"Updated php packages fix a security vulnerability","description":"In PHP versions 7.2.x when PHP is processing incoming HTTP cookie values, the\ncookie names are url-decoded. This may lead to cookies with prefixes\nlike __Host confused with cookies that decode to such prefix, thus leading to\nan attacker being able to forge cookie which is supposed to be secure. \n(CVE-2020-7070)\n\nThese updated packages also fix several bugs:\nCore:\n- realpath() erroneously resolves link to link\n- Stack use-after-scope in define()\n- getimagesize function silently truncates after a null byte\n- Memleak when coercing integers to string via variadic argument\n\nFileinfo: finfo_file crash (FILEINFO_MIME)\n\nLDAP: Fixed memory leaks.\n\nOPCache: opcache.file_cache causes SIGSEGV when custom opcode handlers changed.\n\nStandard: Memory leak in str_replace of empty string\n","status":"published","published":"2020-10-16T17:04:43Z","modified":"2026-04-16T04:44:43.856890551Z","updated_at":"2026-11-02T15:49:41.509337Z"},{"id":"openSUSE-SU-2020:1703-1","title":"Security update for php7","description":"This update for php7 fixes the following issues:\n\n- CVE-2020-7069: Fixed an issue when AES-CCM mode was used with openssl_encrypt() function with 12 bytes IV, \n  only first 7 bytes of the IV was used (bsc#1177351). \n- CVE-2020-7070: Fixed an issue where percent-encoded cookies could have been used to overwrite existing prefixed cookie names (bsc#1177352).\n\nThis update was imported from the SUSE:SLE-15-SP2:Update update project.","status":"published","published":"2020-10-20T08:23:51Z","modified":"2026-02-04T02:35:55.286268Z","updated_at":"2026-11-02T16:58:31.517538Z"},{"id":"openSUSE-SU-2020:1767-1","title":"Security update for php7","description":"This update for php7 fixes the following issues:\n\n- CVE-2020-7069: Fixed an issue when AES-CCM mode was used with openssl_encrypt() function with 12 bytes IV,\n  only first 7 bytes of the IV was used (bsc#1177351).\n- CVE-2020-7070: Fixed an issue where percent-encoded cookies could have been used to overwrite existing prefixed cookie names (bsc#1177352). \n- Added tmpfiles.d for php-fpm to provide a base for a socket (bsc#1173786) \n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2020-10-29T17:23:59Z","modified":"2026-02-04T02:57:39.120888Z","updated_at":"2026-11-02T16:58:31.517538Z"},{"id":"SUSE-SU-2020:14516-1","title":"Security update for php53","description":"This update for php53 fixes the following issues:\n\n- CVE-2020-7070: Fixed an issue where percent-encoded cookies could have been used to overwrite existing prefixed cookie names (bsc#1177352).\n","status":"published","published":"2020-10-14T12:30:41Z","modified":"2025-05-02T04:10:20.787293Z","updated_at":"2026-11-02T15:53:47.634847Z"},{"id":"SUSE-SU-2020:2894-1","title":"Security update for php5","description":"This update for php5 fixes the following issues:\n\n- CVE-2020-7070: Fixed an issue where percent-encoded cookies could have been used to overwrite existing prefixed cookie names (bsc#1177352).\n","status":"published","published":"2020-10-12T15:07:54Z","modified":"2026-02-04T02:39:07.066323Z","updated_at":"2026-11-02T15:53:48.11786Z"},{"id":"SUSE-SU-2020:2896-1","title":"Security update for php74","description":"This update for php74 fixes the following issues:\n\n- CVE-2020-7069: Fixed an issue when AES-CCM mode was used with openssl_encrypt() function with 12 bytes IV,\n  only first 7 bytes of the IV was used (bsc#1177351).\n- CVE-2020-7070: Fixed an issue where percent-encoded cookies could have been used to overwrite existing prefixed cookie names (bsc#1177352). \n- Added tmpfiles.d for php-fpm to provide a base for a socket (bsc#1173786)\n","status":"published","published":"2020-10-13T11:05:56Z","modified":"2026-02-04T02:48:58.513219Z","updated_at":"2026-11-02T15:53:48.11786Z"},{"id":"SUSE-SU-2020:2920-1","title":"Security update for php7","description":"This update for php7 fixes the following issues:\n\n- CVE-2020-7070: Fixed an issue where percent-encoded cookies could have been used to overwrite existing prefixed cookie names (bsc#1177352).\t  \n- Added tmpfiles.d for php-fpm to provide a base for a socket (bsc#1173786) \n","status":"published","published":"2020-10-14T12:29:56Z","modified":"2026-02-04T02:47:04.40705Z","updated_at":"2026-11-02T15:53:48.11786Z"},{"id":"SUSE-SU-2020:2941-1","title":"Security update for php7","description":"This update for php7 fixes the following issues:\n\n- CVE-2020-7069: Fixed an issue when AES-CCM mode was used with openssl_encrypt() function with 12 bytes IV, \n  only first 7 bytes of the IV was used (bsc#1177351). \n- CVE-2020-7070: Fixed an issue where percent-encoded cookies could have been used to overwrite existing prefixed cookie names (bsc#1177352).\n","status":"published","published":"2020-10-16T07:42:09Z","modified":"2026-02-04T04:05:12.986082Z","updated_at":"2026-11-02T15:53:48.11786Z"},{"id":"SUSE-SU-2020:2943-1","title":"Security update for php72","description":"This update for php72 fixes the following issues:\n\n- CVE-2020-7069: Fixed an issue when AES-CCM mode was used with openssl_encrypt() function with 12 bytes IV,\n  only first 7 bytes of the IV was used (bsc#1177351).\n- CVE-2020-7070: Fixed an issue where percent-encoded cookies could have been used to overwrite existing prefixed cookie names (bsc#1177352).\t  \n- Added tmpfiles.d for php-fpm to provide a base for a socket (bsc#1173786) \n","status":"published","published":"2020-10-16T07:48:38Z","modified":"2026-02-04T04:37:29.412318Z","updated_at":"2026-11-02T15:53:48.11786Z"},{"id":"SUSE-SU-2020:2997-1","title":"Security update for php7","description":"This update for php7 fixes the following issues:\n\n- CVE-2020-7069: Fixed an issue when AES-CCM mode was used with openssl_encrypt() function with 12 bytes IV,\n  only first 7 bytes of the IV was used (bsc#1177351).\n- CVE-2020-7070: Fixed an issue where percent-encoded cookies could have been used to overwrite existing prefixed cookie names (bsc#1177352). \n- Added tmpfiles.d for php-fpm to provide a base for a socket (bsc#1173786) \n","status":"published","published":"2020-10-22T08:04:30Z","modified":"2026-02-04T03:12:59.657891Z","updated_at":"2026-11-02T15:53:48.11786Z"},{"id":"SUSE-SU-2022:4067-1","title":"Security update for php7","description":"This update for php7 fixes the following issues:\n\n- Version update to 7.2.34 [jsc#SLE-23639]\n\n- CVE-2022-37454: Fixed SHA-3 buffer overflow (bsc#1204577).\n- Fix integer overflow in PHP_SHA3##bits (bsc#1204577#c26).\n","status":"published","published":"2022-11-18T10:54:18Z","modified":"2026-02-04T04:35:00.387377Z","updated_at":"2026-11-02T15:53:51.440565Z"},{"id":"SUSE-SU-2022:4068-1","title":"Security update for php74","description":"This update for php74 fixes the following issues:\n\n- Version update to 7.4.33:\n- CVE-2022-31630: Fixed out-of-bounds read due to insufficient input validation in imageloadfont() (bsc#1204979).\n- CVE-2022-37454: Fixed buffer overflow in hash_update() on long parameter (bsc#1204577).\n\n- Version update to 7.4.32 (jsc#SLE-23639)\n- CVE-2022-31628: Fixed an uncontrolled recursion in the phar uncompressor while decompressing 'quines' gzip files. (bsc#1203867)\n- CVE-2022-31629: Fixed a bug which could lead an attacker to set an insecure cookie that will treated as secure in the victim's browser. (bsc#1203870)\n","status":"published","published":"2022-11-18T10:55:22Z","modified":"2026-02-04T02:31:07.533852Z","updated_at":"2026-11-02T15:53:51.440565Z"},{"id":"SUSE-SU-2022:4069-1","title":"Security update for php7","description":"This update for php7 fixes the following issues:\n\n- Version update to 7.4.33:\n- CVE-2022-31630: Fixed out-of-bounds read due to insufficient input validation in imageloadfont() (bsc#1204979).\n- CVE-2022-37454: Fixed buffer overflow in hash_update() on long parameter (bsc#1204577).\n\n- Version update to 7.4.32 (jsc#SLE-23639)\n- CVE-2022-31628: Fixed an uncontrolled recursion in the phar uncompressor while decompressing 'quines' gzip files. (bsc#1203867)\n- CVE-2022-31629: Fixed a bug which could lead an attacker to set an insecure cookie that will treated as secure in the victim's browser. (bsc#1203870)\n","status":"published","published":"2022-11-18T10:56:52Z","modified":"2026-02-04T02:13:47.996905Z","updated_at":"2026-11-02T15:53:51.440565Z"},{"id":"USN-4583-1","title":"php5, php7.0, php7.2, php7.4 vulnerabilities","description":"It was discovered that PHP incorrectly handled certain encrypt ciphers.\nAn attacker could possibly use this issue to decrease security or cause\nincorrect encryption data. This issue only affected Ubuntu 18.04 LTS and\nUbuntu 20.04 LTS.  (CVE-2020-7069)\n\nIt was discorevered that PHP incorrectly handled certain HTTP cookies.\nAn attacker could possibly use this issue to forge cookie which is supposed to\nbe secure. (CVE-2020-7070)\n","status":"published","published":"2020-10-14T17:42:17Z","modified":"2026-04-22T10:08:41.618089Z","updated_at":"2026-11-02T16:58:15.159055Z"}]}}