{"id":"USN-6305-3","aliases":[],"status":"published","title":"php7.0 and php7.2 regression","description":"USN-6305-2 fixed a vulnerability in PHP. The update caused a regression\nin Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. This update fix it.\n\nOriginal advisory details:\n\n It was discovered that PHP incorrectly handled certain XML files.\n An attacker could possibly use this issue to expose sensitive information.\n (CVE-2023-3823)\n\n It was discovered that PHP incorrectly handled certain PHAR files.\n An attacker could possibly use this issue to cause a crash,\n expose sensitive information or execute arbitrary code.\n (CVE-2023-3824)","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2024-07-03T20:42:18Z","modified":"2026-06-25T13:32:16Z","fixes":[{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"php7.0","fixed_in":["7.0.33-0ubuntu0.16.04.16+esm10"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"php7.2","fixed_in":["7.2.24-0ubuntu0.18.04.17+esm4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"php7.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.33-0ubuntu0.16.04.16+esm10"}]}],"versions":["7.0.1-5","7.0.1-6","7.0.2-1","7.0.2-3","7.0.2-4","7.0.2-5","7.0.3-2","7.0.3-3","7.0.3-9ubuntu1","7.0.4-5ubuntu1","7.0.4-5ubuntu2","7.0.4-7ubuntu1","7.0.4-7ubuntu2","7.0.4-7ubuntu2.1","7.0.8-0ubuntu0.16.04.1","7.0.8-0ubuntu0.16.04.2","7.0.8-0ubuntu0.16.04.3","7.0.13-0ubuntu0.16.04.1","7.0.15-0ubuntu0.16.04.1","7.0.15-0ubuntu0.16.04.2","7.0.15-0ubuntu0.16.04.4","7.0.18-0ubuntu0.16.04.1","7.0.22-0ubuntu0.16.04.1","7.0.25-0ubuntu0.16.04.1","7.0.28-0ubuntu0.16.04.1","7.0.30-0ubuntu0.16.04.1","7.0.32-0ubuntu0.16.04.1","7.0.33-0ubuntu0.16.04.1","7.0.33-0ubuntu0.16.04.2","7.0.33-0ubuntu0.16.04.3","7.0.33-0ubuntu0.16.04.4","7.0.33-0ubuntu0.16.04.5","7.0.33-0ubuntu0.16.04.6","7.0.33-0ubuntu0.16.04.7","7.0.33-0ubuntu0.16.04.9","7.0.33-0ubuntu0.16.04.11","7.0.33-0ubuntu0.16.04.12","7.0.33-0ubuntu0.16.04.14","7.0.33-0ubuntu0.16.04.15","7.0.33-0ubuntu0.16.04.16","7.0.33-0ubuntu0.16.04.16+esm1","7.0.33-0ubuntu0.16.04.16+esm2","7.0.33-0ubuntu0.16.04.16+esm3","7.0.33-0ubuntu0.16.04.16+esm4","7.0.33-0ubuntu0.16.04.16+esm5","7.0.33-0ubuntu0.16.04.16+esm6","7.0.33-0ubuntu0.16.04.16+esm7","7.0.33-0ubuntu0.16.04.16+esm8","7.0.33-0ubuntu0.16.04.16+esm9"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"php7.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.24-0ubuntu0.18.04.17+esm4"}]}],"versions":["7.2.1-1ubuntu2","7.2.2-1ubuntu1","7.2.2-1ubuntu2","7.2.3-1ubuntu1","7.2.5-0ubuntu0.18.04.1","7.2.7-0ubuntu0.18.04.1","7.2.7-0ubuntu0.18.04.2","7.2.10-0ubuntu0.18.04.1","7.2.15-0ubuntu0.18.04.1","7.2.15-0ubuntu0.18.04.2","7.2.17-0ubuntu0.18.04.1","7.2.19-0ubuntu0.18.04.1","7.2.19-0ubuntu0.18.04.2","7.2.24-0ubuntu0.18.04.1","7.2.24-0ubuntu0.18.04.2","7.2.24-0ubuntu0.18.04.3","7.2.24-0ubuntu0.18.04.4","7.2.24-0ubuntu0.18.04.6","7.2.24-0ubuntu0.18.04.7","7.2.24-0ubuntu0.18.04.8","7.2.24-0ubuntu0.18.04.9","7.2.24-0ubuntu0.18.04.10","7.2.24-0ubuntu0.18.04.11","7.2.24-0ubuntu0.18.04.12","7.2.24-0ubuntu0.18.04.13","7.2.24-0ubuntu0.18.04.15","7.2.24-0ubuntu0.18.04.16","7.2.24-0ubuntu0.18.04.17","7.2.24-0ubuntu0.18.04.17+esm1","7.2.24-0ubuntu0.18.04.17+esm2","7.2.24-0ubuntu0.18.04.17+esm3"]}],"references":[{"url":"https://ubuntu.com/security/notices/USN-6305-3","tags":["advisory"]},{"url":"https://launchpad.net/bugs/2071768","tags":["report"]}],"sources":{"osv":[{"id":"USN-6305-3","title":"php7.0 and php7.2 regression","description":"USN-6305-2 fixed a vulnerability in PHP. The update caused a regression\nin Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. This update fix it.\n\nOriginal advisory details:\n\n It was discovered that PHP incorrectly handled certain XML files.\n An attacker could possibly use this issue to expose sensitive information.\n (CVE-2023-3823)\n\n It was discovered that PHP incorrectly handled certain PHAR files.\n An attacker could possibly use this issue to cause a crash,\n expose sensitive information or execute arbitrary code.\n (CVE-2023-3824)\n","status":"published","published":"2024-07-03T20:42:18Z","modified":"2026-06-25T13:32:16.655003346Z","updated_at":"2026-11-02T16:58:17.305935Z"}]}}