SUSE update for php74

1) Improper input validation

EUVDB-ID: #VU10335

Risk: Low

CVSSv4.0: 4.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2017-8923

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform denial of service (DoS) attack.

The vulnerability exists due to insufficient input validation in zend_string_extend() function in Zend/zend_string.h when leveraging a script's use of ".=" with a long. The application does not prevent changes to string objects that can result in a negative length. A remote attacker can pass an overly long string to script, which uses ".=" operand on the supplied data and trigger application crash.

Mitigation

Update the affected package php74 to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Server for SAP Applications: 12-SP3 - 12-SP5

SUSE Linux Enterprise High Performance Computing: 12

SUSE Linux Enterprise Server: 12-SP2-LTSS-ERICSSON - 12-SP5

SUSE Linux Enterprise Module for Web Scripting: 12

SUSE Linux Enterprise Software Development Kit: 12-SP5

php74-zlib-debuginfo: before 7.4.33-1.47.2

php74-zlib: before 7.4.33-1.47.2

php74-zip-debuginfo: before 7.4.33-1.47.2

php74-zip: before 7.4.33-1.47.2

php74-xsl-debuginfo: before 7.4.33-1.47.2

php74-xsl: before 7.4.33-1.47.2

php74-xmlwriter-debuginfo: before 7.4.33-1.47.2

php74-xmlwriter: before 7.4.33-1.47.2

php74-xmlrpc-debuginfo: before 7.4.33-1.47.2

php74-xmlrpc: before 7.4.33-1.47.2

php74-xmlreader-debuginfo: before 7.4.33-1.47.2

php74-xmlreader: before 7.4.33-1.47.2

php74-tokenizer-debuginfo: before 7.4.33-1.47.2

php74-tokenizer: before 7.4.33-1.47.2

php74-tidy-debuginfo: before 7.4.33-1.47.2

php74-tidy: before 7.4.33-1.47.2

php74-sysvshm-debuginfo: before 7.4.33-1.47.2

php74-sysvshm: before 7.4.33-1.47.2

php74-sysvsem-debuginfo: before 7.4.33-1.47.2

php74-sysvsem: before 7.4.33-1.47.2

php74-sysvmsg-debuginfo: before 7.4.33-1.47.2

php74-sysvmsg: before 7.4.33-1.47.2

php74-sqlite-debuginfo: before 7.4.33-1.47.2

php74-sqlite: before 7.4.33-1.47.2

php74-sodium-debuginfo: before 7.4.33-1.47.2

php74-sodium: before 7.4.33-1.47.2

php74-sockets-debuginfo: before 7.4.33-1.47.2

php74-sockets: before 7.4.33-1.47.2

php74-soap-debuginfo: before 7.4.33-1.47.2

php74-soap: before 7.4.33-1.47.2

php74-snmp-debuginfo: before 7.4.33-1.47.2

php74-snmp: before 7.4.33-1.47.2

php74-shmop-debuginfo: before 7.4.33-1.47.2

php74-shmop: before 7.4.33-1.47.2

php74-readline-debuginfo: before 7.4.33-1.47.2

php74-readline: before 7.4.33-1.47.2

php74-posix-debuginfo: before 7.4.33-1.47.2

php74-posix: before 7.4.33-1.47.2

php74-phar-debuginfo: before 7.4.33-1.47.2

php74-phar: before 7.4.33-1.47.2

php74-pgsql-debuginfo: before 7.4.33-1.47.2

php74-pgsql: before 7.4.33-1.47.2

php74-pdo-debuginfo: before 7.4.33-1.47.2

php74-pdo: before 7.4.33-1.47.2

php74-pcntl-debuginfo: before 7.4.33-1.47.2

php74-pcntl: before 7.4.33-1.47.2

php74-openssl-debuginfo: before 7.4.33-1.47.2

php74-openssl: before 7.4.33-1.47.2

php74-opcache-debuginfo: before 7.4.33-1.47.2

php74-opcache: before 7.4.33-1.47.2

php74-odbc-debuginfo: before 7.4.33-1.47.2

php74-odbc: before 7.4.33-1.47.2

php74-mysql-debuginfo: before 7.4.33-1.47.2

php74-mysql: before 7.4.33-1.47.2

php74-mbstring-debuginfo: before 7.4.33-1.47.2

php74-mbstring: before 7.4.33-1.47.2

php74-ldap-debuginfo: before 7.4.33-1.47.2

php74-ldap: before 7.4.33-1.47.2

php74-json-debuginfo: before 7.4.33-1.47.2

php74-json: before 7.4.33-1.47.2

php74-intl-debuginfo: before 7.4.33-1.47.2

php74-intl: before 7.4.33-1.47.2

php74-iconv-debuginfo: before 7.4.33-1.47.2

php74-iconv: before 7.4.33-1.47.2

php74-gmp-debuginfo: before 7.4.33-1.47.2

php74-gmp: before 7.4.33-1.47.2

php74-gettext-debuginfo: before 7.4.33-1.47.2

php74-gettext: before 7.4.33-1.47.2

php74-gd-debuginfo: before 7.4.33-1.47.2

php74-gd: before 7.4.33-1.47.2

php74-ftp-debuginfo: before 7.4.33-1.47.2

php74-ftp: before 7.4.33-1.47.2

php74-fpm-debuginfo: before 7.4.33-1.47.2

php74-fpm: before 7.4.33-1.47.2

php74-fileinfo-debuginfo: before 7.4.33-1.47.2

php74-fileinfo: before 7.4.33-1.47.2

php74-fastcgi-debuginfo: before 7.4.33-1.47.2

php74-fastcgi: before 7.4.33-1.47.2

php74-exif-debuginfo: before 7.4.33-1.47.2

php74-exif: before 7.4.33-1.47.2

php74-enchant-debuginfo: before 7.4.33-1.47.2

php74-enchant: before 7.4.33-1.47.2

php74-dom-debuginfo: before 7.4.33-1.47.2

php74-dom: before 7.4.33-1.47.2

php74-dba-debuginfo: before 7.4.33-1.47.2

php74-dba: before 7.4.33-1.47.2

php74-curl-debuginfo: before 7.4.33-1.47.2

php74-curl: before 7.4.33-1.47.2

php74-ctype-debuginfo: before 7.4.33-1.47.2

php74-ctype: before 7.4.33-1.47.2

php74-calendar-debuginfo: before 7.4.33-1.47.2

php74-calendar: before 7.4.33-1.47.2

php74-bz2-debuginfo: before 7.4.33-1.47.2

php74-bz2: before 7.4.33-1.47.2

php74-bcmath-debuginfo: before 7.4.33-1.47.2

php74-bcmath: before 7.4.33-1.47.2

php74: before 7.4.33-1.47.2

apache2-mod_php74-debuginfo: before 7.4.33-1.47.2

apache2-mod_php74: before 7.4.33-1.47.2

php74-devel: before 7.4.33-1.47.2

php74-debugsource: before 7.4.33-1.47.2

php74-debuginfo: before 7.4.33-1.47.2

CPE2.3

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications:12-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications:12-SP4:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications:12-SP5:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing:12:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server:12-SP2-LTSS-ERICSSON:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server:12-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server:12-SP4:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_module_for_web_scripting:12:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_software_development_kit:12-SP5:*:*:*:*:*:*:*
• cpe:2.3:a:suse:php74-zlib-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-zlib:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-zip-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-zip:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xsl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xsl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xmlwriter-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xmlwriter:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xmlrpc-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xmlrpc:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xmlreader-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xmlreader:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-tokenizer-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-tokenizer:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-tidy-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-tidy:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sysvshm-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sysvshm:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sysvsem-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sysvsem:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sysvmsg-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sysvmsg:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sqlite-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sqlite:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sodium-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sodium:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sockets-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sockets:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-soap-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-soap:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-snmp-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-snmp:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-shmop-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-shmop:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-readline-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-readline:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-posix-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-posix:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-phar-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-phar:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-pgsql-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-pgsql:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-pdo-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-pdo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-pcntl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-pcntl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-openssl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-openssl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-opcache-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-opcache:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-odbc-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-odbc:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-mysql-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-mysql:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-mbstring-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-mbstring:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-ldap-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-ldap:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-json-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-json:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-intl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-intl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-iconv-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-iconv:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-gmp-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-gmp:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-gettext-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-gettext:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-gd-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-gd:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-ftp-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-ftp:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-fpm-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-fpm:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-fileinfo-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-fileinfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-fastcgi-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-fastcgi:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-exif-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-exif:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-enchant-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-enchant:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-dom-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-dom:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-dba-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-dba:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-curl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-curl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-ctype-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-ctype:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-calendar-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-calendar:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-bz2-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-bz2:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-bcmath-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-bcmath:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:apache2-mod_php74-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:apache2-mod_php74:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-devel:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-debugsource:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-debuginfo:*:*:*:*:*:suse_linux:*:*

External links

https://www.suse.com/support/update/announcement/2022/suse-su-20224068-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Use-after-free

EUVDB-ID: #VU34121

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2020-7068

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error in the "phar_parse_zipfile" function. A remote attacker can can cause a denial of service (DoS) condition on the target system.

Mitigation

Update the affected package php74 to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Server for SAP Applications: 12-SP3 - 12-SP5

SUSE Linux Enterprise High Performance Computing: 12

SUSE Linux Enterprise Server: 12-SP2-LTSS-ERICSSON - 12-SP5

SUSE Linux Enterprise Module for Web Scripting: 12

SUSE Linux Enterprise Software Development Kit: 12-SP5

php74-zlib-debuginfo: before 7.4.33-1.47.2

php74-zlib: before 7.4.33-1.47.2

php74-zip-debuginfo: before 7.4.33-1.47.2

php74-zip: before 7.4.33-1.47.2

php74-xsl-debuginfo: before 7.4.33-1.47.2

php74-xsl: before 7.4.33-1.47.2

php74-xmlwriter-debuginfo: before 7.4.33-1.47.2

php74-xmlwriter: before 7.4.33-1.47.2

php74-xmlrpc-debuginfo: before 7.4.33-1.47.2

php74-xmlrpc: before 7.4.33-1.47.2

php74-xmlreader-debuginfo: before 7.4.33-1.47.2

php74-xmlreader: before 7.4.33-1.47.2

php74-tokenizer-debuginfo: before 7.4.33-1.47.2

php74-tokenizer: before 7.4.33-1.47.2

php74-tidy-debuginfo: before 7.4.33-1.47.2

php74-tidy: before 7.4.33-1.47.2

php74-sysvshm-debuginfo: before 7.4.33-1.47.2

php74-sysvshm: before 7.4.33-1.47.2

php74-sysvsem-debuginfo: before 7.4.33-1.47.2

php74-sysvsem: before 7.4.33-1.47.2

php74-sysvmsg-debuginfo: before 7.4.33-1.47.2

php74-sysvmsg: before 7.4.33-1.47.2

php74-sqlite-debuginfo: before 7.4.33-1.47.2

php74-sqlite: before 7.4.33-1.47.2

php74-sodium-debuginfo: before 7.4.33-1.47.2

php74-sodium: before 7.4.33-1.47.2

php74-sockets-debuginfo: before 7.4.33-1.47.2

php74-sockets: before 7.4.33-1.47.2

php74-soap-debuginfo: before 7.4.33-1.47.2

php74-soap: before 7.4.33-1.47.2

php74-snmp-debuginfo: before 7.4.33-1.47.2

php74-snmp: before 7.4.33-1.47.2

php74-shmop-debuginfo: before 7.4.33-1.47.2

php74-shmop: before 7.4.33-1.47.2

php74-readline-debuginfo: before 7.4.33-1.47.2

php74-readline: before 7.4.33-1.47.2

php74-posix-debuginfo: before 7.4.33-1.47.2

php74-posix: before 7.4.33-1.47.2

php74-phar-debuginfo: before 7.4.33-1.47.2

php74-phar: before 7.4.33-1.47.2

php74-pgsql-debuginfo: before 7.4.33-1.47.2

php74-pgsql: before 7.4.33-1.47.2

php74-pdo-debuginfo: before 7.4.33-1.47.2

php74-pdo: before 7.4.33-1.47.2

php74-pcntl-debuginfo: before 7.4.33-1.47.2

php74-pcntl: before 7.4.33-1.47.2

php74-openssl-debuginfo: before 7.4.33-1.47.2

php74-openssl: before 7.4.33-1.47.2

php74-opcache-debuginfo: before 7.4.33-1.47.2

php74-opcache: before 7.4.33-1.47.2

php74-odbc-debuginfo: before 7.4.33-1.47.2

php74-odbc: before 7.4.33-1.47.2

php74-mysql-debuginfo: before 7.4.33-1.47.2

php74-mysql: before 7.4.33-1.47.2

php74-mbstring-debuginfo: before 7.4.33-1.47.2

php74-mbstring: before 7.4.33-1.47.2

php74-ldap-debuginfo: before 7.4.33-1.47.2

php74-ldap: before 7.4.33-1.47.2

php74-json-debuginfo: before 7.4.33-1.47.2

php74-json: before 7.4.33-1.47.2

php74-intl-debuginfo: before 7.4.33-1.47.2

php74-intl: before 7.4.33-1.47.2

php74-iconv-debuginfo: before 7.4.33-1.47.2

php74-iconv: before 7.4.33-1.47.2

php74-gmp-debuginfo: before 7.4.33-1.47.2

php74-gmp: before 7.4.33-1.47.2

php74-gettext-debuginfo: before 7.4.33-1.47.2

php74-gettext: before 7.4.33-1.47.2

php74-gd-debuginfo: before 7.4.33-1.47.2

php74-gd: before 7.4.33-1.47.2

php74-ftp-debuginfo: before 7.4.33-1.47.2

php74-ftp: before 7.4.33-1.47.2

php74-fpm-debuginfo: before 7.4.33-1.47.2

php74-fpm: before 7.4.33-1.47.2

php74-fileinfo-debuginfo: before 7.4.33-1.47.2

php74-fileinfo: before 7.4.33-1.47.2

php74-fastcgi-debuginfo: before 7.4.33-1.47.2

php74-fastcgi: before 7.4.33-1.47.2

php74-exif-debuginfo: before 7.4.33-1.47.2

php74-exif: before 7.4.33-1.47.2

php74-enchant-debuginfo: before 7.4.33-1.47.2

php74-enchant: before 7.4.33-1.47.2

php74-dom-debuginfo: before 7.4.33-1.47.2

php74-dom: before 7.4.33-1.47.2

php74-dba-debuginfo: before 7.4.33-1.47.2

php74-dba: before 7.4.33-1.47.2

php74-curl-debuginfo: before 7.4.33-1.47.2

php74-curl: before 7.4.33-1.47.2

php74-ctype-debuginfo: before 7.4.33-1.47.2

php74-ctype: before 7.4.33-1.47.2

php74-calendar-debuginfo: before 7.4.33-1.47.2

php74-calendar: before 7.4.33-1.47.2

php74-bz2-debuginfo: before 7.4.33-1.47.2

php74-bz2: before 7.4.33-1.47.2

php74-bcmath-debuginfo: before 7.4.33-1.47.2

php74-bcmath: before 7.4.33-1.47.2

php74: before 7.4.33-1.47.2

apache2-mod_php74-debuginfo: before 7.4.33-1.47.2

apache2-mod_php74: before 7.4.33-1.47.2

php74-devel: before 7.4.33-1.47.2

php74-debugsource: before 7.4.33-1.47.2

php74-debuginfo: before 7.4.33-1.47.2

CPE2.3

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications:12-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications:12-SP4:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications:12-SP5:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing:12:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server:12-SP2-LTSS-ERICSSON:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server:12-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server:12-SP4:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_module_for_web_scripting:12:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_software_development_kit:12-SP5:*:*:*:*:*:*:*
• cpe:2.3:a:suse:php74-zlib-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-zlib:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-zip-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-zip:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xsl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xsl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xmlwriter-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xmlwriter:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xmlrpc-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xmlrpc:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xmlreader-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xmlreader:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-tokenizer-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-tokenizer:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-tidy-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-tidy:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sysvshm-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sysvshm:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sysvsem-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sysvsem:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sysvmsg-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sysvmsg:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sqlite-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sqlite:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sodium-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sodium:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sockets-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sockets:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-soap-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-soap:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-snmp-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-snmp:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-shmop-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-shmop:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-readline-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-readline:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-posix-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-posix:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-phar-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-phar:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-pgsql-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-pgsql:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-pdo-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-pdo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-pcntl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-pcntl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-openssl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-openssl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-opcache-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-opcache:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-odbc-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-odbc:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-mysql-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-mysql:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-mbstring-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-mbstring:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-ldap-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-ldap:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-json-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-json:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-intl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-intl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-iconv-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-iconv:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-gmp-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-gmp:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-gettext-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-gettext:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-gd-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-gd:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-ftp-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-ftp:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-fpm-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-fpm:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-fileinfo-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-fileinfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-fastcgi-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-fastcgi:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-exif-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-exif:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-enchant-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-enchant:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-dom-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-dom:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-dba-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-dba:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-curl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-curl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-ctype-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-ctype:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-calendar-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-calendar:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-bz2-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-bz2:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-bcmath-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-bcmath:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:apache2-mod_php74-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:apache2-mod_php74:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-devel:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-debugsource:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-debuginfo:*:*:*:*:*:suse_linux:*:*

External links

https://www.suse.com/support/update/announcement/2022/suse-su-20224068-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Cryptographic issues

EUVDB-ID: #VU47253

Risk: Low

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-7069

CWE-ID: CWE-310 - Cryptographic Issues

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to the openssl_encrypt() function generates a wrong ciphertext and a wrong tag for AES-CCM for a 12 bytes IV. As a result, a 7-byte nonce is used instead of 12 bytes. A remote attacker can abuse such behavior and decrypt data.

Mitigation

Update the affected package php74 to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Server for SAP Applications: 12-SP3 - 12-SP5

SUSE Linux Enterprise High Performance Computing: 12

SUSE Linux Enterprise Server: 12-SP2-LTSS-ERICSSON - 12-SP5

SUSE Linux Enterprise Module for Web Scripting: 12

SUSE Linux Enterprise Software Development Kit: 12-SP5

php74-zlib-debuginfo: before 7.4.33-1.47.2

php74-zlib: before 7.4.33-1.47.2

php74-zip-debuginfo: before 7.4.33-1.47.2

php74-zip: before 7.4.33-1.47.2

php74-xsl-debuginfo: before 7.4.33-1.47.2

php74-xsl: before 7.4.33-1.47.2

php74-xmlwriter-debuginfo: before 7.4.33-1.47.2

php74-xmlwriter: before 7.4.33-1.47.2

php74-xmlrpc-debuginfo: before 7.4.33-1.47.2

php74-xmlrpc: before 7.4.33-1.47.2

php74-xmlreader-debuginfo: before 7.4.33-1.47.2

php74-xmlreader: before 7.4.33-1.47.2

php74-tokenizer-debuginfo: before 7.4.33-1.47.2

php74-tokenizer: before 7.4.33-1.47.2

php74-tidy-debuginfo: before 7.4.33-1.47.2

php74-tidy: before 7.4.33-1.47.2

php74-sysvshm-debuginfo: before 7.4.33-1.47.2

php74-sysvshm: before 7.4.33-1.47.2

php74-sysvsem-debuginfo: before 7.4.33-1.47.2

php74-sysvsem: before 7.4.33-1.47.2

php74-sysvmsg-debuginfo: before 7.4.33-1.47.2

php74-sysvmsg: before 7.4.33-1.47.2

php74-sqlite-debuginfo: before 7.4.33-1.47.2

php74-sqlite: before 7.4.33-1.47.2

php74-sodium-debuginfo: before 7.4.33-1.47.2

php74-sodium: before 7.4.33-1.47.2

php74-sockets-debuginfo: before 7.4.33-1.47.2

php74-sockets: before 7.4.33-1.47.2

php74-soap-debuginfo: before 7.4.33-1.47.2

php74-soap: before 7.4.33-1.47.2

php74-snmp-debuginfo: before 7.4.33-1.47.2

php74-snmp: before 7.4.33-1.47.2

php74-shmop-debuginfo: before 7.4.33-1.47.2

php74-shmop: before 7.4.33-1.47.2

php74-readline-debuginfo: before 7.4.33-1.47.2

php74-readline: before 7.4.33-1.47.2

php74-posix-debuginfo: before 7.4.33-1.47.2

php74-posix: before 7.4.33-1.47.2

php74-phar-debuginfo: before 7.4.33-1.47.2

php74-phar: before 7.4.33-1.47.2

php74-pgsql-debuginfo: before 7.4.33-1.47.2

php74-pgsql: before 7.4.33-1.47.2

php74-pdo-debuginfo: before 7.4.33-1.47.2

php74-pdo: before 7.4.33-1.47.2

php74-pcntl-debuginfo: before 7.4.33-1.47.2

php74-pcntl: before 7.4.33-1.47.2

php74-openssl-debuginfo: before 7.4.33-1.47.2

php74-openssl: before 7.4.33-1.47.2

php74-opcache-debuginfo: before 7.4.33-1.47.2

php74-opcache: before 7.4.33-1.47.2

php74-odbc-debuginfo: before 7.4.33-1.47.2

php74-odbc: before 7.4.33-1.47.2

php74-mysql-debuginfo: before 7.4.33-1.47.2

php74-mysql: before 7.4.33-1.47.2

php74-mbstring-debuginfo: before 7.4.33-1.47.2

php74-mbstring: before 7.4.33-1.47.2

php74-ldap-debuginfo: before 7.4.33-1.47.2

php74-ldap: before 7.4.33-1.47.2

php74-json-debuginfo: before 7.4.33-1.47.2

php74-json: before 7.4.33-1.47.2

php74-intl-debuginfo: before 7.4.33-1.47.2

php74-intl: before 7.4.33-1.47.2

php74-iconv-debuginfo: before 7.4.33-1.47.2

php74-iconv: before 7.4.33-1.47.2

php74-gmp-debuginfo: before 7.4.33-1.47.2

php74-gmp: before 7.4.33-1.47.2

php74-gettext-debuginfo: before 7.4.33-1.47.2

php74-gettext: before 7.4.33-1.47.2

php74-gd-debuginfo: before 7.4.33-1.47.2

php74-gd: before 7.4.33-1.47.2

php74-ftp-debuginfo: before 7.4.33-1.47.2

php74-ftp: before 7.4.33-1.47.2

php74-fpm-debuginfo: before 7.4.33-1.47.2

php74-fpm: before 7.4.33-1.47.2

php74-fileinfo-debuginfo: before 7.4.33-1.47.2

php74-fileinfo: before 7.4.33-1.47.2

php74-fastcgi-debuginfo: before 7.4.33-1.47.2

php74-fastcgi: before 7.4.33-1.47.2

php74-exif-debuginfo: before 7.4.33-1.47.2

php74-exif: before 7.4.33-1.47.2

php74-enchant-debuginfo: before 7.4.33-1.47.2

php74-enchant: before 7.4.33-1.47.2

php74-dom-debuginfo: before 7.4.33-1.47.2

php74-dom: before 7.4.33-1.47.2

php74-dba-debuginfo: before 7.4.33-1.47.2

php74-dba: before 7.4.33-1.47.2

php74-curl-debuginfo: before 7.4.33-1.47.2

php74-curl: before 7.4.33-1.47.2

php74-ctype-debuginfo: before 7.4.33-1.47.2

php74-ctype: before 7.4.33-1.47.2

php74-calendar-debuginfo: before 7.4.33-1.47.2

php74-calendar: before 7.4.33-1.47.2

php74-bz2-debuginfo: before 7.4.33-1.47.2

php74-bz2: before 7.4.33-1.47.2

php74-bcmath-debuginfo: before 7.4.33-1.47.2

php74-bcmath: before 7.4.33-1.47.2

php74: before 7.4.33-1.47.2

apache2-mod_php74-debuginfo: before 7.4.33-1.47.2

apache2-mod_php74: before 7.4.33-1.47.2

php74-devel: before 7.4.33-1.47.2

php74-debugsource: before 7.4.33-1.47.2

php74-debuginfo: before 7.4.33-1.47.2

CPE2.3

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications:12-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications:12-SP4:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications:12-SP5:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing:12:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server:12-SP2-LTSS-ERICSSON:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server:12-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server:12-SP4:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_module_for_web_scripting:12:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_software_development_kit:12-SP5:*:*:*:*:*:*:*
• cpe:2.3:a:suse:php74-zlib-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-zlib:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-zip-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-zip:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xsl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xsl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xmlwriter-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xmlwriter:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xmlrpc-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xmlrpc:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xmlreader-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xmlreader:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-tokenizer-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-tokenizer:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-tidy-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-tidy:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sysvshm-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sysvshm:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sysvsem-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sysvsem:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sysvmsg-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sysvmsg:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sqlite-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sqlite:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sodium-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sodium:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sockets-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sockets:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-soap-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-soap:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-snmp-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-snmp:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-shmop-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-shmop:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-readline-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-readline:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-posix-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-posix:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-phar-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-phar:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-pgsql-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-pgsql:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-pdo-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-pdo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-pcntl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-pcntl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-openssl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-openssl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-opcache-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-opcache:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-odbc-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-odbc:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-mysql-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-mysql:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-mbstring-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-mbstring:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-ldap-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-ldap:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-json-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-json:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-intl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-intl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-iconv-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-iconv:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-gmp-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-gmp:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-gettext-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-gettext:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-gd-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-gd:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-ftp-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-ftp:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-fpm-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-fpm:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-fileinfo-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-fileinfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-fastcgi-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-fastcgi:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-exif-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-exif:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-enchant-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-enchant:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-dom-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-dom:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-dba-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-dba:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-curl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-curl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-ctype-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-ctype:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-calendar-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-calendar:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-bz2-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-bz2:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-bcmath-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-bcmath:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:apache2-mod_php74-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:apache2-mod_php74:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-devel:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-debugsource:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-debuginfo:*:*:*:*:*:suse_linux:*:*

External links

https://www.suse.com/support/update/announcement/2022/suse-su-20224068-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Input validation error

EUVDB-ID: #VU47252

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2020-7070

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a spoofing attack.

The vulnerability exists in the way PHP parser handles cookies with percent character (e.g. '%'). A remote attacker can send a crafted HTTP request with a `__%48ost-` or `__%53ecure-` cookie that will be processed before other cookies sent in the same request. As a result, an attacker can set malicious `__Host-` cookie on a subdomain and bypass origin restrictions, imposed by browsers.

Successful exploitation of the vulnerability may allow an attacker to perform a spoofing attack.

Mitigation

Update the affected package php74 to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Server for SAP Applications: 12-SP3 - 12-SP5

SUSE Linux Enterprise High Performance Computing: 12

SUSE Linux Enterprise Server: 12-SP2-LTSS-ERICSSON - 12-SP5

SUSE Linux Enterprise Module for Web Scripting: 12

SUSE Linux Enterprise Software Development Kit: 12-SP5

php74-zlib-debuginfo: before 7.4.33-1.47.2

php74-zlib: before 7.4.33-1.47.2

php74-zip-debuginfo: before 7.4.33-1.47.2

php74-zip: before 7.4.33-1.47.2

php74-xsl-debuginfo: before 7.4.33-1.47.2

php74-xsl: before 7.4.33-1.47.2

php74-xmlwriter-debuginfo: before 7.4.33-1.47.2

php74-xmlwriter: before 7.4.33-1.47.2

php74-xmlrpc-debuginfo: before 7.4.33-1.47.2

php74-xmlrpc: before 7.4.33-1.47.2

php74-xmlreader-debuginfo: before 7.4.33-1.47.2

php74-xmlreader: before 7.4.33-1.47.2

php74-tokenizer-debuginfo: before 7.4.33-1.47.2

php74-tokenizer: before 7.4.33-1.47.2

php74-tidy-debuginfo: before 7.4.33-1.47.2

php74-tidy: before 7.4.33-1.47.2

php74-sysvshm-debuginfo: before 7.4.33-1.47.2

php74-sysvshm: before 7.4.33-1.47.2

php74-sysvsem-debuginfo: before 7.4.33-1.47.2

php74-sysvsem: before 7.4.33-1.47.2

php74-sysvmsg-debuginfo: before 7.4.33-1.47.2

php74-sysvmsg: before 7.4.33-1.47.2

php74-sqlite-debuginfo: before 7.4.33-1.47.2

php74-sqlite: before 7.4.33-1.47.2

php74-sodium-debuginfo: before 7.4.33-1.47.2

php74-sodium: before 7.4.33-1.47.2

php74-sockets-debuginfo: before 7.4.33-1.47.2

php74-sockets: before 7.4.33-1.47.2

php74-soap-debuginfo: before 7.4.33-1.47.2

php74-soap: before 7.4.33-1.47.2

php74-snmp-debuginfo: before 7.4.33-1.47.2

php74-snmp: before 7.4.33-1.47.2

php74-shmop-debuginfo: before 7.4.33-1.47.2

php74-shmop: before 7.4.33-1.47.2

php74-readline-debuginfo: before 7.4.33-1.47.2

php74-readline: before 7.4.33-1.47.2

php74-posix-debuginfo: before 7.4.33-1.47.2

php74-posix: before 7.4.33-1.47.2

php74-phar-debuginfo: before 7.4.33-1.47.2

php74-phar: before 7.4.33-1.47.2

php74-pgsql-debuginfo: before 7.4.33-1.47.2

php74-pgsql: before 7.4.33-1.47.2

php74-pdo-debuginfo: before 7.4.33-1.47.2

php74-pdo: before 7.4.33-1.47.2

php74-pcntl-debuginfo: before 7.4.33-1.47.2

php74-pcntl: before 7.4.33-1.47.2

php74-openssl-debuginfo: before 7.4.33-1.47.2

php74-openssl: before 7.4.33-1.47.2

php74-opcache-debuginfo: before 7.4.33-1.47.2

php74-opcache: before 7.4.33-1.47.2

php74-odbc-debuginfo: before 7.4.33-1.47.2

php74-odbc: before 7.4.33-1.47.2

php74-mysql-debuginfo: before 7.4.33-1.47.2

php74-mysql: before 7.4.33-1.47.2

php74-mbstring-debuginfo: before 7.4.33-1.47.2

php74-mbstring: before 7.4.33-1.47.2

php74-ldap-debuginfo: before 7.4.33-1.47.2

php74-ldap: before 7.4.33-1.47.2

php74-json-debuginfo: before 7.4.33-1.47.2

php74-json: before 7.4.33-1.47.2

php74-intl-debuginfo: before 7.4.33-1.47.2

php74-intl: before 7.4.33-1.47.2

php74-iconv-debuginfo: before 7.4.33-1.47.2

php74-iconv: before 7.4.33-1.47.2

php74-gmp-debuginfo: before 7.4.33-1.47.2

php74-gmp: before 7.4.33-1.47.2

php74-gettext-debuginfo: before 7.4.33-1.47.2

php74-gettext: before 7.4.33-1.47.2

php74-gd-debuginfo: before 7.4.33-1.47.2

php74-gd: before 7.4.33-1.47.2

php74-ftp-debuginfo: before 7.4.33-1.47.2

php74-ftp: before 7.4.33-1.47.2

php74-fpm-debuginfo: before 7.4.33-1.47.2

php74-fpm: before 7.4.33-1.47.2

php74-fileinfo-debuginfo: before 7.4.33-1.47.2

php74-fileinfo: before 7.4.33-1.47.2

php74-fastcgi-debuginfo: before 7.4.33-1.47.2

php74-fastcgi: before 7.4.33-1.47.2

php74-exif-debuginfo: before 7.4.33-1.47.2

php74-exif: before 7.4.33-1.47.2

php74-enchant-debuginfo: before 7.4.33-1.47.2

php74-enchant: before 7.4.33-1.47.2

php74-dom-debuginfo: before 7.4.33-1.47.2

php74-dom: before 7.4.33-1.47.2

php74-dba-debuginfo: before 7.4.33-1.47.2

php74-dba: before 7.4.33-1.47.2

php74-curl-debuginfo: before 7.4.33-1.47.2

php74-curl: before 7.4.33-1.47.2

php74-ctype-debuginfo: before 7.4.33-1.47.2

php74-ctype: before 7.4.33-1.47.2

php74-calendar-debuginfo: before 7.4.33-1.47.2

php74-calendar: before 7.4.33-1.47.2

php74-bz2-debuginfo: before 7.4.33-1.47.2

php74-bz2: before 7.4.33-1.47.2

php74-bcmath-debuginfo: before 7.4.33-1.47.2

php74-bcmath: before 7.4.33-1.47.2

php74: before 7.4.33-1.47.2

apache2-mod_php74-debuginfo: before 7.4.33-1.47.2

apache2-mod_php74: before 7.4.33-1.47.2

php74-devel: before 7.4.33-1.47.2

php74-debugsource: before 7.4.33-1.47.2

php74-debuginfo: before 7.4.33-1.47.2

CPE2.3

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications:12-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications:12-SP4:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications:12-SP5:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing:12:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server:12-SP2-LTSS-ERICSSON:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server:12-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server:12-SP4:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_module_for_web_scripting:12:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_software_development_kit:12-SP5:*:*:*:*:*:*:*
• cpe:2.3:a:suse:php74-zlib-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-zlib:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-zip-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-zip:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xsl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xsl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xmlwriter-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xmlwriter:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xmlrpc-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xmlrpc:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xmlreader-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xmlreader:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-tokenizer-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-tokenizer:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-tidy-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-tidy:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sysvshm-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sysvshm:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sysvsem-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sysvsem:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sysvmsg-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sysvmsg:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sqlite-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sqlite:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sodium-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sodium:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sockets-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sockets:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-soap-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-soap:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-snmp-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-snmp:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-shmop-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-shmop:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-readline-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-readline:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-posix-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-posix:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-phar-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-phar:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-pgsql-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-pgsql:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-pdo-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-pdo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-pcntl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-pcntl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-openssl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-openssl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-opcache-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-opcache:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-odbc-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-odbc:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-mysql-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-mysql:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-mbstring-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-mbstring:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-ldap-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-ldap:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-json-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-json:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-intl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-intl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-iconv-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-iconv:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-gmp-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-gmp:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-gettext-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-gettext:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-gd-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-gd:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-ftp-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-ftp:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-fpm-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-fpm:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-fileinfo-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-fileinfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-fastcgi-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-fastcgi:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-exif-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-exif:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-enchant-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-enchant:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-dom-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-dom:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-dba-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-dba:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-curl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-curl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-ctype-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-ctype:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-calendar-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-calendar:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-bz2-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-bz2:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-bcmath-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-bcmath:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:apache2-mod_php74-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:apache2-mod_php74:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-devel:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-debugsource:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-debuginfo:*:*:*:*:*:suse_linux:*:*

External links

https://www.suse.com/support/update/announcement/2022/suse-su-20224068-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Input validation error

EUVDB-ID: #VU49338

Risk: Medium

CVSSv4.0: 5.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/U:Green]

CVE-ID: CVE-2020-7071

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to insufficient validation of URL performed via the "FILTER_VALIDATE_URL" setting. A remote attacker can use the "@" characters in the URL to bypass implemented filter and force the application to accept arbitrary URL instead of the defined by the option.

Example:

http://evel.website@trusted.website

Mitigation

Update the affected package php74 to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Server for SAP Applications: 12-SP3 - 12-SP5

SUSE Linux Enterprise High Performance Computing: 12

SUSE Linux Enterprise Server: 12-SP2-LTSS-ERICSSON - 12-SP5

SUSE Linux Enterprise Module for Web Scripting: 12

SUSE Linux Enterprise Software Development Kit: 12-SP5

php74-zlib-debuginfo: before 7.4.33-1.47.2

php74-zlib: before 7.4.33-1.47.2

php74-zip-debuginfo: before 7.4.33-1.47.2

php74-zip: before 7.4.33-1.47.2

php74-xsl-debuginfo: before 7.4.33-1.47.2

php74-xsl: before 7.4.33-1.47.2

php74-xmlwriter-debuginfo: before 7.4.33-1.47.2

php74-xmlwriter: before 7.4.33-1.47.2

php74-xmlrpc-debuginfo: before 7.4.33-1.47.2

php74-xmlrpc: before 7.4.33-1.47.2

php74-xmlreader-debuginfo: before 7.4.33-1.47.2

php74-xmlreader: before 7.4.33-1.47.2

php74-tokenizer-debuginfo: before 7.4.33-1.47.2

php74-tokenizer: before 7.4.33-1.47.2

php74-tidy-debuginfo: before 7.4.33-1.47.2

php74-tidy: before 7.4.33-1.47.2

php74-sysvshm-debuginfo: before 7.4.33-1.47.2

php74-sysvshm: before 7.4.33-1.47.2

php74-sysvsem-debuginfo: before 7.4.33-1.47.2

php74-sysvsem: before 7.4.33-1.47.2

php74-sysvmsg-debuginfo: before 7.4.33-1.47.2

php74-sysvmsg: before 7.4.33-1.47.2

php74-sqlite-debuginfo: before 7.4.33-1.47.2

php74-sqlite: before 7.4.33-1.47.2

php74-sodium-debuginfo: before 7.4.33-1.47.2

php74-sodium: before 7.4.33-1.47.2

php74-sockets-debuginfo: before 7.4.33-1.47.2

php74-sockets: before 7.4.33-1.47.2

php74-soap-debuginfo: before 7.4.33-1.47.2

php74-soap: before 7.4.33-1.47.2

php74-snmp-debuginfo: before 7.4.33-1.47.2

php74-snmp: before 7.4.33-1.47.2

php74-shmop-debuginfo: before 7.4.33-1.47.2

php74-shmop: before 7.4.33-1.47.2

php74-readline-debuginfo: before 7.4.33-1.47.2

php74-readline: before 7.4.33-1.47.2

php74-posix-debuginfo: before 7.4.33-1.47.2

php74-posix: before 7.4.33-1.47.2

php74-phar-debuginfo: before 7.4.33-1.47.2

php74-phar: before 7.4.33-1.47.2

php74-pgsql-debuginfo: before 7.4.33-1.47.2

php74-pgsql: before 7.4.33-1.47.2

php74-pdo-debuginfo: before 7.4.33-1.47.2

php74-pdo: before 7.4.33-1.47.2

php74-pcntl-debuginfo: before 7.4.33-1.47.2

php74-pcntl: before 7.4.33-1.47.2

php74-openssl-debuginfo: before 7.4.33-1.47.2

php74-openssl: before 7.4.33-1.47.2

php74-opcache-debuginfo: before 7.4.33-1.47.2

php74-opcache: before 7.4.33-1.47.2

php74-odbc-debuginfo: before 7.4.33-1.47.2

php74-odbc: before 7.4.33-1.47.2

php74-mysql-debuginfo: before 7.4.33-1.47.2

php74-mysql: before 7.4.33-1.47.2

php74-mbstring-debuginfo: before 7.4.33-1.47.2

php74-mbstring: before 7.4.33-1.47.2

php74-ldap-debuginfo: before 7.4.33-1.47.2

php74-ldap: before 7.4.33-1.47.2

php74-json-debuginfo: before 7.4.33-1.47.2

php74-json: before 7.4.33-1.47.2

php74-intl-debuginfo: before 7.4.33-1.47.2

php74-intl: before 7.4.33-1.47.2

php74-iconv-debuginfo: before 7.4.33-1.47.2

php74-iconv: before 7.4.33-1.47.2

php74-gmp-debuginfo: before 7.4.33-1.47.2

php74-gmp: before 7.4.33-1.47.2

php74-gettext-debuginfo: before 7.4.33-1.47.2

php74-gettext: before 7.4.33-1.47.2

php74-gd-debuginfo: before 7.4.33-1.47.2

php74-gd: before 7.4.33-1.47.2

php74-ftp-debuginfo: before 7.4.33-1.47.2

php74-ftp: before 7.4.33-1.47.2

php74-fpm-debuginfo: before 7.4.33-1.47.2

php74-fpm: before 7.4.33-1.47.2

php74-fileinfo-debuginfo: before 7.4.33-1.47.2

php74-fileinfo: before 7.4.33-1.47.2

php74-fastcgi-debuginfo: before 7.4.33-1.47.2

php74-fastcgi: before 7.4.33-1.47.2

php74-exif-debuginfo: before 7.4.33-1.47.2

php74-exif: before 7.4.33-1.47.2

php74-enchant-debuginfo: before 7.4.33-1.47.2

php74-enchant: before 7.4.33-1.47.2

php74-dom-debuginfo: before 7.4.33-1.47.2

php74-dom: before 7.4.33-1.47.2

php74-dba-debuginfo: before 7.4.33-1.47.2

php74-dba: before 7.4.33-1.47.2

php74-curl-debuginfo: before 7.4.33-1.47.2

php74-curl: before 7.4.33-1.47.2

php74-ctype-debuginfo: before 7.4.33-1.47.2

php74-ctype: before 7.4.33-1.47.2

php74-calendar-debuginfo: before 7.4.33-1.47.2

php74-calendar: before 7.4.33-1.47.2

php74-bz2-debuginfo: before 7.4.33-1.47.2

php74-bz2: before 7.4.33-1.47.2

php74-bcmath-debuginfo: before 7.4.33-1.47.2

php74-bcmath: before 7.4.33-1.47.2

php74: before 7.4.33-1.47.2

apache2-mod_php74-debuginfo: before 7.4.33-1.47.2

apache2-mod_php74: before 7.4.33-1.47.2

php74-devel: before 7.4.33-1.47.2

php74-debugsource: before 7.4.33-1.47.2

php74-debuginfo: before 7.4.33-1.47.2

CPE2.3

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications:12-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications:12-SP4:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications:12-SP5:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing:12:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server:12-SP2-LTSS-ERICSSON:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server:12-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server:12-SP4:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_module_for_web_scripting:12:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_software_development_kit:12-SP5:*:*:*:*:*:*:*
• cpe:2.3:a:suse:php74-zlib-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-zlib:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-zip-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-zip:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xsl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xsl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xmlwriter-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xmlwriter:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xmlrpc-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xmlrpc:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xmlreader-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xmlreader:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-tokenizer-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-tokenizer:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-tidy-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-tidy:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sysvshm-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sysvshm:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sysvsem-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sysvsem:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sysvmsg-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sysvmsg:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sqlite-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sqlite:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sodium-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sodium:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sockets-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sockets:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-soap-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-soap:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-snmp-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-snmp:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-shmop-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-shmop:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-readline-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-readline:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-posix-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-posix:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-phar-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-phar:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-pgsql-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-pgsql:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-pdo-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-pdo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-pcntl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-pcntl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-openssl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-openssl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-opcache-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-opcache:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-odbc-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-odbc:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-mysql-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-mysql:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-mbstring-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-mbstring:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-ldap-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-ldap:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-json-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-json:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-intl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-intl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-iconv-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-iconv:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-gmp-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-gmp:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-gettext-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-gettext:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-gd-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-gd:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-ftp-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-ftp:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-fpm-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-fpm:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-fileinfo-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-fileinfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-fastcgi-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-fastcgi:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-exif-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-exif:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-enchant-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-enchant:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-dom-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-dom:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-dba-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-dba:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-curl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-curl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-ctype-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-ctype:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-calendar-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-calendar:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-bz2-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-bz2:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-bcmath-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-bcmath:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:apache2-mod_php74-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:apache2-mod_php74:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-devel:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-debugsource:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-debuginfo:*:*:*:*:*:suse_linux:*:*

External links

https://www.suse.com/support/update/announcement/2022/suse-su-20224068-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

6) NULL pointer dereference

EUVDB-ID: #VU50403

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2021-21702

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error within the SoapClient in PHP. A remote attacker can pass specially crafted data to the application and perform a denial of service (DoS) attack.

Mitigation

Update the affected package php74 to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Server for SAP Applications: 12-SP3 - 12-SP5

SUSE Linux Enterprise High Performance Computing: 12

SUSE Linux Enterprise Server: 12-SP2-LTSS-ERICSSON - 12-SP5

SUSE Linux Enterprise Module for Web Scripting: 12

SUSE Linux Enterprise Software Development Kit: 12-SP5

php74-zlib-debuginfo: before 7.4.33-1.47.2

php74-zlib: before 7.4.33-1.47.2

php74-zip-debuginfo: before 7.4.33-1.47.2

php74-zip: before 7.4.33-1.47.2

php74-xsl-debuginfo: before 7.4.33-1.47.2

php74-xsl: before 7.4.33-1.47.2

php74-xmlwriter-debuginfo: before 7.4.33-1.47.2

php74-xmlwriter: before 7.4.33-1.47.2

php74-xmlrpc-debuginfo: before 7.4.33-1.47.2

php74-xmlrpc: before 7.4.33-1.47.2

php74-xmlreader-debuginfo: before 7.4.33-1.47.2

php74-xmlreader: before 7.4.33-1.47.2

php74-tokenizer-debuginfo: before 7.4.33-1.47.2

php74-tokenizer: before 7.4.33-1.47.2

php74-tidy-debuginfo: before 7.4.33-1.47.2

php74-tidy: before 7.4.33-1.47.2

php74-sysvshm-debuginfo: before 7.4.33-1.47.2

php74-sysvshm: before 7.4.33-1.47.2

php74-sysvsem-debuginfo: before 7.4.33-1.47.2

php74-sysvsem: before 7.4.33-1.47.2

php74-sysvmsg-debuginfo: before 7.4.33-1.47.2

php74-sysvmsg: before 7.4.33-1.47.2

php74-sqlite-debuginfo: before 7.4.33-1.47.2

php74-sqlite: before 7.4.33-1.47.2

php74-sodium-debuginfo: before 7.4.33-1.47.2

php74-sodium: before 7.4.33-1.47.2

php74-sockets-debuginfo: before 7.4.33-1.47.2

php74-sockets: before 7.4.33-1.47.2

php74-soap-debuginfo: before 7.4.33-1.47.2

php74-soap: before 7.4.33-1.47.2

php74-snmp-debuginfo: before 7.4.33-1.47.2

php74-snmp: before 7.4.33-1.47.2

php74-shmop-debuginfo: before 7.4.33-1.47.2

php74-shmop: before 7.4.33-1.47.2

php74-readline-debuginfo: before 7.4.33-1.47.2

php74-readline: before 7.4.33-1.47.2

php74-posix-debuginfo: before 7.4.33-1.47.2

php74-posix: before 7.4.33-1.47.2

php74-phar-debuginfo: before 7.4.33-1.47.2

php74-phar: before 7.4.33-1.47.2

php74-pgsql-debuginfo: before 7.4.33-1.47.2

php74-pgsql: before 7.4.33-1.47.2

php74-pdo-debuginfo: before 7.4.33-1.47.2

php74-pdo: before 7.4.33-1.47.2

php74-pcntl-debuginfo: before 7.4.33-1.47.2

php74-pcntl: before 7.4.33-1.47.2

php74-openssl-debuginfo: before 7.4.33-1.47.2

php74-openssl: before 7.4.33-1.47.2

php74-opcache-debuginfo: before 7.4.33-1.47.2

php74-opcache: before 7.4.33-1.47.2

php74-odbc-debuginfo: before 7.4.33-1.47.2

php74-odbc: before 7.4.33-1.47.2

php74-mysql-debuginfo: before 7.4.33-1.47.2

php74-mysql: before 7.4.33-1.47.2

php74-mbstring-debuginfo: before 7.4.33-1.47.2

php74-mbstring: before 7.4.33-1.47.2

php74-ldap-debuginfo: before 7.4.33-1.47.2

php74-ldap: before 7.4.33-1.47.2

php74-json-debuginfo: before 7.4.33-1.47.2

php74-json: before 7.4.33-1.47.2

php74-intl-debuginfo: before 7.4.33-1.47.2

php74-intl: before 7.4.33-1.47.2

php74-iconv-debuginfo: before 7.4.33-1.47.2

php74-iconv: before 7.4.33-1.47.2

php74-gmp-debuginfo: before 7.4.33-1.47.2

php74-gmp: before 7.4.33-1.47.2

php74-gettext-debuginfo: before 7.4.33-1.47.2

php74-gettext: before 7.4.33-1.47.2

php74-gd-debuginfo: before 7.4.33-1.47.2

php74-gd: before 7.4.33-1.47.2

php74-ftp-debuginfo: before 7.4.33-1.47.2

php74-ftp: before 7.4.33-1.47.2

php74-fpm-debuginfo: before 7.4.33-1.47.2

php74-fpm: before 7.4.33-1.47.2

php74-fileinfo-debuginfo: before 7.4.33-1.47.2

php74-fileinfo: before 7.4.33-1.47.2

php74-fastcgi-debuginfo: before 7.4.33-1.47.2

php74-fastcgi: before 7.4.33-1.47.2

php74-exif-debuginfo: before 7.4.33-1.47.2

php74-exif: before 7.4.33-1.47.2

php74-enchant-debuginfo: before 7.4.33-1.47.2

php74-enchant: before 7.4.33-1.47.2

php74-dom-debuginfo: before 7.4.33-1.47.2

php74-dom: before 7.4.33-1.47.2

php74-dba-debuginfo: before 7.4.33-1.47.2

php74-dba: before 7.4.33-1.47.2

php74-curl-debuginfo: before 7.4.33-1.47.2

php74-curl: before 7.4.33-1.47.2

php74-ctype-debuginfo: before 7.4.33-1.47.2

php74-ctype: before 7.4.33-1.47.2

php74-calendar-debuginfo: before 7.4.33-1.47.2

php74-calendar: before 7.4.33-1.47.2

php74-bz2-debuginfo: before 7.4.33-1.47.2

php74-bz2: before 7.4.33-1.47.2

php74-bcmath-debuginfo: before 7.4.33-1.47.2

php74-bcmath: before 7.4.33-1.47.2

php74: before 7.4.33-1.47.2

apache2-mod_php74-debuginfo: before 7.4.33-1.47.2

apache2-mod_php74: before 7.4.33-1.47.2

php74-devel: before 7.4.33-1.47.2

php74-debugsource: before 7.4.33-1.47.2

php74-debuginfo: before 7.4.33-1.47.2

CPE2.3

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications:12-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications:12-SP4:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications:12-SP5:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing:12:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server:12-SP2-LTSS-ERICSSON:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server:12-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server:12-SP4:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_module_for_web_scripting:12:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_software_development_kit:12-SP5:*:*:*:*:*:*:*
• cpe:2.3:a:suse:php74-zlib-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-zlib:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-zip-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-zip:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xsl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xsl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xmlwriter-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xmlwriter:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xmlrpc-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xmlrpc:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xmlreader-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xmlreader:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-tokenizer-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-tokenizer:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-tidy-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-tidy:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sysvshm-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sysvshm:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sysvsem-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sysvsem:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sysvmsg-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sysvmsg:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sqlite-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sqlite:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sodium-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sodium:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sockets-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sockets:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-soap-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-soap:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-snmp-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-snmp:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-shmop-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-shmop:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-readline-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-readline:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-posix-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-posix:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-phar-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-phar:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-pgsql-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-pgsql:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-pdo-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-pdo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-pcntl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-pcntl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-openssl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-openssl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-opcache-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-opcache:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-odbc-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-odbc:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-mysql-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-mysql:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-mbstring-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-mbstring:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-ldap-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-ldap:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-json-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-json:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-intl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-intl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-iconv-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-iconv:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-gmp-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-gmp:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-gettext-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-gettext:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-gd-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-gd:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-ftp-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-ftp:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-fpm-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-fpm:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-fileinfo-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-fileinfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-fastcgi-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-fastcgi:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-exif-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-exif:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-enchant-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-enchant:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-dom-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-dom:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-dba-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-dba:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-curl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-curl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-ctype-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-ctype:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-calendar-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-calendar:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-bz2-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-bz2:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-bcmath-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-bcmath:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:apache2-mod_php74-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:apache2-mod_php74:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-devel:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-debugsource:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-debuginfo:*:*:*:*:*:suse_linux:*:*

External links

https://www.suse.com/support/update/announcement/2022/suse-su-20224068-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Out-of-bounds write

EUVDB-ID: #VU57656

Risk: Low

CVSSv4.0: 7.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Clear]

CVE-ID: CVE-2021-21703

CWE-ID: CWE-787 - Out-of-bounds write

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists in the way PHP handles shared memory access, when using PHP FPM SAPI with main FPM daemon process running as root and child worker processes running as lower-privileged users. A child process can access shared memory with the main process and write to it. As a result, it is possible to cause the root process to conduct invalid memory reads and writes with root privileges. A local user can trigger an out-of-bounds write error and execute arbitrary code on the system with root privileges.

Mitigation

Update the affected package php74 to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Server for SAP Applications: 12-SP3 - 12-SP5

SUSE Linux Enterprise High Performance Computing: 12

SUSE Linux Enterprise Server: 12-SP2-LTSS-ERICSSON - 12-SP5

SUSE Linux Enterprise Module for Web Scripting: 12

SUSE Linux Enterprise Software Development Kit: 12-SP5

php74-zlib-debuginfo: before 7.4.33-1.47.2

php74-zlib: before 7.4.33-1.47.2

php74-zip-debuginfo: before 7.4.33-1.47.2

php74-zip: before 7.4.33-1.47.2

php74-xsl-debuginfo: before 7.4.33-1.47.2

php74-xsl: before 7.4.33-1.47.2

php74-xmlwriter-debuginfo: before 7.4.33-1.47.2

php74-xmlwriter: before 7.4.33-1.47.2

php74-xmlrpc-debuginfo: before 7.4.33-1.47.2

php74-xmlrpc: before 7.4.33-1.47.2

php74-xmlreader-debuginfo: before 7.4.33-1.47.2

php74-xmlreader: before 7.4.33-1.47.2

php74-tokenizer-debuginfo: before 7.4.33-1.47.2

php74-tokenizer: before 7.4.33-1.47.2

php74-tidy-debuginfo: before 7.4.33-1.47.2

php74-tidy: before 7.4.33-1.47.2

php74-sysvshm-debuginfo: before 7.4.33-1.47.2

php74-sysvshm: before 7.4.33-1.47.2

php74-sysvsem-debuginfo: before 7.4.33-1.47.2

php74-sysvsem: before 7.4.33-1.47.2

php74-sysvmsg-debuginfo: before 7.4.33-1.47.2

php74-sysvmsg: before 7.4.33-1.47.2

php74-sqlite-debuginfo: before 7.4.33-1.47.2

php74-sqlite: before 7.4.33-1.47.2

php74-sodium-debuginfo: before 7.4.33-1.47.2

php74-sodium: before 7.4.33-1.47.2

php74-sockets-debuginfo: before 7.4.33-1.47.2

php74-sockets: before 7.4.33-1.47.2

php74-soap-debuginfo: before 7.4.33-1.47.2

php74-soap: before 7.4.33-1.47.2

php74-snmp-debuginfo: before 7.4.33-1.47.2

php74-snmp: before 7.4.33-1.47.2

php74-shmop-debuginfo: before 7.4.33-1.47.2

php74-shmop: before 7.4.33-1.47.2

php74-readline-debuginfo: before 7.4.33-1.47.2

php74-readline: before 7.4.33-1.47.2

php74-posix-debuginfo: before 7.4.33-1.47.2

php74-posix: before 7.4.33-1.47.2

php74-phar-debuginfo: before 7.4.33-1.47.2

php74-phar: before 7.4.33-1.47.2

php74-pgsql-debuginfo: before 7.4.33-1.47.2

php74-pgsql: before 7.4.33-1.47.2

php74-pdo-debuginfo: before 7.4.33-1.47.2

php74-pdo: before 7.4.33-1.47.2

php74-pcntl-debuginfo: before 7.4.33-1.47.2

php74-pcntl: before 7.4.33-1.47.2

php74-openssl-debuginfo: before 7.4.33-1.47.2

php74-openssl: before 7.4.33-1.47.2

php74-opcache-debuginfo: before 7.4.33-1.47.2

php74-opcache: before 7.4.33-1.47.2

php74-odbc-debuginfo: before 7.4.33-1.47.2

php74-odbc: before 7.4.33-1.47.2

php74-mysql-debuginfo: before 7.4.33-1.47.2

php74-mysql: before 7.4.33-1.47.2

php74-mbstring-debuginfo: before 7.4.33-1.47.2

php74-mbstring: before 7.4.33-1.47.2

php74-ldap-debuginfo: before 7.4.33-1.47.2

php74-ldap: before 7.4.33-1.47.2

php74-json-debuginfo: before 7.4.33-1.47.2

php74-json: before 7.4.33-1.47.2

php74-intl-debuginfo: before 7.4.33-1.47.2

php74-intl: before 7.4.33-1.47.2

php74-iconv-debuginfo: before 7.4.33-1.47.2

php74-iconv: before 7.4.33-1.47.2

php74-gmp-debuginfo: before 7.4.33-1.47.2

php74-gmp: before 7.4.33-1.47.2

php74-gettext-debuginfo: before 7.4.33-1.47.2

php74-gettext: before 7.4.33-1.47.2

php74-gd-debuginfo: before 7.4.33-1.47.2

php74-gd: before 7.4.33-1.47.2

php74-ftp-debuginfo: before 7.4.33-1.47.2

php74-ftp: before 7.4.33-1.47.2

php74-fpm-debuginfo: before 7.4.33-1.47.2

php74-fpm: before 7.4.33-1.47.2

php74-fileinfo-debuginfo: before 7.4.33-1.47.2

php74-fileinfo: before 7.4.33-1.47.2

php74-fastcgi-debuginfo: before 7.4.33-1.47.2

php74-fastcgi: before 7.4.33-1.47.2

php74-exif-debuginfo: before 7.4.33-1.47.2

php74-exif: before 7.4.33-1.47.2

php74-enchant-debuginfo: before 7.4.33-1.47.2

php74-enchant: before 7.4.33-1.47.2

php74-dom-debuginfo: before 7.4.33-1.47.2

php74-dom: before 7.4.33-1.47.2

php74-dba-debuginfo: before 7.4.33-1.47.2

php74-dba: before 7.4.33-1.47.2

php74-curl-debuginfo: before 7.4.33-1.47.2

php74-curl: before 7.4.33-1.47.2

php74-ctype-debuginfo: before 7.4.33-1.47.2

php74-ctype: before 7.4.33-1.47.2

php74-calendar-debuginfo: before 7.4.33-1.47.2

php74-calendar: before 7.4.33-1.47.2

php74-bz2-debuginfo: before 7.4.33-1.47.2

php74-bz2: before 7.4.33-1.47.2

php74-bcmath-debuginfo: before 7.4.33-1.47.2

php74-bcmath: before 7.4.33-1.47.2

php74: before 7.4.33-1.47.2

apache2-mod_php74-debuginfo: before 7.4.33-1.47.2

apache2-mod_php74: before 7.4.33-1.47.2

php74-devel: before 7.4.33-1.47.2

php74-debugsource: before 7.4.33-1.47.2

php74-debuginfo: before 7.4.33-1.47.2

CPE2.3

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications:12-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications:12-SP4:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications:12-SP5:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing:12:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server:12-SP2-LTSS-ERICSSON:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server:12-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server:12-SP4:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_module_for_web_scripting:12:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_software_development_kit:12-SP5:*:*:*:*:*:*:*
• cpe:2.3:a:suse:php74-zlib-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-zlib:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-zip-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-zip:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xsl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xsl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xmlwriter-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xmlwriter:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xmlrpc-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xmlrpc:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xmlreader-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xmlreader:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-tokenizer-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-tokenizer:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-tidy-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-tidy:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sysvshm-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sysvshm:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sysvsem-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sysvsem:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sysvmsg-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sysvmsg:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sqlite-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sqlite:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sodium-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sodium:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sockets-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sockets:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-soap-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-soap:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-snmp-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-snmp:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-shmop-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-shmop:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-readline-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-readline:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-posix-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-posix:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-phar-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-phar:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-pgsql-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-pgsql:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-pdo-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-pdo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-pcntl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-pcntl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-openssl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-openssl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-opcache-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-opcache:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-odbc-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-odbc:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-mysql-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-mysql:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-mbstring-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-mbstring:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-ldap-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-ldap:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-json-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-json:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-intl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-intl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-iconv-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-iconv:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-gmp-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-gmp:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-gettext-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-gettext:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-gd-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-gd:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-ftp-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-ftp:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-fpm-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-fpm:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-fileinfo-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-fileinfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-fastcgi-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-fastcgi:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-exif-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-exif:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-enchant-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-enchant:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-dom-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-dom:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-dba-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-dba:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-curl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-curl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-ctype-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-ctype:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-calendar-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-calendar:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-bz2-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-bz2:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-bcmath-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-bcmath:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:apache2-mod_php74-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:apache2-mod_php74:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-devel:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-debugsource:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-debuginfo:*:*:*:*:*:suse_linux:*:*

External links

https://www.suse.com/support/update/announcement/2022/suse-su-20224068-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

8) Stack-based buffer overflow

EUVDB-ID: #VU54566

Risk: High

CVSSv4.0: 7.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2021-21704

CWE-ID: CWE-121 - Stack-based buffer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

Multiple boundary errors exists within firebird_info_cb(), firebird_handle_doer(), firebird_stmt_execute(), and firebird_fetch_blob() function. A remote attacker can pass specially crafted input to the application, trigger a stack-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update the affected package php74 to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Server for SAP Applications: 12-SP3 - 12-SP5

SUSE Linux Enterprise High Performance Computing: 12

SUSE Linux Enterprise Server: 12-SP2-LTSS-ERICSSON - 12-SP5

SUSE Linux Enterprise Module for Web Scripting: 12

SUSE Linux Enterprise Software Development Kit: 12-SP5

php74-zlib-debuginfo: before 7.4.33-1.47.2

php74-zlib: before 7.4.33-1.47.2

php74-zip-debuginfo: before 7.4.33-1.47.2

php74-zip: before 7.4.33-1.47.2

php74-xsl-debuginfo: before 7.4.33-1.47.2

php74-xsl: before 7.4.33-1.47.2

php74-xmlwriter-debuginfo: before 7.4.33-1.47.2

php74-xmlwriter: before 7.4.33-1.47.2

php74-xmlrpc-debuginfo: before 7.4.33-1.47.2

php74-xmlrpc: before 7.4.33-1.47.2

php74-xmlreader-debuginfo: before 7.4.33-1.47.2

php74-xmlreader: before 7.4.33-1.47.2

php74-tokenizer-debuginfo: before 7.4.33-1.47.2

php74-tokenizer: before 7.4.33-1.47.2

php74-tidy-debuginfo: before 7.4.33-1.47.2

php74-tidy: before 7.4.33-1.47.2

php74-sysvshm-debuginfo: before 7.4.33-1.47.2

php74-sysvshm: before 7.4.33-1.47.2

php74-sysvsem-debuginfo: before 7.4.33-1.47.2

php74-sysvsem: before 7.4.33-1.47.2

php74-sysvmsg-debuginfo: before 7.4.33-1.47.2

php74-sysvmsg: before 7.4.33-1.47.2

php74-sqlite-debuginfo: before 7.4.33-1.47.2

php74-sqlite: before 7.4.33-1.47.2

php74-sodium-debuginfo: before 7.4.33-1.47.2

php74-sodium: before 7.4.33-1.47.2

php74-sockets-debuginfo: before 7.4.33-1.47.2

php74-sockets: before 7.4.33-1.47.2

php74-soap-debuginfo: before 7.4.33-1.47.2

php74-soap: before 7.4.33-1.47.2

php74-snmp-debuginfo: before 7.4.33-1.47.2

php74-snmp: before 7.4.33-1.47.2

php74-shmop-debuginfo: before 7.4.33-1.47.2

php74-shmop: before 7.4.33-1.47.2

php74-readline-debuginfo: before 7.4.33-1.47.2

php74-readline: before 7.4.33-1.47.2

php74-posix-debuginfo: before 7.4.33-1.47.2

php74-posix: before 7.4.33-1.47.2

php74-phar-debuginfo: before 7.4.33-1.47.2

php74-phar: before 7.4.33-1.47.2

php74-pgsql-debuginfo: before 7.4.33-1.47.2

php74-pgsql: before 7.4.33-1.47.2

php74-pdo-debuginfo: before 7.4.33-1.47.2

php74-pdo: before 7.4.33-1.47.2

php74-pcntl-debuginfo: before 7.4.33-1.47.2

php74-pcntl: before 7.4.33-1.47.2

php74-openssl-debuginfo: before 7.4.33-1.47.2

php74-openssl: before 7.4.33-1.47.2

php74-opcache-debuginfo: before 7.4.33-1.47.2

php74-opcache: before 7.4.33-1.47.2

php74-odbc-debuginfo: before 7.4.33-1.47.2

php74-odbc: before 7.4.33-1.47.2

php74-mysql-debuginfo: before 7.4.33-1.47.2

php74-mysql: before 7.4.33-1.47.2

php74-mbstring-debuginfo: before 7.4.33-1.47.2

php74-mbstring: before 7.4.33-1.47.2

php74-ldap-debuginfo: before 7.4.33-1.47.2

php74-ldap: before 7.4.33-1.47.2

php74-json-debuginfo: before 7.4.33-1.47.2

php74-json: before 7.4.33-1.47.2

php74-intl-debuginfo: before 7.4.33-1.47.2

php74-intl: before 7.4.33-1.47.2

php74-iconv-debuginfo: before 7.4.33-1.47.2

php74-iconv: before 7.4.33-1.47.2

php74-gmp-debuginfo: before 7.4.33-1.47.2

php74-gmp: before 7.4.33-1.47.2

php74-gettext-debuginfo: before 7.4.33-1.47.2

php74-gettext: before 7.4.33-1.47.2

php74-gd-debuginfo: before 7.4.33-1.47.2

php74-gd: before 7.4.33-1.47.2

php74-ftp-debuginfo: before 7.4.33-1.47.2

php74-ftp: before 7.4.33-1.47.2

php74-fpm-debuginfo: before 7.4.33-1.47.2

php74-fpm: before 7.4.33-1.47.2

php74-fileinfo-debuginfo: before 7.4.33-1.47.2

php74-fileinfo: before 7.4.33-1.47.2

php74-fastcgi-debuginfo: before 7.4.33-1.47.2

php74-fastcgi: before 7.4.33-1.47.2

php74-exif-debuginfo: before 7.4.33-1.47.2

php74-exif: before 7.4.33-1.47.2

php74-enchant-debuginfo: before 7.4.33-1.47.2

php74-enchant: before 7.4.33-1.47.2

php74-dom-debuginfo: before 7.4.33-1.47.2

php74-dom: before 7.4.33-1.47.2

php74-dba-debuginfo: before 7.4.33-1.47.2

php74-dba: before 7.4.33-1.47.2

php74-curl-debuginfo: before 7.4.33-1.47.2

php74-curl: before 7.4.33-1.47.2

php74-ctype-debuginfo: before 7.4.33-1.47.2

php74-ctype: before 7.4.33-1.47.2

php74-calendar-debuginfo: before 7.4.33-1.47.2

php74-calendar: before 7.4.33-1.47.2

php74-bz2-debuginfo: before 7.4.33-1.47.2

php74-bz2: before 7.4.33-1.47.2

php74-bcmath-debuginfo: before 7.4.33-1.47.2

php74-bcmath: before 7.4.33-1.47.2

php74: before 7.4.33-1.47.2

apache2-mod_php74-debuginfo: before 7.4.33-1.47.2

apache2-mod_php74: before 7.4.33-1.47.2

php74-devel: before 7.4.33-1.47.2

php74-debugsource: before 7.4.33-1.47.2

php74-debuginfo: before 7.4.33-1.47.2

CPE2.3

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications:12-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications:12-SP4:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications:12-SP5:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing:12:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server:12-SP2-LTSS-ERICSSON:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server:12-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server:12-SP4:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_module_for_web_scripting:12:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_software_development_kit:12-SP5:*:*:*:*:*:*:*
• cpe:2.3:a:suse:php74-zlib-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-zlib:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-zip-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-zip:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xsl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xsl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xmlwriter-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xmlwriter:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xmlrpc-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xmlrpc:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xmlreader-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xmlreader:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-tokenizer-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-tokenizer:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-tidy-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-tidy:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sysvshm-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sysvshm:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sysvsem-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sysvsem:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sysvmsg-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sysvmsg:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sqlite-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sqlite:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sodium-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sodium:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sockets-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sockets:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-soap-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-soap:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-snmp-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-snmp:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-shmop-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-shmop:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-readline-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-readline:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-posix-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-posix:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-phar-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-phar:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-pgsql-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-pgsql:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-pdo-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-pdo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-pcntl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-pcntl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-openssl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-openssl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-opcache-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-opcache:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-odbc-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-odbc:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-mysql-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-mysql:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-mbstring-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-mbstring:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-ldap-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-ldap:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-json-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-json:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-intl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-intl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-iconv-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-iconv:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-gmp-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-gmp:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-gettext-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-gettext:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-gd-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-gd:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-ftp-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-ftp:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-fpm-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-fpm:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-fileinfo-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-fileinfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-fastcgi-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-fastcgi:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-exif-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-exif:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-enchant-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-enchant:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-dom-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-dom:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-dba-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-dba:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-curl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-curl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-ctype-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-ctype:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-calendar-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-calendar:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-bz2-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-bz2:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-bcmath-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-bcmath:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:apache2-mod_php74-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:apache2-mod_php74:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-devel:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-debugsource:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-debuginfo:*:*:*:*:*:suse_linux:*:*

External links

https://www.suse.com/support/update/announcement/2022/suse-su-20224068-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Server-Side Request Forgery (SSRF)

EUVDB-ID: #VU54565

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2021-21705

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

Exploit availability: No

Description

The disclosed vulnerability allows a remote attacker to perform SSRF attacks.

The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can send a specially crafted HTTP request, bypass the FILTER_VALIDATE_URL and trick the application to initiate requests to arbitrary systems.

Successful exploitation of this vulnerability may allow a remote attacker gain access to sensitive data, located in the local network or send malicious requests to other servers from the vulnerable system.

Mitigation

Update the affected package php74 to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Server for SAP Applications: 12-SP3 - 12-SP5

SUSE Linux Enterprise High Performance Computing: 12

SUSE Linux Enterprise Server: 12-SP2-LTSS-ERICSSON - 12-SP5

SUSE Linux Enterprise Module for Web Scripting: 12

SUSE Linux Enterprise Software Development Kit: 12-SP5

php74-zlib-debuginfo: before 7.4.33-1.47.2

php74-zlib: before 7.4.33-1.47.2

php74-zip-debuginfo: before 7.4.33-1.47.2

php74-zip: before 7.4.33-1.47.2

php74-xsl-debuginfo: before 7.4.33-1.47.2

php74-xsl: before 7.4.33-1.47.2

php74-xmlwriter-debuginfo: before 7.4.33-1.47.2

php74-xmlwriter: before 7.4.33-1.47.2

php74-xmlrpc-debuginfo: before 7.4.33-1.47.2

php74-xmlrpc: before 7.4.33-1.47.2

php74-xmlreader-debuginfo: before 7.4.33-1.47.2

php74-xmlreader: before 7.4.33-1.47.2

php74-tokenizer-debuginfo: before 7.4.33-1.47.2

php74-tokenizer: before 7.4.33-1.47.2

php74-tidy-debuginfo: before 7.4.33-1.47.2

php74-tidy: before 7.4.33-1.47.2

php74-sysvshm-debuginfo: before 7.4.33-1.47.2

php74-sysvshm: before 7.4.33-1.47.2

php74-sysvsem-debuginfo: before 7.4.33-1.47.2

php74-sysvsem: before 7.4.33-1.47.2

php74-sysvmsg-debuginfo: before 7.4.33-1.47.2

php74-sysvmsg: before 7.4.33-1.47.2

php74-sqlite-debuginfo: before 7.4.33-1.47.2

php74-sqlite: before 7.4.33-1.47.2

php74-sodium-debuginfo: before 7.4.33-1.47.2

php74-sodium: before 7.4.33-1.47.2

php74-sockets-debuginfo: before 7.4.33-1.47.2

php74-sockets: before 7.4.33-1.47.2

php74-soap-debuginfo: before 7.4.33-1.47.2

php74-soap: before 7.4.33-1.47.2

php74-snmp-debuginfo: before 7.4.33-1.47.2

php74-snmp: before 7.4.33-1.47.2

php74-shmop-debuginfo: before 7.4.33-1.47.2

php74-shmop: before 7.4.33-1.47.2

php74-readline-debuginfo: before 7.4.33-1.47.2

php74-readline: before 7.4.33-1.47.2

php74-posix-debuginfo: before 7.4.33-1.47.2

php74-posix: before 7.4.33-1.47.2

php74-phar-debuginfo: before 7.4.33-1.47.2

php74-phar: before 7.4.33-1.47.2

php74-pgsql-debuginfo: before 7.4.33-1.47.2

php74-pgsql: before 7.4.33-1.47.2

php74-pdo-debuginfo: before 7.4.33-1.47.2

php74-pdo: before 7.4.33-1.47.2

php74-pcntl-debuginfo: before 7.4.33-1.47.2

php74-pcntl: before 7.4.33-1.47.2

php74-openssl-debuginfo: before 7.4.33-1.47.2

php74-openssl: before 7.4.33-1.47.2

php74-opcache-debuginfo: before 7.4.33-1.47.2

php74-opcache: before 7.4.33-1.47.2

php74-odbc-debuginfo: before 7.4.33-1.47.2

php74-odbc: before 7.4.33-1.47.2

php74-mysql-debuginfo: before 7.4.33-1.47.2

php74-mysql: before 7.4.33-1.47.2

php74-mbstring-debuginfo: before 7.4.33-1.47.2

php74-mbstring: before 7.4.33-1.47.2

php74-ldap-debuginfo: before 7.4.33-1.47.2

php74-ldap: before 7.4.33-1.47.2

php74-json-debuginfo: before 7.4.33-1.47.2

php74-json: before 7.4.33-1.47.2

php74-intl-debuginfo: before 7.4.33-1.47.2

php74-intl: before 7.4.33-1.47.2

php74-iconv-debuginfo: before 7.4.33-1.47.2

php74-iconv: before 7.4.33-1.47.2

php74-gmp-debuginfo: before 7.4.33-1.47.2

php74-gmp: before 7.4.33-1.47.2

php74-gettext-debuginfo: before 7.4.33-1.47.2

php74-gettext: before 7.4.33-1.47.2

php74-gd-debuginfo: before 7.4.33-1.47.2

php74-gd: before 7.4.33-1.47.2

php74-ftp-debuginfo: before 7.4.33-1.47.2

php74-ftp: before 7.4.33-1.47.2

php74-fpm-debuginfo: before 7.4.33-1.47.2

php74-fpm: before 7.4.33-1.47.2

php74-fileinfo-debuginfo: before 7.4.33-1.47.2

php74-fileinfo: before 7.4.33-1.47.2

php74-fastcgi-debuginfo: before 7.4.33-1.47.2

php74-fastcgi: before 7.4.33-1.47.2

php74-exif-debuginfo: before 7.4.33-1.47.2

php74-exif: before 7.4.33-1.47.2

php74-enchant-debuginfo: before 7.4.33-1.47.2

php74-enchant: before 7.4.33-1.47.2

php74-dom-debuginfo: before 7.4.33-1.47.2

php74-dom: before 7.4.33-1.47.2

php74-dba-debuginfo: before 7.4.33-1.47.2

php74-dba: before 7.4.33-1.47.2

php74-curl-debuginfo: before 7.4.33-1.47.2

php74-curl: before 7.4.33-1.47.2

php74-ctype-debuginfo: before 7.4.33-1.47.2

php74-ctype: before 7.4.33-1.47.2

php74-calendar-debuginfo: before 7.4.33-1.47.2

php74-calendar: before 7.4.33-1.47.2

php74-bz2-debuginfo: before 7.4.33-1.47.2

php74-bz2: before 7.4.33-1.47.2

php74-bcmath-debuginfo: before 7.4.33-1.47.2

php74-bcmath: before 7.4.33-1.47.2

php74: before 7.4.33-1.47.2

apache2-mod_php74-debuginfo: before 7.4.33-1.47.2

apache2-mod_php74: before 7.4.33-1.47.2

php74-devel: before 7.4.33-1.47.2

php74-debugsource: before 7.4.33-1.47.2

php74-debuginfo: before 7.4.33-1.47.2

CPE2.3

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications:12-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications:12-SP4:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications:12-SP5:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing:12:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server:12-SP2-LTSS-ERICSSON:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server:12-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server:12-SP4:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_module_for_web_scripting:12:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_software_development_kit:12-SP5:*:*:*:*:*:*:*
• cpe:2.3:a:suse:php74-zlib-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-zlib:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-zip-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-zip:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xsl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xsl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xmlwriter-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xmlwriter:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xmlrpc-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xmlrpc:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xmlreader-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xmlreader:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-tokenizer-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-tokenizer:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-tidy-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-tidy:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sysvshm-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sysvshm:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sysvsem-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sysvsem:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sysvmsg-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sysvmsg:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sqlite-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sqlite:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sodium-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sodium:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sockets-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sockets:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-soap-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-soap:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-snmp-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-snmp:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-shmop-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-shmop:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-readline-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-readline:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-posix-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-posix:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-phar-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-phar:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-pgsql-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-pgsql:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-pdo-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-pdo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-pcntl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-pcntl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-openssl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-openssl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-opcache-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-opcache:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-odbc-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-odbc:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-mysql-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-mysql:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-mbstring-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-mbstring:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-ldap-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-ldap:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-json-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-json:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-intl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-intl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-iconv-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-iconv:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-gmp-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-gmp:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-gettext-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-gettext:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-gd-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-gd:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-ftp-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-ftp:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-fpm-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-fpm:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-fileinfo-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-fileinfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-fastcgi-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-fastcgi:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-exif-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-exif:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-enchant-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-enchant:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-dom-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-dom:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-dba-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-dba:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-curl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-curl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-ctype-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-ctype:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-calendar-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-calendar:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-bz2-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-bz2:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-bcmath-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-bcmath:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:apache2-mod_php74-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:apache2-mod_php74:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-devel:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-debugsource:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-debuginfo:*:*:*:*:*:suse_linux:*:*

External links

https://www.suse.com/support/update/announcement/2022/suse-su-20224068-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Absolute Path Traversal

EUVDB-ID: #VU56905

Risk: Medium

CVSSv4.0: 6.9 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2021-21706

CWE-ID: CWE-36 - Absolute Path Traversal

Exploit availability: No

Description

The vulnerability allows a remote attacker overwrite files on the system.

The vulnerability exists due to insufficient filtration of file names in the php_zip_make_relative_path() function on Windows systems. A remote attacker can construct a specially crafted ZIP archive, which once extracted by the ZipArchive::extractTo() function, can overwrite files outside of the destination directory.

Successful exploitation of the vulnerability may allow an attacker to overwrite arbitrary files on the system with privileges of the web server, but requires that the web application is running on Windows.

Mitigation

Update the affected package php74 to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Server for SAP Applications: 12-SP3 - 12-SP5

SUSE Linux Enterprise High Performance Computing: 12

SUSE Linux Enterprise Server: 12-SP2-LTSS-ERICSSON - 12-SP5

SUSE Linux Enterprise Module for Web Scripting: 12

SUSE Linux Enterprise Software Development Kit: 12-SP5

php74-zlib-debuginfo: before 7.4.33-1.47.2

php74-zlib: before 7.4.33-1.47.2

php74-zip-debuginfo: before 7.4.33-1.47.2

php74-zip: before 7.4.33-1.47.2

php74-xsl-debuginfo: before 7.4.33-1.47.2

php74-xsl: before 7.4.33-1.47.2

php74-xmlwriter-debuginfo: before 7.4.33-1.47.2

php74-xmlwriter: before 7.4.33-1.47.2

php74-xmlrpc-debuginfo: before 7.4.33-1.47.2

php74-xmlrpc: before 7.4.33-1.47.2

php74-xmlreader-debuginfo: before 7.4.33-1.47.2

php74-xmlreader: before 7.4.33-1.47.2

php74-tokenizer-debuginfo: before 7.4.33-1.47.2

php74-tokenizer: before 7.4.33-1.47.2

php74-tidy-debuginfo: before 7.4.33-1.47.2

php74-tidy: before 7.4.33-1.47.2

php74-sysvshm-debuginfo: before 7.4.33-1.47.2

php74-sysvshm: before 7.4.33-1.47.2

php74-sysvsem-debuginfo: before 7.4.33-1.47.2

php74-sysvsem: before 7.4.33-1.47.2

php74-sysvmsg-debuginfo: before 7.4.33-1.47.2

php74-sysvmsg: before 7.4.33-1.47.2

php74-sqlite-debuginfo: before 7.4.33-1.47.2

php74-sqlite: before 7.4.33-1.47.2

php74-sodium-debuginfo: before 7.4.33-1.47.2

php74-sodium: before 7.4.33-1.47.2

php74-sockets-debuginfo: before 7.4.33-1.47.2

php74-sockets: before 7.4.33-1.47.2

php74-soap-debuginfo: before 7.4.33-1.47.2

php74-soap: before 7.4.33-1.47.2

php74-snmp-debuginfo: before 7.4.33-1.47.2

php74-snmp: before 7.4.33-1.47.2

php74-shmop-debuginfo: before 7.4.33-1.47.2

php74-shmop: before 7.4.33-1.47.2

php74-readline-debuginfo: before 7.4.33-1.47.2

php74-readline: before 7.4.33-1.47.2

php74-posix-debuginfo: before 7.4.33-1.47.2

php74-posix: before 7.4.33-1.47.2

php74-phar-debuginfo: before 7.4.33-1.47.2

php74-phar: before 7.4.33-1.47.2

php74-pgsql-debuginfo: before 7.4.33-1.47.2

php74-pgsql: before 7.4.33-1.47.2

php74-pdo-debuginfo: before 7.4.33-1.47.2

php74-pdo: before 7.4.33-1.47.2

php74-pcntl-debuginfo: before 7.4.33-1.47.2

php74-pcntl: before 7.4.33-1.47.2

php74-openssl-debuginfo: before 7.4.33-1.47.2

php74-openssl: before 7.4.33-1.47.2

php74-opcache-debuginfo: before 7.4.33-1.47.2

php74-opcache: before 7.4.33-1.47.2

php74-odbc-debuginfo: before 7.4.33-1.47.2

php74-odbc: before 7.4.33-1.47.2

php74-mysql-debuginfo: before 7.4.33-1.47.2

php74-mysql: before 7.4.33-1.47.2

php74-mbstring-debuginfo: before 7.4.33-1.47.2

php74-mbstring: before 7.4.33-1.47.2

php74-ldap-debuginfo: before 7.4.33-1.47.2

php74-ldap: before 7.4.33-1.47.2

php74-json-debuginfo: before 7.4.33-1.47.2

php74-json: before 7.4.33-1.47.2

php74-intl-debuginfo: before 7.4.33-1.47.2

php74-intl: before 7.4.33-1.47.2

php74-iconv-debuginfo: before 7.4.33-1.47.2

php74-iconv: before 7.4.33-1.47.2

php74-gmp-debuginfo: before 7.4.33-1.47.2

php74-gmp: before 7.4.33-1.47.2

php74-gettext-debuginfo: before 7.4.33-1.47.2

php74-gettext: before 7.4.33-1.47.2

php74-gd-debuginfo: before 7.4.33-1.47.2

php74-gd: before 7.4.33-1.47.2

php74-ftp-debuginfo: before 7.4.33-1.47.2

php74-ftp: before 7.4.33-1.47.2

php74-fpm-debuginfo: before 7.4.33-1.47.2

php74-fpm: before 7.4.33-1.47.2

php74-fileinfo-debuginfo: before 7.4.33-1.47.2

php74-fileinfo: before 7.4.33-1.47.2

php74-fastcgi-debuginfo: before 7.4.33-1.47.2

php74-fastcgi: before 7.4.33-1.47.2

php74-exif-debuginfo: before 7.4.33-1.47.2

php74-exif: before 7.4.33-1.47.2

php74-enchant-debuginfo: before 7.4.33-1.47.2

php74-enchant: before 7.4.33-1.47.2

php74-dom-debuginfo: before 7.4.33-1.47.2

php74-dom: before 7.4.33-1.47.2

php74-dba-debuginfo: before 7.4.33-1.47.2

php74-dba: before 7.4.33-1.47.2

php74-curl-debuginfo: before 7.4.33-1.47.2

php74-curl: before 7.4.33-1.47.2

php74-ctype-debuginfo: before 7.4.33-1.47.2

php74-ctype: before 7.4.33-1.47.2

php74-calendar-debuginfo: before 7.4.33-1.47.2

php74-calendar: before 7.4.33-1.47.2

php74-bz2-debuginfo: before 7.4.33-1.47.2

php74-bz2: before 7.4.33-1.47.2

php74-bcmath-debuginfo: before 7.4.33-1.47.2

php74-bcmath: before 7.4.33-1.47.2

php74: before 7.4.33-1.47.2

apache2-mod_php74-debuginfo: before 7.4.33-1.47.2

apache2-mod_php74: before 7.4.33-1.47.2

php74-devel: before 7.4.33-1.47.2

php74-debugsource: before 7.4.33-1.47.2

php74-debuginfo: before 7.4.33-1.47.2

CPE2.3

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications:12-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications:12-SP4:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications:12-SP5:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing:12:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server:12-SP2-LTSS-ERICSSON:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server:12-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server:12-SP4:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_module_for_web_scripting:12:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_software_development_kit:12-SP5:*:*:*:*:*:*:*
• cpe:2.3:a:suse:php74-zlib-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-zlib:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-zip-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-zip:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xsl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xsl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xmlwriter-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xmlwriter:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xmlrpc-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xmlrpc:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xmlreader-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xmlreader:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-tokenizer-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-tokenizer:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-tidy-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-tidy:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sysvshm-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sysvshm:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sysvsem-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sysvsem:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sysvmsg-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sysvmsg:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sqlite-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sqlite:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sodium-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sodium:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sockets-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sockets:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-soap-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-soap:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-snmp-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-snmp:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-shmop-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-shmop:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-readline-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-readline:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-posix-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-posix:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-phar-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-phar:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-pgsql-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-pgsql:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-pdo-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-pdo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-pcntl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-pcntl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-openssl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-openssl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-opcache-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-opcache:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-odbc-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-odbc:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-mysql-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-mysql:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-mbstring-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-mbstring:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-ldap-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-ldap:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-json-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-json:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-intl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-intl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-iconv-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-iconv:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-gmp-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-gmp:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-gettext-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-gettext:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-gd-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-gd:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-ftp-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-ftp:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-fpm-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-fpm:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-fileinfo-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-fileinfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-fastcgi-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-fastcgi:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-exif-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-exif:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-enchant-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-enchant:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-dom-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-dom:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-dba-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-dba:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-curl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-curl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-ctype-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-ctype:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-calendar-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-calendar:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-bz2-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-bz2:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-bcmath-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-bcmath:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:apache2-mod_php74-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:apache2-mod_php74:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-devel:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-debugsource:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-debuginfo:*:*:*:*:*:suse_linux:*:*

External links

https://www.suse.com/support/update/announcement/2022/suse-su-20224068-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

11) Input validation error

EUVDB-ID: #VU58331

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2021-21707

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to inject arbitrary XML code.

The vulnerability exists due to insufficient validation of user-supplied input within the simplexml_load_file() PHP function when processing NULL byte character (e.g. %00). A remote attacker can pass specially crafted URL to the application and bypass implemented security restrictions.

Mitigation

Update the affected package php74 to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Server for SAP Applications: 12-SP3 - 12-SP5

SUSE Linux Enterprise High Performance Computing: 12

SUSE Linux Enterprise Server: 12-SP2-LTSS-ERICSSON - 12-SP5

SUSE Linux Enterprise Module for Web Scripting: 12

SUSE Linux Enterprise Software Development Kit: 12-SP5

php74-zlib-debuginfo: before 7.4.33-1.47.2

php74-zlib: before 7.4.33-1.47.2

php74-zip-debuginfo: before 7.4.33-1.47.2

php74-zip: before 7.4.33-1.47.2

php74-xsl-debuginfo: before 7.4.33-1.47.2

php74-xsl: before 7.4.33-1.47.2

php74-xmlwriter-debuginfo: before 7.4.33-1.47.2

php74-xmlwriter: before 7.4.33-1.47.2

php74-xmlrpc-debuginfo: before 7.4.33-1.47.2

php74-xmlrpc: before 7.4.33-1.47.2

php74-xmlreader-debuginfo: before 7.4.33-1.47.2

php74-xmlreader: before 7.4.33-1.47.2

php74-tokenizer-debuginfo: before 7.4.33-1.47.2

php74-tokenizer: before 7.4.33-1.47.2

php74-tidy-debuginfo: before 7.4.33-1.47.2

php74-tidy: before 7.4.33-1.47.2

php74-sysvshm-debuginfo: before 7.4.33-1.47.2

php74-sysvshm: before 7.4.33-1.47.2

php74-sysvsem-debuginfo: before 7.4.33-1.47.2

php74-sysvsem: before 7.4.33-1.47.2

php74-sysvmsg-debuginfo: before 7.4.33-1.47.2

php74-sysvmsg: before 7.4.33-1.47.2

php74-sqlite-debuginfo: before 7.4.33-1.47.2

php74-sqlite: before 7.4.33-1.47.2

php74-sodium-debuginfo: before 7.4.33-1.47.2

php74-sodium: before 7.4.33-1.47.2

php74-sockets-debuginfo: before 7.4.33-1.47.2

php74-sockets: before 7.4.33-1.47.2

php74-soap-debuginfo: before 7.4.33-1.47.2

php74-soap: before 7.4.33-1.47.2

php74-snmp-debuginfo: before 7.4.33-1.47.2

php74-snmp: before 7.4.33-1.47.2

php74-shmop-debuginfo: before 7.4.33-1.47.2

php74-shmop: before 7.4.33-1.47.2

php74-readline-debuginfo: before 7.4.33-1.47.2

php74-readline: before 7.4.33-1.47.2

php74-posix-debuginfo: before 7.4.33-1.47.2

php74-posix: before 7.4.33-1.47.2

php74-phar-debuginfo: before 7.4.33-1.47.2

php74-phar: before 7.4.33-1.47.2

php74-pgsql-debuginfo: before 7.4.33-1.47.2

php74-pgsql: before 7.4.33-1.47.2

php74-pdo-debuginfo: before 7.4.33-1.47.2

php74-pdo: before 7.4.33-1.47.2

php74-pcntl-debuginfo: before 7.4.33-1.47.2

php74-pcntl: before 7.4.33-1.47.2

php74-openssl-debuginfo: before 7.4.33-1.47.2

php74-openssl: before 7.4.33-1.47.2

php74-opcache-debuginfo: before 7.4.33-1.47.2

php74-opcache: before 7.4.33-1.47.2

php74-odbc-debuginfo: before 7.4.33-1.47.2

php74-odbc: before 7.4.33-1.47.2

php74-mysql-debuginfo: before 7.4.33-1.47.2

php74-mysql: before 7.4.33-1.47.2

php74-mbstring-debuginfo: before 7.4.33-1.47.2

php74-mbstring: before 7.4.33-1.47.2

php74-ldap-debuginfo: before 7.4.33-1.47.2

php74-ldap: before 7.4.33-1.47.2

php74-json-debuginfo: before 7.4.33-1.47.2

php74-json: before 7.4.33-1.47.2

php74-intl-debuginfo: before 7.4.33-1.47.2

php74-intl: before 7.4.33-1.47.2

php74-iconv-debuginfo: before 7.4.33-1.47.2

php74-iconv: before 7.4.33-1.47.2

php74-gmp-debuginfo: before 7.4.33-1.47.2

php74-gmp: before 7.4.33-1.47.2

php74-gettext-debuginfo: before 7.4.33-1.47.2

php74-gettext: before 7.4.33-1.47.2

php74-gd-debuginfo: before 7.4.33-1.47.2

php74-gd: before 7.4.33-1.47.2

php74-ftp-debuginfo: before 7.4.33-1.47.2

php74-ftp: before 7.4.33-1.47.2

php74-fpm-debuginfo: before 7.4.33-1.47.2

php74-fpm: before 7.4.33-1.47.2

php74-fileinfo-debuginfo: before 7.4.33-1.47.2

php74-fileinfo: before 7.4.33-1.47.2

php74-fastcgi-debuginfo: before 7.4.33-1.47.2

php74-fastcgi: before 7.4.33-1.47.2

php74-exif-debuginfo: before 7.4.33-1.47.2

php74-exif: before 7.4.33-1.47.2

php74-enchant-debuginfo: before 7.4.33-1.47.2

php74-enchant: before 7.4.33-1.47.2

php74-dom-debuginfo: before 7.4.33-1.47.2

php74-dom: before 7.4.33-1.47.2

php74-dba-debuginfo: before 7.4.33-1.47.2

php74-dba: before 7.4.33-1.47.2

php74-curl-debuginfo: before 7.4.33-1.47.2

php74-curl: before 7.4.33-1.47.2

php74-ctype-debuginfo: before 7.4.33-1.47.2

php74-ctype: before 7.4.33-1.47.2

php74-calendar-debuginfo: before 7.4.33-1.47.2

php74-calendar: before 7.4.33-1.47.2

php74-bz2-debuginfo: before 7.4.33-1.47.2

php74-bz2: before 7.4.33-1.47.2

php74-bcmath-debuginfo: before 7.4.33-1.47.2

php74-bcmath: before 7.4.33-1.47.2

php74: before 7.4.33-1.47.2

apache2-mod_php74-debuginfo: before 7.4.33-1.47.2

apache2-mod_php74: before 7.4.33-1.47.2

php74-devel: before 7.4.33-1.47.2

php74-debugsource: before 7.4.33-1.47.2

php74-debuginfo: before 7.4.33-1.47.2

CPE2.3

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications:12-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications:12-SP4:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications:12-SP5:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing:12:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server:12-SP2-LTSS-ERICSSON:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server:12-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server:12-SP4:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_module_for_web_scripting:12:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_software_development_kit:12-SP5:*:*:*:*:*:*:*
• cpe:2.3:a:suse:php74-zlib-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-zlib:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-zip-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-zip:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xsl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xsl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xmlwriter-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xmlwriter:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xmlrpc-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xmlrpc:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xmlreader-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xmlreader:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-tokenizer-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-tokenizer:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-tidy-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-tidy:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sysvshm-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sysvshm:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sysvsem-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sysvsem:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sysvmsg-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sysvmsg:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sqlite-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sqlite:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sodium-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sodium:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sockets-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sockets:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-soap-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-soap:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-snmp-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-snmp:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-shmop-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-shmop:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-readline-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-readline:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-posix-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-posix:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-phar-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-phar:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-pgsql-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-pgsql:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-pdo-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-pdo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-pcntl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-pcntl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-openssl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-openssl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-opcache-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-opcache:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-odbc-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-odbc:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-mysql-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-mysql:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-mbstring-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-mbstring:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-ldap-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-ldap:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-json-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-json:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-intl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-intl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-iconv-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-iconv:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-gmp-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-gmp:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-gettext-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-gettext:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-gd-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-gd:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-ftp-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-ftp:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-fpm-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-fpm:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-fileinfo-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-fileinfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-fastcgi-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-fastcgi:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-exif-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-exif:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-enchant-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-enchant:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-dom-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-dom:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-dba-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-dba:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-curl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-curl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-ctype-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-ctype:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-calendar-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-calendar:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-bz2-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-bz2:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-bcmath-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-bcmath:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:apache2-mod_php74-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:apache2-mod_php74:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-devel:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-debugsource:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-debuginfo:*:*:*:*:*:suse_linux:*:*

External links

https://www.suse.com/support/update/announcement/2022/suse-su-20224068-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

12) Use-after-free

EUVDB-ID: #VU60707

Risk: Medium

CVSSv4.0: 5.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/U:Green]

CVE-ID: CVE-2021-21708

CWE-ID: CWE-416 - Use After Free

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a use-after-free error within the "php_filter_float()" function. A remote attacker can pass specially crafted input to the application that uses the affected PHP function, trigger a use-after-free error and crash the php-fpm process.

Mitigation

Update the affected package php74 to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Server for SAP Applications: 12-SP3 - 12-SP5

SUSE Linux Enterprise High Performance Computing: 12

SUSE Linux Enterprise Server: 12-SP2-LTSS-ERICSSON - 12-SP5

SUSE Linux Enterprise Module for Web Scripting: 12

SUSE Linux Enterprise Software Development Kit: 12-SP5

php74-zlib-debuginfo: before 7.4.33-1.47.2

php74-zlib: before 7.4.33-1.47.2

php74-zip-debuginfo: before 7.4.33-1.47.2

php74-zip: before 7.4.33-1.47.2

php74-xsl-debuginfo: before 7.4.33-1.47.2

php74-xsl: before 7.4.33-1.47.2

php74-xmlwriter-debuginfo: before 7.4.33-1.47.2

php74-xmlwriter: before 7.4.33-1.47.2

php74-xmlrpc-debuginfo: before 7.4.33-1.47.2

php74-xmlrpc: before 7.4.33-1.47.2

php74-xmlreader-debuginfo: before 7.4.33-1.47.2

php74-xmlreader: before 7.4.33-1.47.2

php74-tokenizer-debuginfo: before 7.4.33-1.47.2

php74-tokenizer: before 7.4.33-1.47.2

php74-tidy-debuginfo: before 7.4.33-1.47.2

php74-tidy: before 7.4.33-1.47.2

php74-sysvshm-debuginfo: before 7.4.33-1.47.2

php74-sysvshm: before 7.4.33-1.47.2

php74-sysvsem-debuginfo: before 7.4.33-1.47.2

php74-sysvsem: before 7.4.33-1.47.2

php74-sysvmsg-debuginfo: before 7.4.33-1.47.2

php74-sysvmsg: before 7.4.33-1.47.2

php74-sqlite-debuginfo: before 7.4.33-1.47.2

php74-sqlite: before 7.4.33-1.47.2

php74-sodium-debuginfo: before 7.4.33-1.47.2

php74-sodium: before 7.4.33-1.47.2

php74-sockets-debuginfo: before 7.4.33-1.47.2

php74-sockets: before 7.4.33-1.47.2

php74-soap-debuginfo: before 7.4.33-1.47.2

php74-soap: before 7.4.33-1.47.2

php74-snmp-debuginfo: before 7.4.33-1.47.2

php74-snmp: before 7.4.33-1.47.2

php74-shmop-debuginfo: before 7.4.33-1.47.2

php74-shmop: before 7.4.33-1.47.2

php74-readline-debuginfo: before 7.4.33-1.47.2

php74-readline: before 7.4.33-1.47.2

php74-posix-debuginfo: before 7.4.33-1.47.2

php74-posix: before 7.4.33-1.47.2

php74-phar-debuginfo: before 7.4.33-1.47.2

php74-phar: before 7.4.33-1.47.2

php74-pgsql-debuginfo: before 7.4.33-1.47.2

php74-pgsql: before 7.4.33-1.47.2

php74-pdo-debuginfo: before 7.4.33-1.47.2

php74-pdo: before 7.4.33-1.47.2

php74-pcntl-debuginfo: before 7.4.33-1.47.2

php74-pcntl: before 7.4.33-1.47.2

php74-openssl-debuginfo: before 7.4.33-1.47.2

php74-openssl: before 7.4.33-1.47.2

php74-opcache-debuginfo: before 7.4.33-1.47.2

php74-opcache: before 7.4.33-1.47.2

php74-odbc-debuginfo: before 7.4.33-1.47.2

php74-odbc: before 7.4.33-1.47.2

php74-mysql-debuginfo: before 7.4.33-1.47.2

php74-mysql: before 7.4.33-1.47.2

php74-mbstring-debuginfo: before 7.4.33-1.47.2

php74-mbstring: before 7.4.33-1.47.2

php74-ldap-debuginfo: before 7.4.33-1.47.2

php74-ldap: before 7.4.33-1.47.2

php74-json-debuginfo: before 7.4.33-1.47.2

php74-json: before 7.4.33-1.47.2

php74-intl-debuginfo: before 7.4.33-1.47.2

php74-intl: before 7.4.33-1.47.2

php74-iconv-debuginfo: before 7.4.33-1.47.2

php74-iconv: before 7.4.33-1.47.2

php74-gmp-debuginfo: before 7.4.33-1.47.2

php74-gmp: before 7.4.33-1.47.2

php74-gettext-debuginfo: before 7.4.33-1.47.2

php74-gettext: before 7.4.33-1.47.2

php74-gd-debuginfo: before 7.4.33-1.47.2

php74-gd: before 7.4.33-1.47.2

php74-ftp-debuginfo: before 7.4.33-1.47.2

php74-ftp: before 7.4.33-1.47.2

php74-fpm-debuginfo: before 7.4.33-1.47.2

php74-fpm: before 7.4.33-1.47.2

php74-fileinfo-debuginfo: before 7.4.33-1.47.2

php74-fileinfo: before 7.4.33-1.47.2

php74-fastcgi-debuginfo: before 7.4.33-1.47.2

php74-fastcgi: before 7.4.33-1.47.2

php74-exif-debuginfo: before 7.4.33-1.47.2

php74-exif: before 7.4.33-1.47.2

php74-enchant-debuginfo: before 7.4.33-1.47.2

php74-enchant: before 7.4.33-1.47.2

php74-dom-debuginfo: before 7.4.33-1.47.2

php74-dom: before 7.4.33-1.47.2

php74-dba-debuginfo: before 7.4.33-1.47.2

php74-dba: before 7.4.33-1.47.2

php74-curl-debuginfo: before 7.4.33-1.47.2

php74-curl: before 7.4.33-1.47.2

php74-ctype-debuginfo: before 7.4.33-1.47.2

php74-ctype: before 7.4.33-1.47.2

php74-calendar-debuginfo: before 7.4.33-1.47.2

php74-calendar: before 7.4.33-1.47.2

php74-bz2-debuginfo: before 7.4.33-1.47.2

php74-bz2: before 7.4.33-1.47.2

php74-bcmath-debuginfo: before 7.4.33-1.47.2

php74-bcmath: before 7.4.33-1.47.2

php74: before 7.4.33-1.47.2

apache2-mod_php74-debuginfo: before 7.4.33-1.47.2

apache2-mod_php74: before 7.4.33-1.47.2

php74-devel: before 7.4.33-1.47.2

php74-debugsource: before 7.4.33-1.47.2

php74-debuginfo: before 7.4.33-1.47.2

CPE2.3

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications:12-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications:12-SP4:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications:12-SP5:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing:12:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server:12-SP2-LTSS-ERICSSON:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server:12-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server:12-SP4:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_module_for_web_scripting:12:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_software_development_kit:12-SP5:*:*:*:*:*:*:*
• cpe:2.3:a:suse:php74-zlib-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-zlib:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-zip-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-zip:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xsl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xsl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xmlwriter-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xmlwriter:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xmlrpc-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xmlrpc:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xmlreader-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xmlreader:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-tokenizer-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-tokenizer:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-tidy-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-tidy:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sysvshm-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sysvshm:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sysvsem-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sysvsem:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sysvmsg-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sysvmsg:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sqlite-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sqlite:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sodium-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sodium:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sockets-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sockets:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-soap-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-soap:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-snmp-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-snmp:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-shmop-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-shmop:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-readline-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-readline:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-posix-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-posix:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-phar-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-phar:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-pgsql-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-pgsql:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-pdo-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-pdo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-pcntl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-pcntl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-openssl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-openssl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-opcache-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-opcache:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-odbc-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-odbc:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-mysql-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-mysql:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-mbstring-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-mbstring:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-ldap-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-ldap:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-json-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-json:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-intl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-intl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-iconv-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-iconv:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-gmp-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-gmp:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-gettext-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-gettext:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-gd-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-gd:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-ftp-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-ftp:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-fpm-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-fpm:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-fileinfo-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-fileinfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-fastcgi-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-fastcgi:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-exif-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-exif:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-enchant-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-enchant:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-dom-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-dom:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-dba-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-dba:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-curl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-curl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-ctype-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-ctype:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-calendar-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-calendar:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-bz2-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-bz2:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-bcmath-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-bcmath:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:apache2-mod_php74-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:apache2-mod_php74:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-devel:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-debugsource:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-debuginfo:*:*:*:*:*:suse_linux:*:*

External links

https://www.suse.com/support/update/announcement/2022/suse-su-20224068-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

13) Use of uninitialized resource

EUVDB-ID: #VU64232

Risk: High

CVSSv4.0: 7.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2022-31625

CWE-ID: CWE-908 - Use of Uninitialized Resource

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the system.

The vulnerability exists due to usage of uninitialized array in the pg_query_params() function. A remote attacker with ability to control query parameters can trigger memory corruption and execute arbitrary code on the system.

Mitigation

Update the affected package php74 to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Server for SAP Applications: 12-SP3 - 12-SP5

SUSE Linux Enterprise High Performance Computing: 12

SUSE Linux Enterprise Server: 12-SP2-LTSS-ERICSSON - 12-SP5

SUSE Linux Enterprise Module for Web Scripting: 12

SUSE Linux Enterprise Software Development Kit: 12-SP5

php74-zlib-debuginfo: before 7.4.33-1.47.2

php74-zlib: before 7.4.33-1.47.2

php74-zip-debuginfo: before 7.4.33-1.47.2

php74-zip: before 7.4.33-1.47.2

php74-xsl-debuginfo: before 7.4.33-1.47.2

php74-xsl: before 7.4.33-1.47.2

php74-xmlwriter-debuginfo: before 7.4.33-1.47.2

php74-xmlwriter: before 7.4.33-1.47.2

php74-xmlrpc-debuginfo: before 7.4.33-1.47.2

php74-xmlrpc: before 7.4.33-1.47.2

php74-xmlreader-debuginfo: before 7.4.33-1.47.2

php74-xmlreader: before 7.4.33-1.47.2

php74-tokenizer-debuginfo: before 7.4.33-1.47.2

php74-tokenizer: before 7.4.33-1.47.2

php74-tidy-debuginfo: before 7.4.33-1.47.2

php74-tidy: before 7.4.33-1.47.2

php74-sysvshm-debuginfo: before 7.4.33-1.47.2

php74-sysvshm: before 7.4.33-1.47.2

php74-sysvsem-debuginfo: before 7.4.33-1.47.2

php74-sysvsem: before 7.4.33-1.47.2

php74-sysvmsg-debuginfo: before 7.4.33-1.47.2

php74-sysvmsg: before 7.4.33-1.47.2

php74-sqlite-debuginfo: before 7.4.33-1.47.2

php74-sqlite: before 7.4.33-1.47.2

php74-sodium-debuginfo: before 7.4.33-1.47.2

php74-sodium: before 7.4.33-1.47.2

php74-sockets-debuginfo: before 7.4.33-1.47.2

php74-sockets: before 7.4.33-1.47.2

php74-soap-debuginfo: before 7.4.33-1.47.2

php74-soap: before 7.4.33-1.47.2

php74-snmp-debuginfo: before 7.4.33-1.47.2

php74-snmp: before 7.4.33-1.47.2

php74-shmop-debuginfo: before 7.4.33-1.47.2

php74-shmop: before 7.4.33-1.47.2

php74-readline-debuginfo: before 7.4.33-1.47.2

php74-readline: before 7.4.33-1.47.2

php74-posix-debuginfo: before 7.4.33-1.47.2

php74-posix: before 7.4.33-1.47.2

php74-phar-debuginfo: before 7.4.33-1.47.2

php74-phar: before 7.4.33-1.47.2

php74-pgsql-debuginfo: before 7.4.33-1.47.2

php74-pgsql: before 7.4.33-1.47.2

php74-pdo-debuginfo: before 7.4.33-1.47.2

php74-pdo: before 7.4.33-1.47.2

php74-pcntl-debuginfo: before 7.4.33-1.47.2

php74-pcntl: before 7.4.33-1.47.2

php74-openssl-debuginfo: before 7.4.33-1.47.2

php74-openssl: before 7.4.33-1.47.2

php74-opcache-debuginfo: before 7.4.33-1.47.2

php74-opcache: before 7.4.33-1.47.2

php74-odbc-debuginfo: before 7.4.33-1.47.2

php74-odbc: before 7.4.33-1.47.2

php74-mysql-debuginfo: before 7.4.33-1.47.2

php74-mysql: before 7.4.33-1.47.2

php74-mbstring-debuginfo: before 7.4.33-1.47.2

php74-mbstring: before 7.4.33-1.47.2

php74-ldap-debuginfo: before 7.4.33-1.47.2

php74-ldap: before 7.4.33-1.47.2

php74-json-debuginfo: before 7.4.33-1.47.2

php74-json: before 7.4.33-1.47.2

php74-intl-debuginfo: before 7.4.33-1.47.2

php74-intl: before 7.4.33-1.47.2

php74-iconv-debuginfo: before 7.4.33-1.47.2

php74-iconv: before 7.4.33-1.47.2

php74-gmp-debuginfo: before 7.4.33-1.47.2

php74-gmp: before 7.4.33-1.47.2

php74-gettext-debuginfo: before 7.4.33-1.47.2

php74-gettext: before 7.4.33-1.47.2

php74-gd-debuginfo: before 7.4.33-1.47.2

php74-gd: before 7.4.33-1.47.2

php74-ftp-debuginfo: before 7.4.33-1.47.2

php74-ftp: before 7.4.33-1.47.2

php74-fpm-debuginfo: before 7.4.33-1.47.2

php74-fpm: before 7.4.33-1.47.2

php74-fileinfo-debuginfo: before 7.4.33-1.47.2

php74-fileinfo: before 7.4.33-1.47.2

php74-fastcgi-debuginfo: before 7.4.33-1.47.2

php74-fastcgi: before 7.4.33-1.47.2

php74-exif-debuginfo: before 7.4.33-1.47.2

php74-exif: before 7.4.33-1.47.2

php74-enchant-debuginfo: before 7.4.33-1.47.2

php74-enchant: before 7.4.33-1.47.2

php74-dom-debuginfo: before 7.4.33-1.47.2

php74-dom: before 7.4.33-1.47.2

php74-dba-debuginfo: before 7.4.33-1.47.2

php74-dba: before 7.4.33-1.47.2

php74-curl-debuginfo: before 7.4.33-1.47.2

php74-curl: before 7.4.33-1.47.2

php74-ctype-debuginfo: before 7.4.33-1.47.2

php74-ctype: before 7.4.33-1.47.2

php74-calendar-debuginfo: before 7.4.33-1.47.2

php74-calendar: before 7.4.33-1.47.2

php74-bz2-debuginfo: before 7.4.33-1.47.2

php74-bz2: before 7.4.33-1.47.2

php74-bcmath-debuginfo: before 7.4.33-1.47.2

php74-bcmath: before 7.4.33-1.47.2

php74: before 7.4.33-1.47.2

apache2-mod_php74-debuginfo: before 7.4.33-1.47.2

apache2-mod_php74: before 7.4.33-1.47.2

php74-devel: before 7.4.33-1.47.2

php74-debugsource: before 7.4.33-1.47.2

php74-debuginfo: before 7.4.33-1.47.2

CPE2.3

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications:12-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications:12-SP4:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications:12-SP5:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing:12:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server:12-SP2-LTSS-ERICSSON:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server:12-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server:12-SP4:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_module_for_web_scripting:12:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_software_development_kit:12-SP5:*:*:*:*:*:*:*
• cpe:2.3:a:suse:php74-zlib-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-zlib:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-zip-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-zip:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xsl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xsl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xmlwriter-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xmlwriter:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xmlrpc-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xmlrpc:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xmlreader-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xmlreader:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-tokenizer-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-tokenizer:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-tidy-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-tidy:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sysvshm-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sysvshm:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sysvsem-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sysvsem:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sysvmsg-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sysvmsg:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sqlite-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sqlite:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sodium-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sodium:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sockets-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sockets:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-soap-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-soap:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-snmp-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-snmp:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-shmop-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-shmop:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-readline-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-readline:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-posix-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-posix:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-phar-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-phar:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-pgsql-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-pgsql:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-pdo-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-pdo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-pcntl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-pcntl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-openssl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-openssl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-opcache-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-opcache:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-odbc-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-odbc:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-mysql-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-mysql:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-mbstring-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-mbstring:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-ldap-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-ldap:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-json-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-json:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-intl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-intl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-iconv-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-iconv:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-gmp-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-gmp:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-gettext-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-gettext:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-gd-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-gd:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-ftp-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-ftp:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-fpm-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-fpm:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-fileinfo-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-fileinfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-fastcgi-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-fastcgi:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-exif-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-exif:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-enchant-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-enchant:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-dom-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-dom:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-dba-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-dba:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-curl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-curl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-ctype-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-ctype:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-calendar-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-calendar:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-bz2-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-bz2:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-bcmath-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-bcmath:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:apache2-mod_php74-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:apache2-mod_php74:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-devel:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-debugsource:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-debuginfo:*:*:*:*:*:suse_linux:*:*

External links

https://www.suse.com/support/update/announcement/2022/suse-su-20224068-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

14) Buffer overflow

EUVDB-ID: #VU64231

Risk: High

CVSSv4.0: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Amber]

CVE-ID: CVE-2022-31626

CWE-ID: CWE-119 - Memory corruption

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing password in mysqlnd/pdo in mysqlnd_wireprotocol.c. A remote attacker with ability to control password that is passed via PDO to MySQL server can trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update the affected package php74 to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Server for SAP Applications: 12-SP3 - 12-SP5

SUSE Linux Enterprise High Performance Computing: 12

SUSE Linux Enterprise Server: 12-SP2-LTSS-ERICSSON - 12-SP5

SUSE Linux Enterprise Module for Web Scripting: 12

SUSE Linux Enterprise Software Development Kit: 12-SP5

php74-zlib-debuginfo: before 7.4.33-1.47.2

php74-zlib: before 7.4.33-1.47.2

php74-zip-debuginfo: before 7.4.33-1.47.2

php74-zip: before 7.4.33-1.47.2

php74-xsl-debuginfo: before 7.4.33-1.47.2

php74-xsl: before 7.4.33-1.47.2

php74-xmlwriter-debuginfo: before 7.4.33-1.47.2

php74-xmlwriter: before 7.4.33-1.47.2

php74-xmlrpc-debuginfo: before 7.4.33-1.47.2

php74-xmlrpc: before 7.4.33-1.47.2

php74-xmlreader-debuginfo: before 7.4.33-1.47.2

php74-xmlreader: before 7.4.33-1.47.2

php74-tokenizer-debuginfo: before 7.4.33-1.47.2

php74-tokenizer: before 7.4.33-1.47.2

php74-tidy-debuginfo: before 7.4.33-1.47.2

php74-tidy: before 7.4.33-1.47.2

php74-sysvshm-debuginfo: before 7.4.33-1.47.2

php74-sysvshm: before 7.4.33-1.47.2

php74-sysvsem-debuginfo: before 7.4.33-1.47.2

php74-sysvsem: before 7.4.33-1.47.2

php74-sysvmsg-debuginfo: before 7.4.33-1.47.2

php74-sysvmsg: before 7.4.33-1.47.2

php74-sqlite-debuginfo: before 7.4.33-1.47.2

php74-sqlite: before 7.4.33-1.47.2

php74-sodium-debuginfo: before 7.4.33-1.47.2

php74-sodium: before 7.4.33-1.47.2

php74-sockets-debuginfo: before 7.4.33-1.47.2

php74-sockets: before 7.4.33-1.47.2

php74-soap-debuginfo: before 7.4.33-1.47.2

php74-soap: before 7.4.33-1.47.2

php74-snmp-debuginfo: before 7.4.33-1.47.2

php74-snmp: before 7.4.33-1.47.2

php74-shmop-debuginfo: before 7.4.33-1.47.2

php74-shmop: before 7.4.33-1.47.2

php74-readline-debuginfo: before 7.4.33-1.47.2

php74-readline: before 7.4.33-1.47.2

php74-posix-debuginfo: before 7.4.33-1.47.2

php74-posix: before 7.4.33-1.47.2

php74-phar-debuginfo: before 7.4.33-1.47.2

php74-phar: before 7.4.33-1.47.2

php74-pgsql-debuginfo: before 7.4.33-1.47.2

php74-pgsql: before 7.4.33-1.47.2

php74-pdo-debuginfo: before 7.4.33-1.47.2

php74-pdo: before 7.4.33-1.47.2

php74-pcntl-debuginfo: before 7.4.33-1.47.2

php74-pcntl: before 7.4.33-1.47.2

php74-openssl-debuginfo: before 7.4.33-1.47.2

php74-openssl: before 7.4.33-1.47.2

php74-opcache-debuginfo: before 7.4.33-1.47.2

php74-opcache: before 7.4.33-1.47.2

php74-odbc-debuginfo: before 7.4.33-1.47.2

php74-odbc: before 7.4.33-1.47.2

php74-mysql-debuginfo: before 7.4.33-1.47.2

php74-mysql: before 7.4.33-1.47.2

php74-mbstring-debuginfo: before 7.4.33-1.47.2

php74-mbstring: before 7.4.33-1.47.2

php74-ldap-debuginfo: before 7.4.33-1.47.2

php74-ldap: before 7.4.33-1.47.2

php74-json-debuginfo: before 7.4.33-1.47.2

php74-json: before 7.4.33-1.47.2

php74-intl-debuginfo: before 7.4.33-1.47.2

php74-intl: before 7.4.33-1.47.2

php74-iconv-debuginfo: before 7.4.33-1.47.2

php74-iconv: before 7.4.33-1.47.2

php74-gmp-debuginfo: before 7.4.33-1.47.2

php74-gmp: before 7.4.33-1.47.2

php74-gettext-debuginfo: before 7.4.33-1.47.2

php74-gettext: before 7.4.33-1.47.2

php74-gd-debuginfo: before 7.4.33-1.47.2

php74-gd: before 7.4.33-1.47.2

php74-ftp-debuginfo: before 7.4.33-1.47.2

php74-ftp: before 7.4.33-1.47.2

php74-fpm-debuginfo: before 7.4.33-1.47.2

php74-fpm: before 7.4.33-1.47.2

php74-fileinfo-debuginfo: before 7.4.33-1.47.2

php74-fileinfo: before 7.4.33-1.47.2

php74-fastcgi-debuginfo: before 7.4.33-1.47.2

php74-fastcgi: before 7.4.33-1.47.2

php74-exif-debuginfo: before 7.4.33-1.47.2

php74-exif: before 7.4.33-1.47.2

php74-enchant-debuginfo: before 7.4.33-1.47.2

php74-enchant: before 7.4.33-1.47.2

php74-dom-debuginfo: before 7.4.33-1.47.2

php74-dom: before 7.4.33-1.47.2

php74-dba-debuginfo: before 7.4.33-1.47.2

php74-dba: before 7.4.33-1.47.2

php74-curl-debuginfo: before 7.4.33-1.47.2

php74-curl: before 7.4.33-1.47.2

php74-ctype-debuginfo: before 7.4.33-1.47.2

php74-ctype: before 7.4.33-1.47.2

php74-calendar-debuginfo: before 7.4.33-1.47.2

php74-calendar: before 7.4.33-1.47.2

php74-bz2-debuginfo: before 7.4.33-1.47.2

php74-bz2: before 7.4.33-1.47.2

php74-bcmath-debuginfo: before 7.4.33-1.47.2

php74-bcmath: before 7.4.33-1.47.2

php74: before 7.4.33-1.47.2

apache2-mod_php74-debuginfo: before 7.4.33-1.47.2

apache2-mod_php74: before 7.4.33-1.47.2

php74-devel: before 7.4.33-1.47.2

php74-debugsource: before 7.4.33-1.47.2

php74-debuginfo: before 7.4.33-1.47.2

CPE2.3

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications:12-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications:12-SP4:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications:12-SP5:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing:12:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server:12-SP2-LTSS-ERICSSON:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server:12-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server:12-SP4:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_module_for_web_scripting:12:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_software_development_kit:12-SP5:*:*:*:*:*:*:*
• cpe:2.3:a:suse:php74-zlib-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-zlib:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-zip-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-zip:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xsl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xsl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xmlwriter-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xmlwriter:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xmlrpc-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xmlrpc:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xmlreader-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xmlreader:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-tokenizer-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-tokenizer:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-tidy-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-tidy:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sysvshm-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sysvshm:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sysvsem-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sysvsem:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sysvmsg-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sysvmsg:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sqlite-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sqlite:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sodium-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sodium:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sockets-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sockets:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-soap-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-soap:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-snmp-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-snmp:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-shmop-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-shmop:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-readline-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-readline:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-posix-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-posix:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-phar-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-phar:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-pgsql-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-pgsql:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-pdo-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-pdo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-pcntl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-pcntl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-openssl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-openssl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-opcache-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-opcache:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-odbc-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-odbc:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-mysql-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-mysql:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-mbstring-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-mbstring:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-ldap-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-ldap:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-json-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-json:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-intl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-intl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-iconv-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-iconv:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-gmp-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-gmp:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-gettext-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-gettext:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-gd-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-gd:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-ftp-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-ftp:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-fpm-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-fpm:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-fileinfo-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-fileinfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-fastcgi-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-fastcgi:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-exif-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-exif:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-enchant-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-enchant:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-dom-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-dom:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-dba-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-dba:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-curl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-curl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-ctype-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-ctype:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-calendar-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-calendar:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-bz2-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-bz2:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-bcmath-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-bcmath:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:apache2-mod_php74-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:apache2-mod_php74:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-devel:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-debugsource:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-debuginfo:*:*:*:*:*:suse_linux:*:*

External links

https://www.suse.com/support/update/announcement/2022/suse-su-20224068-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

15) Infinite loop

EUVDB-ID: #VU67755

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2022-31628

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop within the phar uncompressor code when processing "quines" gzip files. A remote attacker can pass a specially crafted archive to the application, consume all available system resources and cause denial of service conditions.

Mitigation

Update the affected package php74 to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Server for SAP Applications: 12-SP3 - 12-SP5

SUSE Linux Enterprise High Performance Computing: 12

SUSE Linux Enterprise Server: 12-SP2-LTSS-ERICSSON - 12-SP5

SUSE Linux Enterprise Module for Web Scripting: 12

SUSE Linux Enterprise Software Development Kit: 12-SP5

php74-zlib-debuginfo: before 7.4.33-1.47.2

php74-zlib: before 7.4.33-1.47.2

php74-zip-debuginfo: before 7.4.33-1.47.2

php74-zip: before 7.4.33-1.47.2

php74-xsl-debuginfo: before 7.4.33-1.47.2

php74-xsl: before 7.4.33-1.47.2

php74-xmlwriter-debuginfo: before 7.4.33-1.47.2

php74-xmlwriter: before 7.4.33-1.47.2

php74-xmlrpc-debuginfo: before 7.4.33-1.47.2

php74-xmlrpc: before 7.4.33-1.47.2

php74-xmlreader-debuginfo: before 7.4.33-1.47.2

php74-xmlreader: before 7.4.33-1.47.2

php74-tokenizer-debuginfo: before 7.4.33-1.47.2

php74-tokenizer: before 7.4.33-1.47.2

php74-tidy-debuginfo: before 7.4.33-1.47.2

php74-tidy: before 7.4.33-1.47.2

php74-sysvshm-debuginfo: before 7.4.33-1.47.2

php74-sysvshm: before 7.4.33-1.47.2

php74-sysvsem-debuginfo: before 7.4.33-1.47.2

php74-sysvsem: before 7.4.33-1.47.2

php74-sysvmsg-debuginfo: before 7.4.33-1.47.2

php74-sysvmsg: before 7.4.33-1.47.2

php74-sqlite-debuginfo: before 7.4.33-1.47.2

php74-sqlite: before 7.4.33-1.47.2

php74-sodium-debuginfo: before 7.4.33-1.47.2

php74-sodium: before 7.4.33-1.47.2

php74-sockets-debuginfo: before 7.4.33-1.47.2

php74-sockets: before 7.4.33-1.47.2

php74-soap-debuginfo: before 7.4.33-1.47.2

php74-soap: before 7.4.33-1.47.2

php74-snmp-debuginfo: before 7.4.33-1.47.2

php74-snmp: before 7.4.33-1.47.2

php74-shmop-debuginfo: before 7.4.33-1.47.2

php74-shmop: before 7.4.33-1.47.2

php74-readline-debuginfo: before 7.4.33-1.47.2

php74-readline: before 7.4.33-1.47.2

php74-posix-debuginfo: before 7.4.33-1.47.2

php74-posix: before 7.4.33-1.47.2

php74-phar-debuginfo: before 7.4.33-1.47.2

php74-phar: before 7.4.33-1.47.2

php74-pgsql-debuginfo: before 7.4.33-1.47.2

php74-pgsql: before 7.4.33-1.47.2

php74-pdo-debuginfo: before 7.4.33-1.47.2

php74-pdo: before 7.4.33-1.47.2

php74-pcntl-debuginfo: before 7.4.33-1.47.2

php74-pcntl: before 7.4.33-1.47.2

php74-openssl-debuginfo: before 7.4.33-1.47.2

php74-openssl: before 7.4.33-1.47.2

php74-opcache-debuginfo: before 7.4.33-1.47.2

php74-opcache: before 7.4.33-1.47.2

php74-odbc-debuginfo: before 7.4.33-1.47.2

php74-odbc: before 7.4.33-1.47.2

php74-mysql-debuginfo: before 7.4.33-1.47.2

php74-mysql: before 7.4.33-1.47.2

php74-mbstring-debuginfo: before 7.4.33-1.47.2

php74-mbstring: before 7.4.33-1.47.2

php74-ldap-debuginfo: before 7.4.33-1.47.2

php74-ldap: before 7.4.33-1.47.2

php74-json-debuginfo: before 7.4.33-1.47.2

php74-json: before 7.4.33-1.47.2

php74-intl-debuginfo: before 7.4.33-1.47.2

php74-intl: before 7.4.33-1.47.2

php74-iconv-debuginfo: before 7.4.33-1.47.2

php74-iconv: before 7.4.33-1.47.2

php74-gmp-debuginfo: before 7.4.33-1.47.2

php74-gmp: before 7.4.33-1.47.2

php74-gettext-debuginfo: before 7.4.33-1.47.2

php74-gettext: before 7.4.33-1.47.2

php74-gd-debuginfo: before 7.4.33-1.47.2

php74-gd: before 7.4.33-1.47.2

php74-ftp-debuginfo: before 7.4.33-1.47.2

php74-ftp: before 7.4.33-1.47.2

php74-fpm-debuginfo: before 7.4.33-1.47.2

php74-fpm: before 7.4.33-1.47.2

php74-fileinfo-debuginfo: before 7.4.33-1.47.2

php74-fileinfo: before 7.4.33-1.47.2

php74-fastcgi-debuginfo: before 7.4.33-1.47.2

php74-fastcgi: before 7.4.33-1.47.2

php74-exif-debuginfo: before 7.4.33-1.47.2

php74-exif: before 7.4.33-1.47.2

php74-enchant-debuginfo: before 7.4.33-1.47.2

php74-enchant: before 7.4.33-1.47.2

php74-dom-debuginfo: before 7.4.33-1.47.2

php74-dom: before 7.4.33-1.47.2

php74-dba-debuginfo: before 7.4.33-1.47.2

php74-dba: before 7.4.33-1.47.2

php74-curl-debuginfo: before 7.4.33-1.47.2

php74-curl: before 7.4.33-1.47.2

php74-ctype-debuginfo: before 7.4.33-1.47.2

php74-ctype: before 7.4.33-1.47.2

php74-calendar-debuginfo: before 7.4.33-1.47.2

php74-calendar: before 7.4.33-1.47.2

php74-bz2-debuginfo: before 7.4.33-1.47.2

php74-bz2: before 7.4.33-1.47.2

php74-bcmath-debuginfo: before 7.4.33-1.47.2

php74-bcmath: before 7.4.33-1.47.2

php74: before 7.4.33-1.47.2

apache2-mod_php74-debuginfo: before 7.4.33-1.47.2

apache2-mod_php74: before 7.4.33-1.47.2

php74-devel: before 7.4.33-1.47.2

php74-debugsource: before 7.4.33-1.47.2

php74-debuginfo: before 7.4.33-1.47.2

CPE2.3

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications:12-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications:12-SP4:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications:12-SP5:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing:12:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server:12-SP2-LTSS-ERICSSON:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server:12-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server:12-SP4:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_module_for_web_scripting:12:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_software_development_kit:12-SP5:*:*:*:*:*:*:*
• cpe:2.3:a:suse:php74-zlib-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-zlib:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-zip-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-zip:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xsl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xsl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xmlwriter-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xmlwriter:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xmlrpc-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xmlrpc:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xmlreader-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xmlreader:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-tokenizer-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-tokenizer:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-tidy-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-tidy:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sysvshm-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sysvshm:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sysvsem-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sysvsem:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sysvmsg-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sysvmsg:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sqlite-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sqlite:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sodium-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sodium:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sockets-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sockets:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-soap-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-soap:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-snmp-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-snmp:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-shmop-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-shmop:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-readline-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-readline:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-posix-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-posix:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-phar-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-phar:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-pgsql-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-pgsql:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-pdo-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-pdo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-pcntl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-pcntl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-openssl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-openssl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-opcache-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-opcache:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-odbc-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-odbc:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-mysql-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-mysql:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-mbstring-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-mbstring:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-ldap-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-ldap:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-json-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-json:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-intl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-intl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-iconv-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-iconv:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-gmp-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-gmp:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-gettext-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-gettext:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-gd-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-gd:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-ftp-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-ftp:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-fpm-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-fpm:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-fileinfo-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-fileinfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-fastcgi-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-fastcgi:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-exif-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-exif:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-enchant-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-enchant:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-dom-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-dom:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-dba-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-dba:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-curl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-curl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-ctype-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-ctype:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-calendar-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-calendar:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-bz2-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-bz2:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-bcmath-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-bcmath:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:apache2-mod_php74-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:apache2-mod_php74:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-devel:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-debugsource:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-debuginfo:*:*:*:*:*:suse_linux:*:*

External links

https://www.suse.com/support/update/announcement/2022/suse-su-20224068-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

16) Security features bypass

EUVDB-ID: #VU67756

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/U:Clear]

CVE-ID: CVE-2022-31629

CWE-ID: CWE-254 - Security Features

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to the way PHP handles HTTP variable names. A remote attacker can set a standard insecure cookie in the victim's browser which is treated as a `__Host-` or `__Secure-` cookie by PHP applications.

Mitigation

Update the affected package php74 to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Server for SAP Applications: 12-SP3 - 12-SP5

SUSE Linux Enterprise High Performance Computing: 12

SUSE Linux Enterprise Server: 12-SP2-LTSS-ERICSSON - 12-SP5

SUSE Linux Enterprise Module for Web Scripting: 12

SUSE Linux Enterprise Software Development Kit: 12-SP5

php74-zlib-debuginfo: before 7.4.33-1.47.2

php74-zlib: before 7.4.33-1.47.2

php74-zip-debuginfo: before 7.4.33-1.47.2

php74-zip: before 7.4.33-1.47.2

php74-xsl-debuginfo: before 7.4.33-1.47.2

php74-xsl: before 7.4.33-1.47.2

php74-xmlwriter-debuginfo: before 7.4.33-1.47.2

php74-xmlwriter: before 7.4.33-1.47.2

php74-xmlrpc-debuginfo: before 7.4.33-1.47.2

php74-xmlrpc: before 7.4.33-1.47.2

php74-xmlreader-debuginfo: before 7.4.33-1.47.2

php74-xmlreader: before 7.4.33-1.47.2

php74-tokenizer-debuginfo: before 7.4.33-1.47.2

php74-tokenizer: before 7.4.33-1.47.2

php74-tidy-debuginfo: before 7.4.33-1.47.2

php74-tidy: before 7.4.33-1.47.2

php74-sysvshm-debuginfo: before 7.4.33-1.47.2

php74-sysvshm: before 7.4.33-1.47.2

php74-sysvsem-debuginfo: before 7.4.33-1.47.2

php74-sysvsem: before 7.4.33-1.47.2

php74-sysvmsg-debuginfo: before 7.4.33-1.47.2

php74-sysvmsg: before 7.4.33-1.47.2

php74-sqlite-debuginfo: before 7.4.33-1.47.2

php74-sqlite: before 7.4.33-1.47.2

php74-sodium-debuginfo: before 7.4.33-1.47.2

php74-sodium: before 7.4.33-1.47.2

php74-sockets-debuginfo: before 7.4.33-1.47.2

php74-sockets: before 7.4.33-1.47.2

php74-soap-debuginfo: before 7.4.33-1.47.2

php74-soap: before 7.4.33-1.47.2

php74-snmp-debuginfo: before 7.4.33-1.47.2

php74-snmp: before 7.4.33-1.47.2

php74-shmop-debuginfo: before 7.4.33-1.47.2

php74-shmop: before 7.4.33-1.47.2

php74-readline-debuginfo: before 7.4.33-1.47.2

php74-readline: before 7.4.33-1.47.2

php74-posix-debuginfo: before 7.4.33-1.47.2

php74-posix: before 7.4.33-1.47.2

php74-phar-debuginfo: before 7.4.33-1.47.2

php74-phar: before 7.4.33-1.47.2

php74-pgsql-debuginfo: before 7.4.33-1.47.2

php74-pgsql: before 7.4.33-1.47.2

php74-pdo-debuginfo: before 7.4.33-1.47.2

php74-pdo: before 7.4.33-1.47.2

php74-pcntl-debuginfo: before 7.4.33-1.47.2

php74-pcntl: before 7.4.33-1.47.2

php74-openssl-debuginfo: before 7.4.33-1.47.2

php74-openssl: before 7.4.33-1.47.2

php74-opcache-debuginfo: before 7.4.33-1.47.2

php74-opcache: before 7.4.33-1.47.2

php74-odbc-debuginfo: before 7.4.33-1.47.2

php74-odbc: before 7.4.33-1.47.2

php74-mysql-debuginfo: before 7.4.33-1.47.2

php74-mysql: before 7.4.33-1.47.2

php74-mbstring-debuginfo: before 7.4.33-1.47.2

php74-mbstring: before 7.4.33-1.47.2

php74-ldap-debuginfo: before 7.4.33-1.47.2

php74-ldap: before 7.4.33-1.47.2

php74-json-debuginfo: before 7.4.33-1.47.2

php74-json: before 7.4.33-1.47.2

php74-intl-debuginfo: before 7.4.33-1.47.2

php74-intl: before 7.4.33-1.47.2

php74-iconv-debuginfo: before 7.4.33-1.47.2

php74-iconv: before 7.4.33-1.47.2

php74-gmp-debuginfo: before 7.4.33-1.47.2

php74-gmp: before 7.4.33-1.47.2

php74-gettext-debuginfo: before 7.4.33-1.47.2

php74-gettext: before 7.4.33-1.47.2

php74-gd-debuginfo: before 7.4.33-1.47.2

php74-gd: before 7.4.33-1.47.2

php74-ftp-debuginfo: before 7.4.33-1.47.2

php74-ftp: before 7.4.33-1.47.2

php74-fpm-debuginfo: before 7.4.33-1.47.2

php74-fpm: before 7.4.33-1.47.2

php74-fileinfo-debuginfo: before 7.4.33-1.47.2

php74-fileinfo: before 7.4.33-1.47.2

php74-fastcgi-debuginfo: before 7.4.33-1.47.2

php74-fastcgi: before 7.4.33-1.47.2

php74-exif-debuginfo: before 7.4.33-1.47.2

php74-exif: before 7.4.33-1.47.2

php74-enchant-debuginfo: before 7.4.33-1.47.2

php74-enchant: before 7.4.33-1.47.2

php74-dom-debuginfo: before 7.4.33-1.47.2

php74-dom: before 7.4.33-1.47.2

php74-dba-debuginfo: before 7.4.33-1.47.2

php74-dba: before 7.4.33-1.47.2

php74-curl-debuginfo: before 7.4.33-1.47.2

php74-curl: before 7.4.33-1.47.2

php74-ctype-debuginfo: before 7.4.33-1.47.2

php74-ctype: before 7.4.33-1.47.2

php74-calendar-debuginfo: before 7.4.33-1.47.2

php74-calendar: before 7.4.33-1.47.2

php74-bz2-debuginfo: before 7.4.33-1.47.2

php74-bz2: before 7.4.33-1.47.2

php74-bcmath-debuginfo: before 7.4.33-1.47.2

php74-bcmath: before 7.4.33-1.47.2

php74: before 7.4.33-1.47.2

apache2-mod_php74-debuginfo: before 7.4.33-1.47.2

apache2-mod_php74: before 7.4.33-1.47.2

php74-devel: before 7.4.33-1.47.2

php74-debugsource: before 7.4.33-1.47.2

php74-debuginfo: before 7.4.33-1.47.2

CPE2.3

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications:12-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications:12-SP4:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications:12-SP5:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing:12:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server:12-SP2-LTSS-ERICSSON:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server:12-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server:12-SP4:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_module_for_web_scripting:12:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_software_development_kit:12-SP5:*:*:*:*:*:*:*
• cpe:2.3:a:suse:php74-zlib-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-zlib:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-zip-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-zip:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xsl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xsl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xmlwriter-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xmlwriter:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xmlrpc-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xmlrpc:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xmlreader-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xmlreader:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-tokenizer-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-tokenizer:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-tidy-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-tidy:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sysvshm-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sysvshm:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sysvsem-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sysvsem:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sysvmsg-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sysvmsg:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sqlite-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sqlite:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sodium-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sodium:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sockets-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sockets:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-soap-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-soap:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-snmp-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-snmp:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-shmop-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-shmop:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-readline-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-readline:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-posix-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-posix:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-phar-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-phar:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-pgsql-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-pgsql:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-pdo-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-pdo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-pcntl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-pcntl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-openssl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-openssl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-opcache-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-opcache:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-odbc-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-odbc:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-mysql-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-mysql:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-mbstring-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-mbstring:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-ldap-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-ldap:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-json-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-json:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-intl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-intl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-iconv-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-iconv:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-gmp-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-gmp:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-gettext-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-gettext:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-gd-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-gd:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-ftp-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-ftp:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-fpm-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-fpm:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-fileinfo-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-fileinfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-fastcgi-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-fastcgi:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-exif-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-exif:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-enchant-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-enchant:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-dom-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-dom:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-dba-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-dba:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-curl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-curl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-ctype-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-ctype:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-calendar-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-calendar:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-bz2-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-bz2:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-bcmath-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-bcmath:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:apache2-mod_php74-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:apache2-mod_php74:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-devel:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-debugsource:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-debuginfo:*:*:*:*:*:suse_linux:*:*

External links

https://www.suse.com/support/update/announcement/2022/suse-su-20224068-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

17) Out-of-bounds read

EUVDB-ID: #VU68886

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2022-31630

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition within the imageloadfont() function. A remote attacker can pass specially crafted data to the web application, trigger an out-of-bounds read error and read contents of memory on the system.

Mitigation

Update the affected package php74 to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Server for SAP Applications: 12-SP3 - 12-SP5

SUSE Linux Enterprise High Performance Computing: 12

SUSE Linux Enterprise Server: 12-SP2-LTSS-ERICSSON - 12-SP5

SUSE Linux Enterprise Module for Web Scripting: 12

SUSE Linux Enterprise Software Development Kit: 12-SP5

php74-zlib-debuginfo: before 7.4.33-1.47.2

php74-zlib: before 7.4.33-1.47.2

php74-zip-debuginfo: before 7.4.33-1.47.2

php74-zip: before 7.4.33-1.47.2

php74-xsl-debuginfo: before 7.4.33-1.47.2

php74-xsl: before 7.4.33-1.47.2

php74-xmlwriter-debuginfo: before 7.4.33-1.47.2

php74-xmlwriter: before 7.4.33-1.47.2

php74-xmlrpc-debuginfo: before 7.4.33-1.47.2

php74-xmlrpc: before 7.4.33-1.47.2

php74-xmlreader-debuginfo: before 7.4.33-1.47.2

php74-xmlreader: before 7.4.33-1.47.2

php74-tokenizer-debuginfo: before 7.4.33-1.47.2

php74-tokenizer: before 7.4.33-1.47.2

php74-tidy-debuginfo: before 7.4.33-1.47.2

php74-tidy: before 7.4.33-1.47.2

php74-sysvshm-debuginfo: before 7.4.33-1.47.2

php74-sysvshm: before 7.4.33-1.47.2

php74-sysvsem-debuginfo: before 7.4.33-1.47.2

php74-sysvsem: before 7.4.33-1.47.2

php74-sysvmsg-debuginfo: before 7.4.33-1.47.2

php74-sysvmsg: before 7.4.33-1.47.2

php74-sqlite-debuginfo: before 7.4.33-1.47.2

php74-sqlite: before 7.4.33-1.47.2

php74-sodium-debuginfo: before 7.4.33-1.47.2

php74-sodium: before 7.4.33-1.47.2

php74-sockets-debuginfo: before 7.4.33-1.47.2

php74-sockets: before 7.4.33-1.47.2

php74-soap-debuginfo: before 7.4.33-1.47.2

php74-soap: before 7.4.33-1.47.2

php74-snmp-debuginfo: before 7.4.33-1.47.2

php74-snmp: before 7.4.33-1.47.2

php74-shmop-debuginfo: before 7.4.33-1.47.2

php74-shmop: before 7.4.33-1.47.2

php74-readline-debuginfo: before 7.4.33-1.47.2

php74-readline: before 7.4.33-1.47.2

php74-posix-debuginfo: before 7.4.33-1.47.2

php74-posix: before 7.4.33-1.47.2

php74-phar-debuginfo: before 7.4.33-1.47.2

php74-phar: before 7.4.33-1.47.2

php74-pgsql-debuginfo: before 7.4.33-1.47.2

php74-pgsql: before 7.4.33-1.47.2

php74-pdo-debuginfo: before 7.4.33-1.47.2

php74-pdo: before 7.4.33-1.47.2

php74-pcntl-debuginfo: before 7.4.33-1.47.2

php74-pcntl: before 7.4.33-1.47.2

php74-openssl-debuginfo: before 7.4.33-1.47.2

php74-openssl: before 7.4.33-1.47.2

php74-opcache-debuginfo: before 7.4.33-1.47.2

php74-opcache: before 7.4.33-1.47.2

php74-odbc-debuginfo: before 7.4.33-1.47.2

php74-odbc: before 7.4.33-1.47.2

php74-mysql-debuginfo: before 7.4.33-1.47.2

php74-mysql: before 7.4.33-1.47.2

php74-mbstring-debuginfo: before 7.4.33-1.47.2

php74-mbstring: before 7.4.33-1.47.2

php74-ldap-debuginfo: before 7.4.33-1.47.2

php74-ldap: before 7.4.33-1.47.2

php74-json-debuginfo: before 7.4.33-1.47.2

php74-json: before 7.4.33-1.47.2

php74-intl-debuginfo: before 7.4.33-1.47.2

php74-intl: before 7.4.33-1.47.2

php74-iconv-debuginfo: before 7.4.33-1.47.2

php74-iconv: before 7.4.33-1.47.2

php74-gmp-debuginfo: before 7.4.33-1.47.2

php74-gmp: before 7.4.33-1.47.2

php74-gettext-debuginfo: before 7.4.33-1.47.2

php74-gettext: before 7.4.33-1.47.2

php74-gd-debuginfo: before 7.4.33-1.47.2

php74-gd: before 7.4.33-1.47.2

php74-ftp-debuginfo: before 7.4.33-1.47.2

php74-ftp: before 7.4.33-1.47.2

php74-fpm-debuginfo: before 7.4.33-1.47.2

php74-fpm: before 7.4.33-1.47.2

php74-fileinfo-debuginfo: before 7.4.33-1.47.2

php74-fileinfo: before 7.4.33-1.47.2

php74-fastcgi-debuginfo: before 7.4.33-1.47.2

php74-fastcgi: before 7.4.33-1.47.2

php74-exif-debuginfo: before 7.4.33-1.47.2

php74-exif: before 7.4.33-1.47.2

php74-enchant-debuginfo: before 7.4.33-1.47.2

php74-enchant: before 7.4.33-1.47.2

php74-dom-debuginfo: before 7.4.33-1.47.2

php74-dom: before 7.4.33-1.47.2

php74-dba-debuginfo: before 7.4.33-1.47.2

php74-dba: before 7.4.33-1.47.2

php74-curl-debuginfo: before 7.4.33-1.47.2

php74-curl: before 7.4.33-1.47.2

php74-ctype-debuginfo: before 7.4.33-1.47.2

php74-ctype: before 7.4.33-1.47.2

php74-calendar-debuginfo: before 7.4.33-1.47.2

php74-calendar: before 7.4.33-1.47.2

php74-bz2-debuginfo: before 7.4.33-1.47.2

php74-bz2: before 7.4.33-1.47.2

php74-bcmath-debuginfo: before 7.4.33-1.47.2

php74-bcmath: before 7.4.33-1.47.2

php74: before 7.4.33-1.47.2

apache2-mod_php74-debuginfo: before 7.4.33-1.47.2

apache2-mod_php74: before 7.4.33-1.47.2

php74-devel: before 7.4.33-1.47.2

php74-debugsource: before 7.4.33-1.47.2

php74-debuginfo: before 7.4.33-1.47.2

CPE2.3

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications:12-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications:12-SP4:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications:12-SP5:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing:12:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server:12-SP2-LTSS-ERICSSON:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server:12-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server:12-SP4:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_module_for_web_scripting:12:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_software_development_kit:12-SP5:*:*:*:*:*:*:*
• cpe:2.3:a:suse:php74-zlib-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-zlib:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-zip-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-zip:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xsl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xsl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xmlwriter-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xmlwriter:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xmlrpc-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xmlrpc:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xmlreader-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xmlreader:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-tokenizer-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-tokenizer:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-tidy-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-tidy:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sysvshm-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sysvshm:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sysvsem-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sysvsem:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sysvmsg-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sysvmsg:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sqlite-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sqlite:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sodium-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sodium:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sockets-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sockets:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-soap-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-soap:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-snmp-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-snmp:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-shmop-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-shmop:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-readline-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-readline:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-posix-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-posix:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-phar-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-phar:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-pgsql-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-pgsql:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-pdo-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-pdo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-pcntl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-pcntl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-openssl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-openssl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-opcache-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-opcache:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-odbc-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-odbc:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-mysql-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-mysql:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-mbstring-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-mbstring:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-ldap-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-ldap:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-json-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-json:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-intl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-intl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-iconv-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-iconv:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-gmp-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-gmp:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-gettext-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-gettext:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-gd-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-gd:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-ftp-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-ftp:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-fpm-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-fpm:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-fileinfo-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-fileinfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-fastcgi-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-fastcgi:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-exif-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-exif:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-enchant-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-enchant:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-dom-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-dom:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-dba-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-dba:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-curl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-curl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-ctype-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-ctype:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-calendar-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-calendar:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-bz2-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-bz2:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-bcmath-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-bcmath:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:apache2-mod_php74-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:apache2-mod_php74:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-devel:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-debugsource:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-debuginfo:*:*:*:*:*:suse_linux:*:*

External links

https://www.suse.com/support/update/announcement/2022/suse-su-20224068-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

18) Integer overflow

EUVDB-ID: #VU68887

Risk: High

CVSSv4.0: 8.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Amber]

CVE-ID: CVE-2022-37454

CWE-ID: CWE-190 - Integer overflow

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow within the Keccak XKCP SHA-3 reference implementation. A remote attacker can pass specially crafted data to the application, trigger an integer overflow and execute arbitrary code on the target system or eliminate expected cryptographic properties.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update the affected package php74 to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Server for SAP Applications: 12-SP3 - 12-SP5

SUSE Linux Enterprise High Performance Computing: 12

SUSE Linux Enterprise Server: 12-SP2-LTSS-ERICSSON - 12-SP5

SUSE Linux Enterprise Module for Web Scripting: 12

SUSE Linux Enterprise Software Development Kit: 12-SP5

php74-zlib-debuginfo: before 7.4.33-1.47.2

php74-zlib: before 7.4.33-1.47.2

php74-zip-debuginfo: before 7.4.33-1.47.2

php74-zip: before 7.4.33-1.47.2

php74-xsl-debuginfo: before 7.4.33-1.47.2

php74-xsl: before 7.4.33-1.47.2

php74-xmlwriter-debuginfo: before 7.4.33-1.47.2

php74-xmlwriter: before 7.4.33-1.47.2

php74-xmlrpc-debuginfo: before 7.4.33-1.47.2

php74-xmlrpc: before 7.4.33-1.47.2

php74-xmlreader-debuginfo: before 7.4.33-1.47.2

php74-xmlreader: before 7.4.33-1.47.2

php74-tokenizer-debuginfo: before 7.4.33-1.47.2

php74-tokenizer: before 7.4.33-1.47.2

php74-tidy-debuginfo: before 7.4.33-1.47.2

php74-tidy: before 7.4.33-1.47.2

php74-sysvshm-debuginfo: before 7.4.33-1.47.2

php74-sysvshm: before 7.4.33-1.47.2

php74-sysvsem-debuginfo: before 7.4.33-1.47.2

php74-sysvsem: before 7.4.33-1.47.2

php74-sysvmsg-debuginfo: before 7.4.33-1.47.2

php74-sysvmsg: before 7.4.33-1.47.2

php74-sqlite-debuginfo: before 7.4.33-1.47.2

php74-sqlite: before 7.4.33-1.47.2

php74-sodium-debuginfo: before 7.4.33-1.47.2

php74-sodium: before 7.4.33-1.47.2

php74-sockets-debuginfo: before 7.4.33-1.47.2

php74-sockets: before 7.4.33-1.47.2

php74-soap-debuginfo: before 7.4.33-1.47.2

php74-soap: before 7.4.33-1.47.2

php74-snmp-debuginfo: before 7.4.33-1.47.2

php74-snmp: before 7.4.33-1.47.2

php74-shmop-debuginfo: before 7.4.33-1.47.2

php74-shmop: before 7.4.33-1.47.2

php74-readline-debuginfo: before 7.4.33-1.47.2

php74-readline: before 7.4.33-1.47.2

php74-posix-debuginfo: before 7.4.33-1.47.2

php74-posix: before 7.4.33-1.47.2

php74-phar-debuginfo: before 7.4.33-1.47.2

php74-phar: before 7.4.33-1.47.2

php74-pgsql-debuginfo: before 7.4.33-1.47.2

php74-pgsql: before 7.4.33-1.47.2

php74-pdo-debuginfo: before 7.4.33-1.47.2

php74-pdo: before 7.4.33-1.47.2

php74-pcntl-debuginfo: before 7.4.33-1.47.2

php74-pcntl: before 7.4.33-1.47.2

php74-openssl-debuginfo: before 7.4.33-1.47.2

php74-openssl: before 7.4.33-1.47.2

php74-opcache-debuginfo: before 7.4.33-1.47.2

php74-opcache: before 7.4.33-1.47.2

php74-odbc-debuginfo: before 7.4.33-1.47.2

php74-odbc: before 7.4.33-1.47.2

php74-mysql-debuginfo: before 7.4.33-1.47.2

php74-mysql: before 7.4.33-1.47.2

php74-mbstring-debuginfo: before 7.4.33-1.47.2

php74-mbstring: before 7.4.33-1.47.2

php74-ldap-debuginfo: before 7.4.33-1.47.2

php74-ldap: before 7.4.33-1.47.2

php74-json-debuginfo: before 7.4.33-1.47.2

php74-json: before 7.4.33-1.47.2

php74-intl-debuginfo: before 7.4.33-1.47.2

php74-intl: before 7.4.33-1.47.2

php74-iconv-debuginfo: before 7.4.33-1.47.2

php74-iconv: before 7.4.33-1.47.2

php74-gmp-debuginfo: before 7.4.33-1.47.2

php74-gmp: before 7.4.33-1.47.2

php74-gettext-debuginfo: before 7.4.33-1.47.2

php74-gettext: before 7.4.33-1.47.2

php74-gd-debuginfo: before 7.4.33-1.47.2

php74-gd: before 7.4.33-1.47.2

php74-ftp-debuginfo: before 7.4.33-1.47.2

php74-ftp: before 7.4.33-1.47.2

php74-fpm-debuginfo: before 7.4.33-1.47.2

php74-fpm: before 7.4.33-1.47.2

php74-fileinfo-debuginfo: before 7.4.33-1.47.2

php74-fileinfo: before 7.4.33-1.47.2

php74-fastcgi-debuginfo: before 7.4.33-1.47.2

php74-fastcgi: before 7.4.33-1.47.2

php74-exif-debuginfo: before 7.4.33-1.47.2

php74-exif: before 7.4.33-1.47.2

php74-enchant-debuginfo: before 7.4.33-1.47.2

php74-enchant: before 7.4.33-1.47.2

php74-dom-debuginfo: before 7.4.33-1.47.2

php74-dom: before 7.4.33-1.47.2

php74-dba-debuginfo: before 7.4.33-1.47.2

php74-dba: before 7.4.33-1.47.2

php74-curl-debuginfo: before 7.4.33-1.47.2

php74-curl: before 7.4.33-1.47.2

php74-ctype-debuginfo: before 7.4.33-1.47.2

php74-ctype: before 7.4.33-1.47.2

php74-calendar-debuginfo: before 7.4.33-1.47.2

php74-calendar: before 7.4.33-1.47.2

php74-bz2-debuginfo: before 7.4.33-1.47.2

php74-bz2: before 7.4.33-1.47.2

php74-bcmath-debuginfo: before 7.4.33-1.47.2

php74-bcmath: before 7.4.33-1.47.2

php74: before 7.4.33-1.47.2

apache2-mod_php74-debuginfo: before 7.4.33-1.47.2

apache2-mod_php74: before 7.4.33-1.47.2

php74-devel: before 7.4.33-1.47.2

php74-debugsource: before 7.4.33-1.47.2

php74-debuginfo: before 7.4.33-1.47.2

CPE2.3

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications:12-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications:12-SP4:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications:12-SP5:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing:12:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server:12-SP2-LTSS-ERICSSON:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server:12-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server:12-SP4:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_module_for_web_scripting:12:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_software_development_kit:12-SP5:*:*:*:*:*:*:*
• cpe:2.3:a:suse:php74-zlib-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-zlib:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-zip-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-zip:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xsl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xsl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xmlwriter-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xmlwriter:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xmlrpc-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xmlrpc:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xmlreader-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-xmlreader:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-tokenizer-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-tokenizer:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-tidy-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-tidy:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sysvshm-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sysvshm:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sysvsem-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sysvsem:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sysvmsg-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sysvmsg:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sqlite-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sqlite:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sodium-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sodium:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sockets-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-sockets:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-soap-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-soap:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-snmp-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-snmp:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-shmop-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-shmop:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-readline-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-readline:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-posix-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-posix:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-phar-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-phar:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-pgsql-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-pgsql:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-pdo-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-pdo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-pcntl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-pcntl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-openssl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-openssl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-opcache-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-opcache:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-odbc-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-odbc:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-mysql-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-mysql:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-mbstring-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-mbstring:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-ldap-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-ldap:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-json-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-json:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-intl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-intl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-iconv-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-iconv:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-gmp-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-gmp:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-gettext-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-gettext:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-gd-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-gd:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-ftp-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-ftp:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-fpm-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-fpm:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-fileinfo-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-fileinfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-fastcgi-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-fastcgi:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-exif-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-exif:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-enchant-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-enchant:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-dom-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-dom:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-dba-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-dba:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-curl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-curl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-ctype-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-ctype:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-calendar-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-calendar:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-bz2-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-bz2:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-bcmath-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-bcmath:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:apache2-mod_php74-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:apache2-mod_php74:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-devel:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-debugsource:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:php74-debuginfo:*:*:*:*:*:suse_linux:*:*

External links

https://www.suse.com/support/update/announcement/2022/suse-su-20224068-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.