SUSE update for php72
| Risk | Medium |
| Patch available | YES |
| Number of vulnerabilities | 2 |
| CVE-ID | CVE-2022-31628 CVE-2022-31629 |
| CWE-ID | CWE-835 CWE-254 |
| Exploitation vector | Network |
| Public exploit | Public exploit code for vulnerability #2 is available. |
| Vulnerable software |
SUSE Linux Enterprise Server for SAP Applications Operating systems & Components / Operating system SUSE Linux Enterprise High Performance Computing Operating systems & Components / Operating system SUSE Linux Enterprise Server Operating systems & Components / Operating system SUSE Linux Enterprise Module for Web Scripting Operating systems & Components / Operating system SUSE Linux Enterprise Software Development Kit Operating systems & Components / Operating system php72-pear-Archive_Tar Operating systems & Components / Operating system package or component php72-pear Operating systems & Components / Operating system package or component php72-zlib-debuginfo Operating systems & Components / Operating system package or component php72-zlib Operating systems & Components / Operating system package or component php72-zip-debuginfo Operating systems & Components / Operating system package or component php72-zip Operating systems & Components / Operating system package or component php72-xsl-debuginfo Operating systems & Components / Operating system package or component php72-xsl Operating systems & Components / Operating system package or component php72-xmlwriter-debuginfo Operating systems & Components / Operating system package or component php72-xmlwriter Operating systems & Components / Operating system package or component php72-xmlrpc-debuginfo Operating systems & Components / Operating system package or component php72-xmlrpc Operating systems & Components / Operating system package or component php72-xmlreader-debuginfo Operating systems & Components / Operating system package or component php72-xmlreader Operating systems & Components / Operating system package or component php72-wddx-debuginfo Operating systems & Components / Operating system package or component php72-wddx Operating systems & Components / Operating system package or component php72-tokenizer-debuginfo Operating systems & Components / Operating system package or component php72-tokenizer Operating systems & Components / Operating system package or component php72-tidy-debuginfo Operating systems & Components / Operating system package or component php72-tidy Operating systems & Components / Operating system package or component php72-sysvshm-debuginfo Operating systems & Components / Operating system package or component php72-sysvshm Operating systems & Components / Operating system package or component php72-sysvsem-debuginfo Operating systems & Components / Operating system package or component php72-sysvsem Operating systems & Components / Operating system package or component php72-sysvmsg-debuginfo Operating systems & Components / Operating system package or component php72-sysvmsg Operating systems & Components / Operating system package or component php72-sqlite-debuginfo Operating systems & Components / Operating system package or component php72-sqlite Operating systems & Components / Operating system package or component php72-sodium-debuginfo Operating systems & Components / Operating system package or component php72-sodium Operating systems & Components / Operating system package or component php72-sockets-debuginfo Operating systems & Components / Operating system package or component php72-sockets Operating systems & Components / Operating system package or component php72-soap-debuginfo Operating systems & Components / Operating system package or component php72-soap Operating systems & Components / Operating system package or component php72-snmp-debuginfo Operating systems & Components / Operating system package or component php72-snmp Operating systems & Components / Operating system package or component php72-shmop-debuginfo Operating systems & Components / Operating system package or component php72-shmop Operating systems & Components / Operating system package or component php72-readline-debuginfo Operating systems & Components / Operating system package or component php72-readline Operating systems & Components / Operating system package or component php72-pspell-debuginfo Operating systems & Components / Operating system package or component php72-pspell Operating systems & Components / Operating system package or component php72-posix-debuginfo Operating systems & Components / Operating system package or component php72-posix Operating systems & Components / Operating system package or component php72-phar-debuginfo Operating systems & Components / Operating system package or component php72-phar Operating systems & Components / Operating system package or component php72-pgsql-debuginfo Operating systems & Components / Operating system package or component php72-pgsql Operating systems & Components / Operating system package or component php72-pdo-debuginfo Operating systems & Components / Operating system package or component php72-pdo Operating systems & Components / Operating system package or component php72-pcntl-debuginfo Operating systems & Components / Operating system package or component php72-pcntl Operating systems & Components / Operating system package or component php72-openssl-debuginfo Operating systems & Components / Operating system package or component php72-openssl Operating systems & Components / Operating system package or component php72-opcache-debuginfo Operating systems & Components / Operating system package or component php72-opcache Operating systems & Components / Operating system package or component php72-odbc-debuginfo Operating systems & Components / Operating system package or component php72-odbc Operating systems & Components / Operating system package or component php72-mysql-debuginfo Operating systems & Components / Operating system package or component php72-mysql Operating systems & Components / Operating system package or component php72-mbstring-debuginfo Operating systems & Components / Operating system package or component php72-mbstring Operating systems & Components / Operating system package or component php72-ldap-debuginfo Operating systems & Components / Operating system package or component php72-ldap Operating systems & Components / Operating system package or component php72-json-debuginfo Operating systems & Components / Operating system package or component php72-json Operating systems & Components / Operating system package or component php72-intl-debuginfo Operating systems & Components / Operating system package or component php72-intl Operating systems & Components / Operating system package or component php72-imap-debuginfo Operating systems & Components / Operating system package or component php72-imap Operating systems & Components / Operating system package or component php72-iconv-debuginfo Operating systems & Components / Operating system package or component php72-iconv Operating systems & Components / Operating system package or component php72-gmp-debuginfo Operating systems & Components / Operating system package or component php72-gmp Operating systems & Components / Operating system package or component php72-gettext-debuginfo Operating systems & Components / Operating system package or component php72-gettext Operating systems & Components / Operating system package or component php72-gd-debuginfo Operating systems & Components / Operating system package or component php72-gd Operating systems & Components / Operating system package or component php72-ftp-debuginfo Operating systems & Components / Operating system package or component php72-ftp Operating systems & Components / Operating system package or component php72-fpm-debuginfo Operating systems & Components / Operating system package or component php72-fpm Operating systems & Components / Operating system package or component php72-fileinfo-debuginfo Operating systems & Components / Operating system package or component php72-fileinfo Operating systems & Components / Operating system package or component php72-fastcgi-debuginfo Operating systems & Components / Operating system package or component php72-fastcgi Operating systems & Components / Operating system package or component php72-exif-debuginfo Operating systems & Components / Operating system package or component php72-exif Operating systems & Components / Operating system package or component php72-enchant-debuginfo Operating systems & Components / Operating system package or component php72-enchant Operating systems & Components / Operating system package or component php72-dom-debuginfo Operating systems & Components / Operating system package or component php72-dom Operating systems & Components / Operating system package or component php72-dba-debuginfo Operating systems & Components / Operating system package or component php72-dba Operating systems & Components / Operating system package or component php72-curl-debuginfo Operating systems & Components / Operating system package or component php72-curl Operating systems & Components / Operating system package or component php72-ctype-debuginfo Operating systems & Components / Operating system package or component php72-ctype Operating systems & Components / Operating system package or component php72-calendar-debuginfo Operating systems & Components / Operating system package or component php72-calendar Operating systems & Components / Operating system package or component php72-bz2-debuginfo Operating systems & Components / Operating system package or component php72-bz2 Operating systems & Components / Operating system package or component php72-bcmath-debuginfo Operating systems & Components / Operating system package or component php72-bcmath Operating systems & Components / Operating system package or component php72 Operating systems & Components / Operating system package or component apache2-mod_php72-debuginfo Operating systems & Components / Operating system package or component apache2-mod_php72 Operating systems & Components / Operating system package or component php72-devel Operating systems & Components / Operating system package or component php72-debugsource Operating systems & Components / Operating system package or component php72-debuginfo Operating systems & Components / Operating system package or component |
| Vendor | SUSE |
Security Bulletin
This security bulletin contains information about 2 vulnerabilities.
1) Infinite loop
EUVDB-ID: #VU67755
Risk: Medium
CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2022-31628
CWE-ID:
CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to infinite loop within the phar uncompressor code when processing "quines" gzip files. A remote attacker can pass a specially crafted archive to the application, consume all available system resources and cause denial of service conditions.
MitigationUpdate the affected package php72 to the latest version.
Vulnerable software versionsSUSE Linux Enterprise Server for SAP Applications: 12-SP3 - 12-SP5
SUSE Linux Enterprise High Performance Computing: 12
SUSE Linux Enterprise Server: 12-SP2-LTSS-ERICSSON - 12-SP5
SUSE Linux Enterprise Module for Web Scripting: 12
SUSE Linux Enterprise Software Development Kit: 12-SP5
php72-pear-Archive_Tar: before 7.2.5-1.84.1
php72-pear: before 7.2.5-1.84.1
php72-zlib-debuginfo: before 7.2.5-1.84.1
php72-zlib: before 7.2.5-1.84.1
php72-zip-debuginfo: before 7.2.5-1.84.1
php72-zip: before 7.2.5-1.84.1
php72-xsl-debuginfo: before 7.2.5-1.84.1
php72-xsl: before 7.2.5-1.84.1
php72-xmlwriter-debuginfo: before 7.2.5-1.84.1
php72-xmlwriter: before 7.2.5-1.84.1
php72-xmlrpc-debuginfo: before 7.2.5-1.84.1
php72-xmlrpc: before 7.2.5-1.84.1
php72-xmlreader-debuginfo: before 7.2.5-1.84.1
php72-xmlreader: before 7.2.5-1.84.1
php72-wddx-debuginfo: before 7.2.5-1.84.1
php72-wddx: before 7.2.5-1.84.1
php72-tokenizer-debuginfo: before 7.2.5-1.84.1
php72-tokenizer: before 7.2.5-1.84.1
php72-tidy-debuginfo: before 7.2.5-1.84.1
php72-tidy: before 7.2.5-1.84.1
php72-sysvshm-debuginfo: before 7.2.5-1.84.1
php72-sysvshm: before 7.2.5-1.84.1
php72-sysvsem-debuginfo: before 7.2.5-1.84.1
php72-sysvsem: before 7.2.5-1.84.1
php72-sysvmsg-debuginfo: before 7.2.5-1.84.1
php72-sysvmsg: before 7.2.5-1.84.1
php72-sqlite-debuginfo: before 7.2.5-1.84.1
php72-sqlite: before 7.2.5-1.84.1
php72-sodium-debuginfo: before 7.2.5-1.84.1
php72-sodium: before 7.2.5-1.84.1
php72-sockets-debuginfo: before 7.2.5-1.84.1
php72-sockets: before 7.2.5-1.84.1
php72-soap-debuginfo: before 7.2.5-1.84.1
php72-soap: before 7.2.5-1.84.1
php72-snmp-debuginfo: before 7.2.5-1.84.1
php72-snmp: before 7.2.5-1.84.1
php72-shmop-debuginfo: before 7.2.5-1.84.1
php72-shmop: before 7.2.5-1.84.1
php72-readline-debuginfo: before 7.2.5-1.84.1
php72-readline: before 7.2.5-1.84.1
php72-pspell-debuginfo: before 7.2.5-1.84.1
php72-pspell: before 7.2.5-1.84.1
php72-posix-debuginfo: before 7.2.5-1.84.1
php72-posix: before 7.2.5-1.84.1
php72-phar-debuginfo: before 7.2.5-1.84.1
php72-phar: before 7.2.5-1.84.1
php72-pgsql-debuginfo: before 7.2.5-1.84.1
php72-pgsql: before 7.2.5-1.84.1
php72-pdo-debuginfo: before 7.2.5-1.84.1
php72-pdo: before 7.2.5-1.84.1
php72-pcntl-debuginfo: before 7.2.5-1.84.1
php72-pcntl: before 7.2.5-1.84.1
php72-openssl-debuginfo: before 7.2.5-1.84.1
php72-openssl: before 7.2.5-1.84.1
php72-opcache-debuginfo: before 7.2.5-1.84.1
php72-opcache: before 7.2.5-1.84.1
php72-odbc-debuginfo: before 7.2.5-1.84.1
php72-odbc: before 7.2.5-1.84.1
php72-mysql-debuginfo: before 7.2.5-1.84.1
php72-mysql: before 7.2.5-1.84.1
php72-mbstring-debuginfo: before 7.2.5-1.84.1
php72-mbstring: before 7.2.5-1.84.1
php72-ldap-debuginfo: before 7.2.5-1.84.1
php72-ldap: before 7.2.5-1.84.1
php72-json-debuginfo: before 7.2.5-1.84.1
php72-json: before 7.2.5-1.84.1
php72-intl-debuginfo: before 7.2.5-1.84.1
php72-intl: before 7.2.5-1.84.1
php72-imap-debuginfo: before 7.2.5-1.84.1
php72-imap: before 7.2.5-1.84.1
php72-iconv-debuginfo: before 7.2.5-1.84.1
php72-iconv: before 7.2.5-1.84.1
php72-gmp-debuginfo: before 7.2.5-1.84.1
php72-gmp: before 7.2.5-1.84.1
php72-gettext-debuginfo: before 7.2.5-1.84.1
php72-gettext: before 7.2.5-1.84.1
php72-gd-debuginfo: before 7.2.5-1.84.1
php72-gd: before 7.2.5-1.84.1
php72-ftp-debuginfo: before 7.2.5-1.84.1
php72-ftp: before 7.2.5-1.84.1
php72-fpm-debuginfo: before 7.2.5-1.84.1
php72-fpm: before 7.2.5-1.84.1
php72-fileinfo-debuginfo: before 7.2.5-1.84.1
php72-fileinfo: before 7.2.5-1.84.1
php72-fastcgi-debuginfo: before 7.2.5-1.84.1
php72-fastcgi: before 7.2.5-1.84.1
php72-exif-debuginfo: before 7.2.5-1.84.1
php72-exif: before 7.2.5-1.84.1
php72-enchant-debuginfo: before 7.2.5-1.84.1
php72-enchant: before 7.2.5-1.84.1
php72-dom-debuginfo: before 7.2.5-1.84.1
php72-dom: before 7.2.5-1.84.1
php72-dba-debuginfo: before 7.2.5-1.84.1
php72-dba: before 7.2.5-1.84.1
php72-curl-debuginfo: before 7.2.5-1.84.1
php72-curl: before 7.2.5-1.84.1
php72-ctype-debuginfo: before 7.2.5-1.84.1
php72-ctype: before 7.2.5-1.84.1
php72-calendar-debuginfo: before 7.2.5-1.84.1
php72-calendar: before 7.2.5-1.84.1
php72-bz2-debuginfo: before 7.2.5-1.84.1
php72-bz2: before 7.2.5-1.84.1
php72-bcmath-debuginfo: before 7.2.5-1.84.1
php72-bcmath: before 7.2.5-1.84.1
php72: before 7.2.5-1.84.1
apache2-mod_php72-debuginfo: before 7.2.5-1.84.1
apache2-mod_php72: before 7.2.5-1.84.1
php72-devel: before 7.2.5-1.84.1
php72-debugsource: before 7.2.5-1.84.1
php72-debuginfo: before 7.2.5-1.84.1
CPE2.3- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications:12-SP3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications:12-SP4:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications:12-SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing:12:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server:12-SP2-LTSS-ERICSSON:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server:12-SP3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server:12-SP4:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_module_for_web_scripting:12:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_software_development_kit:12-SP5:*:*:*:*:*:*:*
- cpe:2.3:a:suse:php72-pear-archive_tar:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-pear:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-zlib-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-zlib:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-zip-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-zip:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-xsl-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-xsl:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-xmlwriter-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-xmlwriter:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-xmlrpc-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-xmlrpc:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-xmlreader-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-xmlreader:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-wddx-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-wddx:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-tokenizer-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-tokenizer:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-tidy-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-tidy:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-sysvshm-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-sysvshm:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-sysvsem-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-sysvsem:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-sysvmsg-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-sysvmsg:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-sqlite-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-sqlite:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-sodium-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-sodium:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-sockets-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-sockets:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-soap-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-soap:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-snmp-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-snmp:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-shmop-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-shmop:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-readline-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-readline:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-pspell-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-pspell:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-posix-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-posix:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-phar-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-phar:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-pgsql-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-pgsql:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-pdo-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-pdo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-pcntl-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-pcntl:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-openssl-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-openssl:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-opcache-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-opcache:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-odbc-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-odbc:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-mysql-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-mysql:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-mbstring-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-mbstring:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-ldap-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-ldap:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-json-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-json:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-intl-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-intl:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-imap-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-imap:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-iconv-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-iconv:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-gmp-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-gmp:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-gettext-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-gettext:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-gd-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-gd:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-ftp-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-ftp:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-fpm-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-fpm:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-fileinfo-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-fileinfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-fastcgi-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-fastcgi:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-exif-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-exif:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-enchant-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-enchant:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-dom-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-dom:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-dba-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-dba:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-curl-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-curl:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-ctype-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-ctype:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-calendar-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-calendar:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-bz2-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-bz2:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-bcmath-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-bcmath:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:apache2-mod_php72-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:apache2-mod_php72:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-debugsource:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-debuginfo:*:*:*:*:*:suse_linux:*:*
https://www.suse.com/support/update/announcement/2022/suse-su-20223957-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) Security features bypass
EUVDB-ID: #VU67756
Risk: Low
CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/U:Clear]
CVE-ID: CVE-2022-31629
CWE-ID:
CWE-254 - Security Features
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to bypass implemented security restrictions.
The vulnerability exists due to the way PHP handles HTTP variable names. A remote attacker can set a standard insecure cookie in the victim's browser which is treated as a `__Host-` or `__Secure-` cookie by PHP applications.
MitigationUpdate the affected package php72 to the latest version.
Vulnerable software versionsSUSE Linux Enterprise Server for SAP Applications: 12-SP3 - 12-SP5
SUSE Linux Enterprise High Performance Computing: 12
SUSE Linux Enterprise Server: 12-SP2-LTSS-ERICSSON - 12-SP5
SUSE Linux Enterprise Module for Web Scripting: 12
SUSE Linux Enterprise Software Development Kit: 12-SP5
php72-pear-Archive_Tar: before 7.2.5-1.84.1
php72-pear: before 7.2.5-1.84.1
php72-zlib-debuginfo: before 7.2.5-1.84.1
php72-zlib: before 7.2.5-1.84.1
php72-zip-debuginfo: before 7.2.5-1.84.1
php72-zip: before 7.2.5-1.84.1
php72-xsl-debuginfo: before 7.2.5-1.84.1
php72-xsl: before 7.2.5-1.84.1
php72-xmlwriter-debuginfo: before 7.2.5-1.84.1
php72-xmlwriter: before 7.2.5-1.84.1
php72-xmlrpc-debuginfo: before 7.2.5-1.84.1
php72-xmlrpc: before 7.2.5-1.84.1
php72-xmlreader-debuginfo: before 7.2.5-1.84.1
php72-xmlreader: before 7.2.5-1.84.1
php72-wddx-debuginfo: before 7.2.5-1.84.1
php72-wddx: before 7.2.5-1.84.1
php72-tokenizer-debuginfo: before 7.2.5-1.84.1
php72-tokenizer: before 7.2.5-1.84.1
php72-tidy-debuginfo: before 7.2.5-1.84.1
php72-tidy: before 7.2.5-1.84.1
php72-sysvshm-debuginfo: before 7.2.5-1.84.1
php72-sysvshm: before 7.2.5-1.84.1
php72-sysvsem-debuginfo: before 7.2.5-1.84.1
php72-sysvsem: before 7.2.5-1.84.1
php72-sysvmsg-debuginfo: before 7.2.5-1.84.1
php72-sysvmsg: before 7.2.5-1.84.1
php72-sqlite-debuginfo: before 7.2.5-1.84.1
php72-sqlite: before 7.2.5-1.84.1
php72-sodium-debuginfo: before 7.2.5-1.84.1
php72-sodium: before 7.2.5-1.84.1
php72-sockets-debuginfo: before 7.2.5-1.84.1
php72-sockets: before 7.2.5-1.84.1
php72-soap-debuginfo: before 7.2.5-1.84.1
php72-soap: before 7.2.5-1.84.1
php72-snmp-debuginfo: before 7.2.5-1.84.1
php72-snmp: before 7.2.5-1.84.1
php72-shmop-debuginfo: before 7.2.5-1.84.1
php72-shmop: before 7.2.5-1.84.1
php72-readline-debuginfo: before 7.2.5-1.84.1
php72-readline: before 7.2.5-1.84.1
php72-pspell-debuginfo: before 7.2.5-1.84.1
php72-pspell: before 7.2.5-1.84.1
php72-posix-debuginfo: before 7.2.5-1.84.1
php72-posix: before 7.2.5-1.84.1
php72-phar-debuginfo: before 7.2.5-1.84.1
php72-phar: before 7.2.5-1.84.1
php72-pgsql-debuginfo: before 7.2.5-1.84.1
php72-pgsql: before 7.2.5-1.84.1
php72-pdo-debuginfo: before 7.2.5-1.84.1
php72-pdo: before 7.2.5-1.84.1
php72-pcntl-debuginfo: before 7.2.5-1.84.1
php72-pcntl: before 7.2.5-1.84.1
php72-openssl-debuginfo: before 7.2.5-1.84.1
php72-openssl: before 7.2.5-1.84.1
php72-opcache-debuginfo: before 7.2.5-1.84.1
php72-opcache: before 7.2.5-1.84.1
php72-odbc-debuginfo: before 7.2.5-1.84.1
php72-odbc: before 7.2.5-1.84.1
php72-mysql-debuginfo: before 7.2.5-1.84.1
php72-mysql: before 7.2.5-1.84.1
php72-mbstring-debuginfo: before 7.2.5-1.84.1
php72-mbstring: before 7.2.5-1.84.1
php72-ldap-debuginfo: before 7.2.5-1.84.1
php72-ldap: before 7.2.5-1.84.1
php72-json-debuginfo: before 7.2.5-1.84.1
php72-json: before 7.2.5-1.84.1
php72-intl-debuginfo: before 7.2.5-1.84.1
php72-intl: before 7.2.5-1.84.1
php72-imap-debuginfo: before 7.2.5-1.84.1
php72-imap: before 7.2.5-1.84.1
php72-iconv-debuginfo: before 7.2.5-1.84.1
php72-iconv: before 7.2.5-1.84.1
php72-gmp-debuginfo: before 7.2.5-1.84.1
php72-gmp: before 7.2.5-1.84.1
php72-gettext-debuginfo: before 7.2.5-1.84.1
php72-gettext: before 7.2.5-1.84.1
php72-gd-debuginfo: before 7.2.5-1.84.1
php72-gd: before 7.2.5-1.84.1
php72-ftp-debuginfo: before 7.2.5-1.84.1
php72-ftp: before 7.2.5-1.84.1
php72-fpm-debuginfo: before 7.2.5-1.84.1
php72-fpm: before 7.2.5-1.84.1
php72-fileinfo-debuginfo: before 7.2.5-1.84.1
php72-fileinfo: before 7.2.5-1.84.1
php72-fastcgi-debuginfo: before 7.2.5-1.84.1
php72-fastcgi: before 7.2.5-1.84.1
php72-exif-debuginfo: before 7.2.5-1.84.1
php72-exif: before 7.2.5-1.84.1
php72-enchant-debuginfo: before 7.2.5-1.84.1
php72-enchant: before 7.2.5-1.84.1
php72-dom-debuginfo: before 7.2.5-1.84.1
php72-dom: before 7.2.5-1.84.1
php72-dba-debuginfo: before 7.2.5-1.84.1
php72-dba: before 7.2.5-1.84.1
php72-curl-debuginfo: before 7.2.5-1.84.1
php72-curl: before 7.2.5-1.84.1
php72-ctype-debuginfo: before 7.2.5-1.84.1
php72-ctype: before 7.2.5-1.84.1
php72-calendar-debuginfo: before 7.2.5-1.84.1
php72-calendar: before 7.2.5-1.84.1
php72-bz2-debuginfo: before 7.2.5-1.84.1
php72-bz2: before 7.2.5-1.84.1
php72-bcmath-debuginfo: before 7.2.5-1.84.1
php72-bcmath: before 7.2.5-1.84.1
php72: before 7.2.5-1.84.1
apache2-mod_php72-debuginfo: before 7.2.5-1.84.1
apache2-mod_php72: before 7.2.5-1.84.1
php72-devel: before 7.2.5-1.84.1
php72-debugsource: before 7.2.5-1.84.1
php72-debuginfo: before 7.2.5-1.84.1
CPE2.3- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications:12-SP3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications:12-SP4:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications:12-SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing:12:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server:12-SP2-LTSS-ERICSSON:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server:12-SP3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server:12-SP4:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_module_for_web_scripting:12:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_software_development_kit:12-SP5:*:*:*:*:*:*:*
- cpe:2.3:a:suse:php72-pear-archive_tar:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-pear:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-zlib-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-zlib:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-zip-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-zip:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-xsl-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-xsl:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-xmlwriter-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-xmlwriter:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-xmlrpc-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-xmlrpc:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-xmlreader-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-xmlreader:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-wddx-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-wddx:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-tokenizer-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-tokenizer:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-tidy-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-tidy:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-sysvshm-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-sysvshm:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-sysvsem-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-sysvsem:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-sysvmsg-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-sysvmsg:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-sqlite-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-sqlite:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-sodium-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-sodium:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-sockets-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-sockets:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-soap-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-soap:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-snmp-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-snmp:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-shmop-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-shmop:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-readline-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-readline:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-pspell-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-pspell:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-posix-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-posix:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-phar-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-phar:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-pgsql-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-pgsql:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-pdo-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-pdo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-pcntl-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-pcntl:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-openssl-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-openssl:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-opcache-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-opcache:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-odbc-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-odbc:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-mysql-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-mysql:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-mbstring-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-mbstring:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-ldap-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-ldap:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-json-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-json:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-intl-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-intl:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-imap-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-imap:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-iconv-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-iconv:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-gmp-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-gmp:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-gettext-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-gettext:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-gd-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-gd:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-ftp-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-ftp:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-fpm-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-fpm:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-fileinfo-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-fileinfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-fastcgi-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-fastcgi:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-exif-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-exif:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-enchant-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-enchant:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-dom-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-dom:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-dba-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-dba:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-curl-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-curl:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-ctype-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-ctype:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-calendar-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-calendar:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-bz2-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-bz2:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-bcmath-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-bcmath:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:apache2-mod_php72-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:apache2-mod_php72:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-debugsource:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:php72-debuginfo:*:*:*:*:*:suse_linux:*:*
https://www.suse.com/support/update/announcement/2022/suse-su-20223957-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.
