SUSE update for php7

1) Improper input validation

EUVDB-ID: #VU10335

Risk: Low

CVSSv4.0: 4.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2017-8923

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform denial of service (DoS) attack.

The vulnerability exists due to insufficient input validation in zend_string_extend() function in Zend/zend_string.h when leveraging a script's use of ".=" with a long. The application does not prevent changes to string objects that can result in a negative length. A remote attacker can pass an overly long string to script, which uses ".=" operand on the supplied data and trigger application crash.

Mitigation

Update the affected package php7 to the latest version.

Vulnerable software versions

SUSE Enterprise Storage: 7.1

SUSE Linux Enterprise Module for Web Scripting: 15-SP3

SUSE Manager Retail Branch Server: 4.1 - 4.2

SUSE Manager Server: 4.1 - 4.2

SUSE Manager Proxy: 4.1 - 4.2

SUSE Linux Enterprise Server for SAP: 15-SP2

SUSE Linux Enterprise Server: 15-SP2-LTSS - 15-SP3

SUSE Linux Enterprise High Performance Computing: 15-SP2-LTSS - 15-SP3

openSUSE Leap: 15.3 - 15.4

SUSE Linux Enterprise Server for SAP Applications: 15-SP3

SUSE Linux Enterprise Module for Packagehub Subpackages: 15-SP3

php7-zlib-debuginfo: before 7.4.33-150200.3.46.2

php7-zlib: before 7.4.33-150200.3.46.2

php7-zip-debuginfo: before 7.4.33-150200.3.46.2

php7-zip: before 7.4.33-150200.3.46.2

php7-xsl-debuginfo: before 7.4.33-150200.3.46.2

php7-xsl: before 7.4.33-150200.3.46.2

php7-xmlwriter-debuginfo: before 7.4.33-150200.3.46.2

php7-xmlwriter: before 7.4.33-150200.3.46.2

php7-xmlrpc-debuginfo: before 7.4.33-150200.3.46.2

php7-xmlrpc: before 7.4.33-150200.3.46.2

php7-xmlreader-debuginfo: before 7.4.33-150200.3.46.2

php7-xmlreader: before 7.4.33-150200.3.46.2

php7-tokenizer-debuginfo: before 7.4.33-150200.3.46.2

php7-tokenizer: before 7.4.33-150200.3.46.2

php7-tidy-debuginfo: before 7.4.33-150200.3.46.2

php7-tidy: before 7.4.33-150200.3.46.2

php7-test: before 7.4.33-150200.3.46.2

php7-sysvshm-debuginfo: before 7.4.33-150200.3.46.2

php7-sysvshm: before 7.4.33-150200.3.46.2

php7-sysvsem-debuginfo: before 7.4.33-150200.3.46.2

php7-sysvsem: before 7.4.33-150200.3.46.2

php7-sysvmsg-debuginfo: before 7.4.33-150200.3.46.2

php7-sysvmsg: before 7.4.33-150200.3.46.2

php7-sqlite-debuginfo: before 7.4.33-150200.3.46.2

php7-sqlite: before 7.4.33-150200.3.46.2

php7-sodium-debuginfo: before 7.4.33-150200.3.46.2

php7-sodium: before 7.4.33-150200.3.46.2

php7-sockets-debuginfo: before 7.4.33-150200.3.46.2

php7-sockets: before 7.4.33-150200.3.46.2

php7-soap-debuginfo: before 7.4.33-150200.3.46.2

php7-soap: before 7.4.33-150200.3.46.2

php7-snmp-debuginfo: before 7.4.33-150200.3.46.2

php7-snmp: before 7.4.33-150200.3.46.2

php7-shmop-debuginfo: before 7.4.33-150200.3.46.2

php7-shmop: before 7.4.33-150200.3.46.2

php7-readline-debuginfo: before 7.4.33-150200.3.46.2

php7-readline: before 7.4.33-150200.3.46.2

php7-posix-debuginfo: before 7.4.33-150200.3.46.2

php7-posix: before 7.4.33-150200.3.46.2

php7-phar-debuginfo: before 7.4.33-150200.3.46.2

php7-phar: before 7.4.33-150200.3.46.2

php7-pgsql-debuginfo: before 7.4.33-150200.3.46.2

php7-pgsql: before 7.4.33-150200.3.46.2

php7-pdo-debuginfo: before 7.4.33-150200.3.46.2

php7-pdo: before 7.4.33-150200.3.46.2

php7-pcntl-debuginfo: before 7.4.33-150200.3.46.2

php7-pcntl: before 7.4.33-150200.3.46.2

php7-openssl-debuginfo: before 7.4.33-150200.3.46.2

php7-openssl: before 7.4.33-150200.3.46.2

php7-opcache-debuginfo: before 7.4.33-150200.3.46.2

php7-opcache: before 7.4.33-150200.3.46.2

php7-odbc-debuginfo: before 7.4.33-150200.3.46.2

php7-odbc: before 7.4.33-150200.3.46.2

php7-mysql-debuginfo: before 7.4.33-150200.3.46.2

php7-mysql: before 7.4.33-150200.3.46.2

php7-mbstring-debuginfo: before 7.4.33-150200.3.46.2

php7-mbstring: before 7.4.33-150200.3.46.2

php7-ldap-debuginfo: before 7.4.33-150200.3.46.2

php7-ldap: before 7.4.33-150200.3.46.2

php7-json-debuginfo: before 7.4.33-150200.3.46.2

php7-json: before 7.4.33-150200.3.46.2

php7-intl-debuginfo: before 7.4.33-150200.3.46.2

php7-intl: before 7.4.33-150200.3.46.2

php7-iconv-debuginfo: before 7.4.33-150200.3.46.2

php7-iconv: before 7.4.33-150200.3.46.2

php7-gmp-debuginfo: before 7.4.33-150200.3.46.2

php7-gmp: before 7.4.33-150200.3.46.2

php7-gettext-debuginfo: before 7.4.33-150200.3.46.2

php7-gettext: before 7.4.33-150200.3.46.2

php7-gd-debuginfo: before 7.4.33-150200.3.46.2

php7-gd: before 7.4.33-150200.3.46.2

php7-ftp-debuginfo: before 7.4.33-150200.3.46.2

php7-ftp: before 7.4.33-150200.3.46.2

php7-fpm-debuginfo: before 7.4.33-150200.3.46.2

php7-fpm: before 7.4.33-150200.3.46.2

php7-fileinfo-debuginfo: before 7.4.33-150200.3.46.2

php7-fileinfo: before 7.4.33-150200.3.46.2

php7-fastcgi-debuginfo: before 7.4.33-150200.3.46.2

php7-fastcgi: before 7.4.33-150200.3.46.2

php7-exif-debuginfo: before 7.4.33-150200.3.46.2

php7-exif: before 7.4.33-150200.3.46.2

php7-enchant-debuginfo: before 7.4.33-150200.3.46.2

php7-enchant: before 7.4.33-150200.3.46.2

php7-embed-debuginfo: before 7.4.33-150200.3.46.2

php7-embed: before 7.4.33-150200.3.46.2

php7-dom-debuginfo: before 7.4.33-150200.3.46.2

php7-dom: before 7.4.33-150200.3.46.2

php7-devel: before 7.4.33-150200.3.46.2

php7-debugsource: before 7.4.33-150200.3.46.2

php7-debuginfo: before 7.4.33-150200.3.46.2

php7-dba-debuginfo: before 7.4.33-150200.3.46.2

php7-dba: before 7.4.33-150200.3.46.2

php7-curl-debuginfo: before 7.4.33-150200.3.46.2

php7-curl: before 7.4.33-150200.3.46.2

php7-ctype-debuginfo: before 7.4.33-150200.3.46.2

php7-ctype: before 7.4.33-150200.3.46.2

php7-calendar-debuginfo: before 7.4.33-150200.3.46.2

php7-calendar: before 7.4.33-150200.3.46.2

php7-bz2-debuginfo: before 7.4.33-150200.3.46.2

php7-bz2: before 7.4.33-150200.3.46.2

php7-bcmath-debuginfo: before 7.4.33-150200.3.46.2

php7-bcmath: before 7.4.33-150200.3.46.2

php7: before 7.4.33-150200.3.46.2

apache2-mod_php7-debuginfo: before 7.4.33-150200.3.46.2

apache2-mod_php7: before 7.4.33-150200.3.46.2

php7-firebird-debuginfo: before 7.4.33-150200.3.46.2

php7-firebird: before 7.4.33-150200.3.46.2

CPE2.3

• cpe:2.3:o:suse:suse_enterprise_storage:7.1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_module_for_web_scripting:15-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_retail_branch_server:4.1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_retail_branch_server:4.2:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_server:4.1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_server:4.2:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_proxy:4.1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_proxy:4.2:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap:15-SP2:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server:15-SP2-LTSS:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing:15-SP2-LTSS:*:*:*:*:*:*:*
• cpe:2.3:o:suse:opensuse_leap:15.3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications:15-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_module_for_packagehub_subpackages:15-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:php7-zlib-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-zlib:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-zip-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-zip:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xsl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xsl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xmlwriter-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xmlwriter:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xmlrpc-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xmlrpc:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xmlreader-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xmlreader:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-tokenizer-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-tokenizer:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-tidy-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-tidy:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-test:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sysvshm-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sysvshm:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sysvsem-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sysvsem:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sysvmsg-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sysvmsg:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sqlite-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sqlite:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sodium-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sodium:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sockets-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sockets:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-soap-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-soap:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-snmp-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-snmp:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-shmop-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-shmop:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-readline-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-readline:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-posix-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-posix:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-phar-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-phar:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-pgsql-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-pgsql:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-pdo-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-pdo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-pcntl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-pcntl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-openssl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-openssl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-opcache-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-opcache:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-odbc-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-odbc:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-mysql-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-mysql:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-mbstring-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-mbstring:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-ldap-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-ldap:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-json-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-json:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-intl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-intl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-iconv-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-iconv:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-gmp-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-gmp:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-gettext-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-gettext:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-gd-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-gd:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-ftp-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-ftp:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-fpm-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-fpm:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-fileinfo-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-fileinfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-fastcgi-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-fastcgi:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-exif-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-exif:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-enchant-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-enchant:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-embed-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-embed:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-dom-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-dom:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-devel:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-debugsource:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-dba-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-dba:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-curl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-curl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-ctype-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-ctype:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-calendar-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-calendar:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-bz2-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-bz2:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-bcmath-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-bcmath:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:apache2-mod_php7-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:apache2-mod_php7:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-firebird-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-firebird:*:*:*:*:*:suse_linux:*:*

External links

https://www.suse.com/support/update/announcement/2022/suse-su-20224069-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Use-after-free

EUVDB-ID: #VU34121

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2020-7068

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error in the "phar_parse_zipfile" function. A remote attacker can can cause a denial of service (DoS) condition on the target system.

Mitigation

Update the affected package php7 to the latest version.

Vulnerable software versions

SUSE Enterprise Storage: 7.1

SUSE Linux Enterprise Module for Web Scripting: 15-SP3

SUSE Manager Retail Branch Server: 4.1 - 4.2

SUSE Manager Server: 4.1 - 4.2

SUSE Manager Proxy: 4.1 - 4.2

SUSE Linux Enterprise Server for SAP: 15-SP2

SUSE Linux Enterprise Server: 15-SP2-LTSS - 15-SP3

SUSE Linux Enterprise High Performance Computing: 15-SP2-LTSS - 15-SP3

openSUSE Leap: 15.3 - 15.4

SUSE Linux Enterprise Server for SAP Applications: 15-SP3

SUSE Linux Enterprise Module for Packagehub Subpackages: 15-SP3

php7-zlib-debuginfo: before 7.4.33-150200.3.46.2

php7-zlib: before 7.4.33-150200.3.46.2

php7-zip-debuginfo: before 7.4.33-150200.3.46.2

php7-zip: before 7.4.33-150200.3.46.2

php7-xsl-debuginfo: before 7.4.33-150200.3.46.2

php7-xsl: before 7.4.33-150200.3.46.2

php7-xmlwriter-debuginfo: before 7.4.33-150200.3.46.2

php7-xmlwriter: before 7.4.33-150200.3.46.2

php7-xmlrpc-debuginfo: before 7.4.33-150200.3.46.2

php7-xmlrpc: before 7.4.33-150200.3.46.2

php7-xmlreader-debuginfo: before 7.4.33-150200.3.46.2

php7-xmlreader: before 7.4.33-150200.3.46.2

php7-tokenizer-debuginfo: before 7.4.33-150200.3.46.2

php7-tokenizer: before 7.4.33-150200.3.46.2

php7-tidy-debuginfo: before 7.4.33-150200.3.46.2

php7-tidy: before 7.4.33-150200.3.46.2

php7-test: before 7.4.33-150200.3.46.2

php7-sysvshm-debuginfo: before 7.4.33-150200.3.46.2

php7-sysvshm: before 7.4.33-150200.3.46.2

php7-sysvsem-debuginfo: before 7.4.33-150200.3.46.2

php7-sysvsem: before 7.4.33-150200.3.46.2

php7-sysvmsg-debuginfo: before 7.4.33-150200.3.46.2

php7-sysvmsg: before 7.4.33-150200.3.46.2

php7-sqlite-debuginfo: before 7.4.33-150200.3.46.2

php7-sqlite: before 7.4.33-150200.3.46.2

php7-sodium-debuginfo: before 7.4.33-150200.3.46.2

php7-sodium: before 7.4.33-150200.3.46.2

php7-sockets-debuginfo: before 7.4.33-150200.3.46.2

php7-sockets: before 7.4.33-150200.3.46.2

php7-soap-debuginfo: before 7.4.33-150200.3.46.2

php7-soap: before 7.4.33-150200.3.46.2

php7-snmp-debuginfo: before 7.4.33-150200.3.46.2

php7-snmp: before 7.4.33-150200.3.46.2

php7-shmop-debuginfo: before 7.4.33-150200.3.46.2

php7-shmop: before 7.4.33-150200.3.46.2

php7-readline-debuginfo: before 7.4.33-150200.3.46.2

php7-readline: before 7.4.33-150200.3.46.2

php7-posix-debuginfo: before 7.4.33-150200.3.46.2

php7-posix: before 7.4.33-150200.3.46.2

php7-phar-debuginfo: before 7.4.33-150200.3.46.2

php7-phar: before 7.4.33-150200.3.46.2

php7-pgsql-debuginfo: before 7.4.33-150200.3.46.2

php7-pgsql: before 7.4.33-150200.3.46.2

php7-pdo-debuginfo: before 7.4.33-150200.3.46.2

php7-pdo: before 7.4.33-150200.3.46.2

php7-pcntl-debuginfo: before 7.4.33-150200.3.46.2

php7-pcntl: before 7.4.33-150200.3.46.2

php7-openssl-debuginfo: before 7.4.33-150200.3.46.2

php7-openssl: before 7.4.33-150200.3.46.2

php7-opcache-debuginfo: before 7.4.33-150200.3.46.2

php7-opcache: before 7.4.33-150200.3.46.2

php7-odbc-debuginfo: before 7.4.33-150200.3.46.2

php7-odbc: before 7.4.33-150200.3.46.2

php7-mysql-debuginfo: before 7.4.33-150200.3.46.2

php7-mysql: before 7.4.33-150200.3.46.2

php7-mbstring-debuginfo: before 7.4.33-150200.3.46.2

php7-mbstring: before 7.4.33-150200.3.46.2

php7-ldap-debuginfo: before 7.4.33-150200.3.46.2

php7-ldap: before 7.4.33-150200.3.46.2

php7-json-debuginfo: before 7.4.33-150200.3.46.2

php7-json: before 7.4.33-150200.3.46.2

php7-intl-debuginfo: before 7.4.33-150200.3.46.2

php7-intl: before 7.4.33-150200.3.46.2

php7-iconv-debuginfo: before 7.4.33-150200.3.46.2

php7-iconv: before 7.4.33-150200.3.46.2

php7-gmp-debuginfo: before 7.4.33-150200.3.46.2

php7-gmp: before 7.4.33-150200.3.46.2

php7-gettext-debuginfo: before 7.4.33-150200.3.46.2

php7-gettext: before 7.4.33-150200.3.46.2

php7-gd-debuginfo: before 7.4.33-150200.3.46.2

php7-gd: before 7.4.33-150200.3.46.2

php7-ftp-debuginfo: before 7.4.33-150200.3.46.2

php7-ftp: before 7.4.33-150200.3.46.2

php7-fpm-debuginfo: before 7.4.33-150200.3.46.2

php7-fpm: before 7.4.33-150200.3.46.2

php7-fileinfo-debuginfo: before 7.4.33-150200.3.46.2

php7-fileinfo: before 7.4.33-150200.3.46.2

php7-fastcgi-debuginfo: before 7.4.33-150200.3.46.2

php7-fastcgi: before 7.4.33-150200.3.46.2

php7-exif-debuginfo: before 7.4.33-150200.3.46.2

php7-exif: before 7.4.33-150200.3.46.2

php7-enchant-debuginfo: before 7.4.33-150200.3.46.2

php7-enchant: before 7.4.33-150200.3.46.2

php7-embed-debuginfo: before 7.4.33-150200.3.46.2

php7-embed: before 7.4.33-150200.3.46.2

php7-dom-debuginfo: before 7.4.33-150200.3.46.2

php7-dom: before 7.4.33-150200.3.46.2

php7-devel: before 7.4.33-150200.3.46.2

php7-debugsource: before 7.4.33-150200.3.46.2

php7-debuginfo: before 7.4.33-150200.3.46.2

php7-dba-debuginfo: before 7.4.33-150200.3.46.2

php7-dba: before 7.4.33-150200.3.46.2

php7-curl-debuginfo: before 7.4.33-150200.3.46.2

php7-curl: before 7.4.33-150200.3.46.2

php7-ctype-debuginfo: before 7.4.33-150200.3.46.2

php7-ctype: before 7.4.33-150200.3.46.2

php7-calendar-debuginfo: before 7.4.33-150200.3.46.2

php7-calendar: before 7.4.33-150200.3.46.2

php7-bz2-debuginfo: before 7.4.33-150200.3.46.2

php7-bz2: before 7.4.33-150200.3.46.2

php7-bcmath-debuginfo: before 7.4.33-150200.3.46.2

php7-bcmath: before 7.4.33-150200.3.46.2

php7: before 7.4.33-150200.3.46.2

apache2-mod_php7-debuginfo: before 7.4.33-150200.3.46.2

apache2-mod_php7: before 7.4.33-150200.3.46.2

php7-firebird-debuginfo: before 7.4.33-150200.3.46.2

php7-firebird: before 7.4.33-150200.3.46.2

CPE2.3

• cpe:2.3:o:suse:suse_enterprise_storage:7.1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_module_for_web_scripting:15-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_retail_branch_server:4.1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_retail_branch_server:4.2:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_server:4.1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_server:4.2:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_proxy:4.1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_proxy:4.2:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap:15-SP2:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server:15-SP2-LTSS:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing:15-SP2-LTSS:*:*:*:*:*:*:*
• cpe:2.3:o:suse:opensuse_leap:15.3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications:15-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_module_for_packagehub_subpackages:15-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:php7-zlib-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-zlib:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-zip-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-zip:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xsl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xsl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xmlwriter-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xmlwriter:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xmlrpc-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xmlrpc:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xmlreader-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xmlreader:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-tokenizer-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-tokenizer:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-tidy-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-tidy:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-test:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sysvshm-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sysvshm:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sysvsem-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sysvsem:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sysvmsg-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sysvmsg:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sqlite-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sqlite:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sodium-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sodium:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sockets-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sockets:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-soap-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-soap:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-snmp-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-snmp:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-shmop-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-shmop:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-readline-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-readline:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-posix-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-posix:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-phar-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-phar:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-pgsql-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-pgsql:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-pdo-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-pdo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-pcntl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-pcntl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-openssl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-openssl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-opcache-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-opcache:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-odbc-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-odbc:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-mysql-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-mysql:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-mbstring-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-mbstring:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-ldap-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-ldap:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-json-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-json:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-intl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-intl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-iconv-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-iconv:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-gmp-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-gmp:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-gettext-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-gettext:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-gd-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-gd:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-ftp-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-ftp:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-fpm-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-fpm:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-fileinfo-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-fileinfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-fastcgi-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-fastcgi:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-exif-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-exif:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-enchant-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-enchant:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-embed-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-embed:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-dom-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-dom:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-devel:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-debugsource:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-dba-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-dba:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-curl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-curl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-ctype-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-ctype:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-calendar-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-calendar:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-bz2-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-bz2:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-bcmath-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-bcmath:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:apache2-mod_php7-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:apache2-mod_php7:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-firebird-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-firebird:*:*:*:*:*:suse_linux:*:*

External links

https://www.suse.com/support/update/announcement/2022/suse-su-20224069-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Cryptographic issues

EUVDB-ID: #VU47253

Risk: Low

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-7069

CWE-ID: CWE-310 - Cryptographic Issues

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to the openssl_encrypt() function generates a wrong ciphertext and a wrong tag for AES-CCM for a 12 bytes IV. As a result, a 7-byte nonce is used instead of 12 bytes. A remote attacker can abuse such behavior and decrypt data.

Mitigation

Update the affected package php7 to the latest version.

Vulnerable software versions

SUSE Enterprise Storage: 7.1

SUSE Linux Enterprise Module for Web Scripting: 15-SP3

SUSE Manager Retail Branch Server: 4.1 - 4.2

SUSE Manager Server: 4.1 - 4.2

SUSE Manager Proxy: 4.1 - 4.2

SUSE Linux Enterprise Server for SAP: 15-SP2

SUSE Linux Enterprise Server: 15-SP2-LTSS - 15-SP3

SUSE Linux Enterprise High Performance Computing: 15-SP2-LTSS - 15-SP3

openSUSE Leap: 15.3 - 15.4

SUSE Linux Enterprise Server for SAP Applications: 15-SP3

SUSE Linux Enterprise Module for Packagehub Subpackages: 15-SP3

php7-zlib-debuginfo: before 7.4.33-150200.3.46.2

php7-zlib: before 7.4.33-150200.3.46.2

php7-zip-debuginfo: before 7.4.33-150200.3.46.2

php7-zip: before 7.4.33-150200.3.46.2

php7-xsl-debuginfo: before 7.4.33-150200.3.46.2

php7-xsl: before 7.4.33-150200.3.46.2

php7-xmlwriter-debuginfo: before 7.4.33-150200.3.46.2

php7-xmlwriter: before 7.4.33-150200.3.46.2

php7-xmlrpc-debuginfo: before 7.4.33-150200.3.46.2

php7-xmlrpc: before 7.4.33-150200.3.46.2

php7-xmlreader-debuginfo: before 7.4.33-150200.3.46.2

php7-xmlreader: before 7.4.33-150200.3.46.2

php7-tokenizer-debuginfo: before 7.4.33-150200.3.46.2

php7-tokenizer: before 7.4.33-150200.3.46.2

php7-tidy-debuginfo: before 7.4.33-150200.3.46.2

php7-tidy: before 7.4.33-150200.3.46.2

php7-test: before 7.4.33-150200.3.46.2

php7-sysvshm-debuginfo: before 7.4.33-150200.3.46.2

php7-sysvshm: before 7.4.33-150200.3.46.2

php7-sysvsem-debuginfo: before 7.4.33-150200.3.46.2

php7-sysvsem: before 7.4.33-150200.3.46.2

php7-sysvmsg-debuginfo: before 7.4.33-150200.3.46.2

php7-sysvmsg: before 7.4.33-150200.3.46.2

php7-sqlite-debuginfo: before 7.4.33-150200.3.46.2

php7-sqlite: before 7.4.33-150200.3.46.2

php7-sodium-debuginfo: before 7.4.33-150200.3.46.2

php7-sodium: before 7.4.33-150200.3.46.2

php7-sockets-debuginfo: before 7.4.33-150200.3.46.2

php7-sockets: before 7.4.33-150200.3.46.2

php7-soap-debuginfo: before 7.4.33-150200.3.46.2

php7-soap: before 7.4.33-150200.3.46.2

php7-snmp-debuginfo: before 7.4.33-150200.3.46.2

php7-snmp: before 7.4.33-150200.3.46.2

php7-shmop-debuginfo: before 7.4.33-150200.3.46.2

php7-shmop: before 7.4.33-150200.3.46.2

php7-readline-debuginfo: before 7.4.33-150200.3.46.2

php7-readline: before 7.4.33-150200.3.46.2

php7-posix-debuginfo: before 7.4.33-150200.3.46.2

php7-posix: before 7.4.33-150200.3.46.2

php7-phar-debuginfo: before 7.4.33-150200.3.46.2

php7-phar: before 7.4.33-150200.3.46.2

php7-pgsql-debuginfo: before 7.4.33-150200.3.46.2

php7-pgsql: before 7.4.33-150200.3.46.2

php7-pdo-debuginfo: before 7.4.33-150200.3.46.2

php7-pdo: before 7.4.33-150200.3.46.2

php7-pcntl-debuginfo: before 7.4.33-150200.3.46.2

php7-pcntl: before 7.4.33-150200.3.46.2

php7-openssl-debuginfo: before 7.4.33-150200.3.46.2

php7-openssl: before 7.4.33-150200.3.46.2

php7-opcache-debuginfo: before 7.4.33-150200.3.46.2

php7-opcache: before 7.4.33-150200.3.46.2

php7-odbc-debuginfo: before 7.4.33-150200.3.46.2

php7-odbc: before 7.4.33-150200.3.46.2

php7-mysql-debuginfo: before 7.4.33-150200.3.46.2

php7-mysql: before 7.4.33-150200.3.46.2

php7-mbstring-debuginfo: before 7.4.33-150200.3.46.2

php7-mbstring: before 7.4.33-150200.3.46.2

php7-ldap-debuginfo: before 7.4.33-150200.3.46.2

php7-ldap: before 7.4.33-150200.3.46.2

php7-json-debuginfo: before 7.4.33-150200.3.46.2

php7-json: before 7.4.33-150200.3.46.2

php7-intl-debuginfo: before 7.4.33-150200.3.46.2

php7-intl: before 7.4.33-150200.3.46.2

php7-iconv-debuginfo: before 7.4.33-150200.3.46.2

php7-iconv: before 7.4.33-150200.3.46.2

php7-gmp-debuginfo: before 7.4.33-150200.3.46.2

php7-gmp: before 7.4.33-150200.3.46.2

php7-gettext-debuginfo: before 7.4.33-150200.3.46.2

php7-gettext: before 7.4.33-150200.3.46.2

php7-gd-debuginfo: before 7.4.33-150200.3.46.2

php7-gd: before 7.4.33-150200.3.46.2

php7-ftp-debuginfo: before 7.4.33-150200.3.46.2

php7-ftp: before 7.4.33-150200.3.46.2

php7-fpm-debuginfo: before 7.4.33-150200.3.46.2

php7-fpm: before 7.4.33-150200.3.46.2

php7-fileinfo-debuginfo: before 7.4.33-150200.3.46.2

php7-fileinfo: before 7.4.33-150200.3.46.2

php7-fastcgi-debuginfo: before 7.4.33-150200.3.46.2

php7-fastcgi: before 7.4.33-150200.3.46.2

php7-exif-debuginfo: before 7.4.33-150200.3.46.2

php7-exif: before 7.4.33-150200.3.46.2

php7-enchant-debuginfo: before 7.4.33-150200.3.46.2

php7-enchant: before 7.4.33-150200.3.46.2

php7-embed-debuginfo: before 7.4.33-150200.3.46.2

php7-embed: before 7.4.33-150200.3.46.2

php7-dom-debuginfo: before 7.4.33-150200.3.46.2

php7-dom: before 7.4.33-150200.3.46.2

php7-devel: before 7.4.33-150200.3.46.2

php7-debugsource: before 7.4.33-150200.3.46.2

php7-debuginfo: before 7.4.33-150200.3.46.2

php7-dba-debuginfo: before 7.4.33-150200.3.46.2

php7-dba: before 7.4.33-150200.3.46.2

php7-curl-debuginfo: before 7.4.33-150200.3.46.2

php7-curl: before 7.4.33-150200.3.46.2

php7-ctype-debuginfo: before 7.4.33-150200.3.46.2

php7-ctype: before 7.4.33-150200.3.46.2

php7-calendar-debuginfo: before 7.4.33-150200.3.46.2

php7-calendar: before 7.4.33-150200.3.46.2

php7-bz2-debuginfo: before 7.4.33-150200.3.46.2

php7-bz2: before 7.4.33-150200.3.46.2

php7-bcmath-debuginfo: before 7.4.33-150200.3.46.2

php7-bcmath: before 7.4.33-150200.3.46.2

php7: before 7.4.33-150200.3.46.2

apache2-mod_php7-debuginfo: before 7.4.33-150200.3.46.2

apache2-mod_php7: before 7.4.33-150200.3.46.2

php7-firebird-debuginfo: before 7.4.33-150200.3.46.2

php7-firebird: before 7.4.33-150200.3.46.2

CPE2.3

• cpe:2.3:o:suse:suse_enterprise_storage:7.1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_module_for_web_scripting:15-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_retail_branch_server:4.1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_retail_branch_server:4.2:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_server:4.1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_server:4.2:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_proxy:4.1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_proxy:4.2:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap:15-SP2:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server:15-SP2-LTSS:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing:15-SP2-LTSS:*:*:*:*:*:*:*
• cpe:2.3:o:suse:opensuse_leap:15.3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications:15-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_module_for_packagehub_subpackages:15-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:php7-zlib-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-zlib:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-zip-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-zip:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xsl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xsl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xmlwriter-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xmlwriter:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xmlrpc-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xmlrpc:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xmlreader-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xmlreader:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-tokenizer-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-tokenizer:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-tidy-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-tidy:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-test:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sysvshm-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sysvshm:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sysvsem-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sysvsem:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sysvmsg-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sysvmsg:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sqlite-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sqlite:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sodium-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sodium:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sockets-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sockets:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-soap-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-soap:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-snmp-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-snmp:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-shmop-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-shmop:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-readline-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-readline:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-posix-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-posix:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-phar-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-phar:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-pgsql-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-pgsql:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-pdo-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-pdo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-pcntl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-pcntl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-openssl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-openssl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-opcache-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-opcache:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-odbc-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-odbc:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-mysql-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-mysql:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-mbstring-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-mbstring:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-ldap-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-ldap:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-json-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-json:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-intl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-intl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-iconv-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-iconv:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-gmp-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-gmp:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-gettext-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-gettext:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-gd-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-gd:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-ftp-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-ftp:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-fpm-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-fpm:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-fileinfo-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-fileinfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-fastcgi-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-fastcgi:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-exif-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-exif:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-enchant-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-enchant:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-embed-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-embed:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-dom-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-dom:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-devel:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-debugsource:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-dba-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-dba:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-curl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-curl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-ctype-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-ctype:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-calendar-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-calendar:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-bz2-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-bz2:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-bcmath-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-bcmath:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:apache2-mod_php7-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:apache2-mod_php7:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-firebird-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-firebird:*:*:*:*:*:suse_linux:*:*

External links

https://www.suse.com/support/update/announcement/2022/suse-su-20224069-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Input validation error

EUVDB-ID: #VU47252

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2020-7070

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a spoofing attack.

The vulnerability exists in the way PHP parser handles cookies with percent character (e.g. '%'). A remote attacker can send a crafted HTTP request with a `__%48ost-` or `__%53ecure-` cookie that will be processed before other cookies sent in the same request. As a result, an attacker can set malicious `__Host-` cookie on a subdomain and bypass origin restrictions, imposed by browsers.

Successful exploitation of the vulnerability may allow an attacker to perform a spoofing attack.

Mitigation

Update the affected package php7 to the latest version.

Vulnerable software versions

SUSE Enterprise Storage: 7.1

SUSE Linux Enterprise Module for Web Scripting: 15-SP3

SUSE Manager Retail Branch Server: 4.1 - 4.2

SUSE Manager Server: 4.1 - 4.2

SUSE Manager Proxy: 4.1 - 4.2

SUSE Linux Enterprise Server for SAP: 15-SP2

SUSE Linux Enterprise Server: 15-SP2-LTSS - 15-SP3

SUSE Linux Enterprise High Performance Computing: 15-SP2-LTSS - 15-SP3

openSUSE Leap: 15.3 - 15.4

SUSE Linux Enterprise Server for SAP Applications: 15-SP3

SUSE Linux Enterprise Module for Packagehub Subpackages: 15-SP3

php7-zlib-debuginfo: before 7.4.33-150200.3.46.2

php7-zlib: before 7.4.33-150200.3.46.2

php7-zip-debuginfo: before 7.4.33-150200.3.46.2

php7-zip: before 7.4.33-150200.3.46.2

php7-xsl-debuginfo: before 7.4.33-150200.3.46.2

php7-xsl: before 7.4.33-150200.3.46.2

php7-xmlwriter-debuginfo: before 7.4.33-150200.3.46.2

php7-xmlwriter: before 7.4.33-150200.3.46.2

php7-xmlrpc-debuginfo: before 7.4.33-150200.3.46.2

php7-xmlrpc: before 7.4.33-150200.3.46.2

php7-xmlreader-debuginfo: before 7.4.33-150200.3.46.2

php7-xmlreader: before 7.4.33-150200.3.46.2

php7-tokenizer-debuginfo: before 7.4.33-150200.3.46.2

php7-tokenizer: before 7.4.33-150200.3.46.2

php7-tidy-debuginfo: before 7.4.33-150200.3.46.2

php7-tidy: before 7.4.33-150200.3.46.2

php7-test: before 7.4.33-150200.3.46.2

php7-sysvshm-debuginfo: before 7.4.33-150200.3.46.2

php7-sysvshm: before 7.4.33-150200.3.46.2

php7-sysvsem-debuginfo: before 7.4.33-150200.3.46.2

php7-sysvsem: before 7.4.33-150200.3.46.2

php7-sysvmsg-debuginfo: before 7.4.33-150200.3.46.2

php7-sysvmsg: before 7.4.33-150200.3.46.2

php7-sqlite-debuginfo: before 7.4.33-150200.3.46.2

php7-sqlite: before 7.4.33-150200.3.46.2

php7-sodium-debuginfo: before 7.4.33-150200.3.46.2

php7-sodium: before 7.4.33-150200.3.46.2

php7-sockets-debuginfo: before 7.4.33-150200.3.46.2

php7-sockets: before 7.4.33-150200.3.46.2

php7-soap-debuginfo: before 7.4.33-150200.3.46.2

php7-soap: before 7.4.33-150200.3.46.2

php7-snmp-debuginfo: before 7.4.33-150200.3.46.2

php7-snmp: before 7.4.33-150200.3.46.2

php7-shmop-debuginfo: before 7.4.33-150200.3.46.2

php7-shmop: before 7.4.33-150200.3.46.2

php7-readline-debuginfo: before 7.4.33-150200.3.46.2

php7-readline: before 7.4.33-150200.3.46.2

php7-posix-debuginfo: before 7.4.33-150200.3.46.2

php7-posix: before 7.4.33-150200.3.46.2

php7-phar-debuginfo: before 7.4.33-150200.3.46.2

php7-phar: before 7.4.33-150200.3.46.2

php7-pgsql-debuginfo: before 7.4.33-150200.3.46.2

php7-pgsql: before 7.4.33-150200.3.46.2

php7-pdo-debuginfo: before 7.4.33-150200.3.46.2

php7-pdo: before 7.4.33-150200.3.46.2

php7-pcntl-debuginfo: before 7.4.33-150200.3.46.2

php7-pcntl: before 7.4.33-150200.3.46.2

php7-openssl-debuginfo: before 7.4.33-150200.3.46.2

php7-openssl: before 7.4.33-150200.3.46.2

php7-opcache-debuginfo: before 7.4.33-150200.3.46.2

php7-opcache: before 7.4.33-150200.3.46.2

php7-odbc-debuginfo: before 7.4.33-150200.3.46.2

php7-odbc: before 7.4.33-150200.3.46.2

php7-mysql-debuginfo: before 7.4.33-150200.3.46.2

php7-mysql: before 7.4.33-150200.3.46.2

php7-mbstring-debuginfo: before 7.4.33-150200.3.46.2

php7-mbstring: before 7.4.33-150200.3.46.2

php7-ldap-debuginfo: before 7.4.33-150200.3.46.2

php7-ldap: before 7.4.33-150200.3.46.2

php7-json-debuginfo: before 7.4.33-150200.3.46.2

php7-json: before 7.4.33-150200.3.46.2

php7-intl-debuginfo: before 7.4.33-150200.3.46.2

php7-intl: before 7.4.33-150200.3.46.2

php7-iconv-debuginfo: before 7.4.33-150200.3.46.2

php7-iconv: before 7.4.33-150200.3.46.2

php7-gmp-debuginfo: before 7.4.33-150200.3.46.2

php7-gmp: before 7.4.33-150200.3.46.2

php7-gettext-debuginfo: before 7.4.33-150200.3.46.2

php7-gettext: before 7.4.33-150200.3.46.2

php7-gd-debuginfo: before 7.4.33-150200.3.46.2

php7-gd: before 7.4.33-150200.3.46.2

php7-ftp-debuginfo: before 7.4.33-150200.3.46.2

php7-ftp: before 7.4.33-150200.3.46.2

php7-fpm-debuginfo: before 7.4.33-150200.3.46.2

php7-fpm: before 7.4.33-150200.3.46.2

php7-fileinfo-debuginfo: before 7.4.33-150200.3.46.2

php7-fileinfo: before 7.4.33-150200.3.46.2

php7-fastcgi-debuginfo: before 7.4.33-150200.3.46.2

php7-fastcgi: before 7.4.33-150200.3.46.2

php7-exif-debuginfo: before 7.4.33-150200.3.46.2

php7-exif: before 7.4.33-150200.3.46.2

php7-enchant-debuginfo: before 7.4.33-150200.3.46.2

php7-enchant: before 7.4.33-150200.3.46.2

php7-embed-debuginfo: before 7.4.33-150200.3.46.2

php7-embed: before 7.4.33-150200.3.46.2

php7-dom-debuginfo: before 7.4.33-150200.3.46.2

php7-dom: before 7.4.33-150200.3.46.2

php7-devel: before 7.4.33-150200.3.46.2

php7-debugsource: before 7.4.33-150200.3.46.2

php7-debuginfo: before 7.4.33-150200.3.46.2

php7-dba-debuginfo: before 7.4.33-150200.3.46.2

php7-dba: before 7.4.33-150200.3.46.2

php7-curl-debuginfo: before 7.4.33-150200.3.46.2

php7-curl: before 7.4.33-150200.3.46.2

php7-ctype-debuginfo: before 7.4.33-150200.3.46.2

php7-ctype: before 7.4.33-150200.3.46.2

php7-calendar-debuginfo: before 7.4.33-150200.3.46.2

php7-calendar: before 7.4.33-150200.3.46.2

php7-bz2-debuginfo: before 7.4.33-150200.3.46.2

php7-bz2: before 7.4.33-150200.3.46.2

php7-bcmath-debuginfo: before 7.4.33-150200.3.46.2

php7-bcmath: before 7.4.33-150200.3.46.2

php7: before 7.4.33-150200.3.46.2

apache2-mod_php7-debuginfo: before 7.4.33-150200.3.46.2

apache2-mod_php7: before 7.4.33-150200.3.46.2

php7-firebird-debuginfo: before 7.4.33-150200.3.46.2

php7-firebird: before 7.4.33-150200.3.46.2

CPE2.3

• cpe:2.3:o:suse:suse_enterprise_storage:7.1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_module_for_web_scripting:15-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_retail_branch_server:4.1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_retail_branch_server:4.2:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_server:4.1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_server:4.2:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_proxy:4.1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_proxy:4.2:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap:15-SP2:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server:15-SP2-LTSS:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing:15-SP2-LTSS:*:*:*:*:*:*:*
• cpe:2.3:o:suse:opensuse_leap:15.3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications:15-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_module_for_packagehub_subpackages:15-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:php7-zlib-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-zlib:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-zip-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-zip:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xsl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xsl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xmlwriter-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xmlwriter:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xmlrpc-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xmlrpc:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xmlreader-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xmlreader:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-tokenizer-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-tokenizer:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-tidy-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-tidy:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-test:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sysvshm-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sysvshm:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sysvsem-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sysvsem:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sysvmsg-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sysvmsg:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sqlite-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sqlite:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sodium-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sodium:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sockets-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sockets:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-soap-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-soap:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-snmp-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-snmp:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-shmop-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-shmop:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-readline-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-readline:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-posix-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-posix:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-phar-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-phar:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-pgsql-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-pgsql:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-pdo-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-pdo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-pcntl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-pcntl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-openssl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-openssl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-opcache-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-opcache:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-odbc-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-odbc:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-mysql-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-mysql:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-mbstring-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-mbstring:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-ldap-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-ldap:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-json-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-json:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-intl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-intl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-iconv-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-iconv:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-gmp-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-gmp:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-gettext-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-gettext:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-gd-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-gd:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-ftp-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-ftp:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-fpm-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-fpm:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-fileinfo-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-fileinfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-fastcgi-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-fastcgi:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-exif-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-exif:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-enchant-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-enchant:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-embed-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-embed:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-dom-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-dom:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-devel:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-debugsource:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-dba-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-dba:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-curl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-curl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-ctype-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-ctype:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-calendar-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-calendar:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-bz2-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-bz2:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-bcmath-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-bcmath:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:apache2-mod_php7-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:apache2-mod_php7:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-firebird-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-firebird:*:*:*:*:*:suse_linux:*:*

External links

https://www.suse.com/support/update/announcement/2022/suse-su-20224069-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Input validation error

EUVDB-ID: #VU49338

Risk: Medium

CVSSv4.0: 5.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/U:Green]

CVE-ID: CVE-2020-7071

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to insufficient validation of URL performed via the "FILTER_VALIDATE_URL" setting. A remote attacker can use the "@" characters in the URL to bypass implemented filter and force the application to accept arbitrary URL instead of the defined by the option.

Example:

http://evel.website@trusted.website

Mitigation

Update the affected package php7 to the latest version.

Vulnerable software versions

SUSE Enterprise Storage: 7.1

SUSE Linux Enterprise Module for Web Scripting: 15-SP3

SUSE Manager Retail Branch Server: 4.1 - 4.2

SUSE Manager Server: 4.1 - 4.2

SUSE Manager Proxy: 4.1 - 4.2

SUSE Linux Enterprise Server for SAP: 15-SP2

SUSE Linux Enterprise Server: 15-SP2-LTSS - 15-SP3

SUSE Linux Enterprise High Performance Computing: 15-SP2-LTSS - 15-SP3

openSUSE Leap: 15.3 - 15.4

SUSE Linux Enterprise Server for SAP Applications: 15-SP3

SUSE Linux Enterprise Module for Packagehub Subpackages: 15-SP3

php7-zlib-debuginfo: before 7.4.33-150200.3.46.2

php7-zlib: before 7.4.33-150200.3.46.2

php7-zip-debuginfo: before 7.4.33-150200.3.46.2

php7-zip: before 7.4.33-150200.3.46.2

php7-xsl-debuginfo: before 7.4.33-150200.3.46.2

php7-xsl: before 7.4.33-150200.3.46.2

php7-xmlwriter-debuginfo: before 7.4.33-150200.3.46.2

php7-xmlwriter: before 7.4.33-150200.3.46.2

php7-xmlrpc-debuginfo: before 7.4.33-150200.3.46.2

php7-xmlrpc: before 7.4.33-150200.3.46.2

php7-xmlreader-debuginfo: before 7.4.33-150200.3.46.2

php7-xmlreader: before 7.4.33-150200.3.46.2

php7-tokenizer-debuginfo: before 7.4.33-150200.3.46.2

php7-tokenizer: before 7.4.33-150200.3.46.2

php7-tidy-debuginfo: before 7.4.33-150200.3.46.2

php7-tidy: before 7.4.33-150200.3.46.2

php7-test: before 7.4.33-150200.3.46.2

php7-sysvshm-debuginfo: before 7.4.33-150200.3.46.2

php7-sysvshm: before 7.4.33-150200.3.46.2

php7-sysvsem-debuginfo: before 7.4.33-150200.3.46.2

php7-sysvsem: before 7.4.33-150200.3.46.2

php7-sysvmsg-debuginfo: before 7.4.33-150200.3.46.2

php7-sysvmsg: before 7.4.33-150200.3.46.2

php7-sqlite-debuginfo: before 7.4.33-150200.3.46.2

php7-sqlite: before 7.4.33-150200.3.46.2

php7-sodium-debuginfo: before 7.4.33-150200.3.46.2

php7-sodium: before 7.4.33-150200.3.46.2

php7-sockets-debuginfo: before 7.4.33-150200.3.46.2

php7-sockets: before 7.4.33-150200.3.46.2

php7-soap-debuginfo: before 7.4.33-150200.3.46.2

php7-soap: before 7.4.33-150200.3.46.2

php7-snmp-debuginfo: before 7.4.33-150200.3.46.2

php7-snmp: before 7.4.33-150200.3.46.2

php7-shmop-debuginfo: before 7.4.33-150200.3.46.2

php7-shmop: before 7.4.33-150200.3.46.2

php7-readline-debuginfo: before 7.4.33-150200.3.46.2

php7-readline: before 7.4.33-150200.3.46.2

php7-posix-debuginfo: before 7.4.33-150200.3.46.2

php7-posix: before 7.4.33-150200.3.46.2

php7-phar-debuginfo: before 7.4.33-150200.3.46.2

php7-phar: before 7.4.33-150200.3.46.2

php7-pgsql-debuginfo: before 7.4.33-150200.3.46.2

php7-pgsql: before 7.4.33-150200.3.46.2

php7-pdo-debuginfo: before 7.4.33-150200.3.46.2

php7-pdo: before 7.4.33-150200.3.46.2

php7-pcntl-debuginfo: before 7.4.33-150200.3.46.2

php7-pcntl: before 7.4.33-150200.3.46.2

php7-openssl-debuginfo: before 7.4.33-150200.3.46.2

php7-openssl: before 7.4.33-150200.3.46.2

php7-opcache-debuginfo: before 7.4.33-150200.3.46.2

php7-opcache: before 7.4.33-150200.3.46.2

php7-odbc-debuginfo: before 7.4.33-150200.3.46.2

php7-odbc: before 7.4.33-150200.3.46.2

php7-mysql-debuginfo: before 7.4.33-150200.3.46.2

php7-mysql: before 7.4.33-150200.3.46.2

php7-mbstring-debuginfo: before 7.4.33-150200.3.46.2

php7-mbstring: before 7.4.33-150200.3.46.2

php7-ldap-debuginfo: before 7.4.33-150200.3.46.2

php7-ldap: before 7.4.33-150200.3.46.2

php7-json-debuginfo: before 7.4.33-150200.3.46.2

php7-json: before 7.4.33-150200.3.46.2

php7-intl-debuginfo: before 7.4.33-150200.3.46.2

php7-intl: before 7.4.33-150200.3.46.2

php7-iconv-debuginfo: before 7.4.33-150200.3.46.2

php7-iconv: before 7.4.33-150200.3.46.2

php7-gmp-debuginfo: before 7.4.33-150200.3.46.2

php7-gmp: before 7.4.33-150200.3.46.2

php7-gettext-debuginfo: before 7.4.33-150200.3.46.2

php7-gettext: before 7.4.33-150200.3.46.2

php7-gd-debuginfo: before 7.4.33-150200.3.46.2

php7-gd: before 7.4.33-150200.3.46.2

php7-ftp-debuginfo: before 7.4.33-150200.3.46.2

php7-ftp: before 7.4.33-150200.3.46.2

php7-fpm-debuginfo: before 7.4.33-150200.3.46.2

php7-fpm: before 7.4.33-150200.3.46.2

php7-fileinfo-debuginfo: before 7.4.33-150200.3.46.2

php7-fileinfo: before 7.4.33-150200.3.46.2

php7-fastcgi-debuginfo: before 7.4.33-150200.3.46.2

php7-fastcgi: before 7.4.33-150200.3.46.2

php7-exif-debuginfo: before 7.4.33-150200.3.46.2

php7-exif: before 7.4.33-150200.3.46.2

php7-enchant-debuginfo: before 7.4.33-150200.3.46.2

php7-enchant: before 7.4.33-150200.3.46.2

php7-embed-debuginfo: before 7.4.33-150200.3.46.2

php7-embed: before 7.4.33-150200.3.46.2

php7-dom-debuginfo: before 7.4.33-150200.3.46.2

php7-dom: before 7.4.33-150200.3.46.2

php7-devel: before 7.4.33-150200.3.46.2

php7-debugsource: before 7.4.33-150200.3.46.2

php7-debuginfo: before 7.4.33-150200.3.46.2

php7-dba-debuginfo: before 7.4.33-150200.3.46.2

php7-dba: before 7.4.33-150200.3.46.2

php7-curl-debuginfo: before 7.4.33-150200.3.46.2

php7-curl: before 7.4.33-150200.3.46.2

php7-ctype-debuginfo: before 7.4.33-150200.3.46.2

php7-ctype: before 7.4.33-150200.3.46.2

php7-calendar-debuginfo: before 7.4.33-150200.3.46.2

php7-calendar: before 7.4.33-150200.3.46.2

php7-bz2-debuginfo: before 7.4.33-150200.3.46.2

php7-bz2: before 7.4.33-150200.3.46.2

php7-bcmath-debuginfo: before 7.4.33-150200.3.46.2

php7-bcmath: before 7.4.33-150200.3.46.2

php7: before 7.4.33-150200.3.46.2

apache2-mod_php7-debuginfo: before 7.4.33-150200.3.46.2

apache2-mod_php7: before 7.4.33-150200.3.46.2

php7-firebird-debuginfo: before 7.4.33-150200.3.46.2

php7-firebird: before 7.4.33-150200.3.46.2

CPE2.3

• cpe:2.3:o:suse:suse_enterprise_storage:7.1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_module_for_web_scripting:15-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_retail_branch_server:4.1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_retail_branch_server:4.2:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_server:4.1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_server:4.2:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_proxy:4.1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_proxy:4.2:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap:15-SP2:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server:15-SP2-LTSS:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing:15-SP2-LTSS:*:*:*:*:*:*:*
• cpe:2.3:o:suse:opensuse_leap:15.3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications:15-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_module_for_packagehub_subpackages:15-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:php7-zlib-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-zlib:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-zip-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-zip:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xsl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xsl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xmlwriter-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xmlwriter:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xmlrpc-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xmlrpc:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xmlreader-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xmlreader:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-tokenizer-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-tokenizer:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-tidy-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-tidy:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-test:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sysvshm-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sysvshm:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sysvsem-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sysvsem:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sysvmsg-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sysvmsg:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sqlite-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sqlite:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sodium-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sodium:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sockets-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sockets:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-soap-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-soap:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-snmp-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-snmp:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-shmop-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-shmop:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-readline-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-readline:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-posix-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-posix:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-phar-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-phar:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-pgsql-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-pgsql:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-pdo-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-pdo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-pcntl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-pcntl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-openssl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-openssl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-opcache-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-opcache:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-odbc-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-odbc:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-mysql-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-mysql:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-mbstring-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-mbstring:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-ldap-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-ldap:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-json-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-json:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-intl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-intl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-iconv-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-iconv:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-gmp-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-gmp:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-gettext-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-gettext:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-gd-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-gd:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-ftp-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-ftp:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-fpm-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-fpm:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-fileinfo-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-fileinfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-fastcgi-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-fastcgi:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-exif-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-exif:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-enchant-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-enchant:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-embed-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-embed:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-dom-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-dom:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-devel:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-debugsource:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-dba-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-dba:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-curl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-curl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-ctype-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-ctype:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-calendar-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-calendar:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-bz2-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-bz2:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-bcmath-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-bcmath:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:apache2-mod_php7-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:apache2-mod_php7:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-firebird-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-firebird:*:*:*:*:*:suse_linux:*:*

External links

https://www.suse.com/support/update/announcement/2022/suse-su-20224069-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

6) NULL pointer dereference

EUVDB-ID: #VU50403

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2021-21702

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error within the SoapClient in PHP. A remote attacker can pass specially crafted data to the application and perform a denial of service (DoS) attack.

Mitigation

Update the affected package php7 to the latest version.

Vulnerable software versions

SUSE Enterprise Storage: 7.1

SUSE Linux Enterprise Module for Web Scripting: 15-SP3

SUSE Manager Retail Branch Server: 4.1 - 4.2

SUSE Manager Server: 4.1 - 4.2

SUSE Manager Proxy: 4.1 - 4.2

SUSE Linux Enterprise Server for SAP: 15-SP2

SUSE Linux Enterprise Server: 15-SP2-LTSS - 15-SP3

SUSE Linux Enterprise High Performance Computing: 15-SP2-LTSS - 15-SP3

openSUSE Leap: 15.3 - 15.4

SUSE Linux Enterprise Server for SAP Applications: 15-SP3

SUSE Linux Enterprise Module for Packagehub Subpackages: 15-SP3

php7-zlib-debuginfo: before 7.4.33-150200.3.46.2

php7-zlib: before 7.4.33-150200.3.46.2

php7-zip-debuginfo: before 7.4.33-150200.3.46.2

php7-zip: before 7.4.33-150200.3.46.2

php7-xsl-debuginfo: before 7.4.33-150200.3.46.2

php7-xsl: before 7.4.33-150200.3.46.2

php7-xmlwriter-debuginfo: before 7.4.33-150200.3.46.2

php7-xmlwriter: before 7.4.33-150200.3.46.2

php7-xmlrpc-debuginfo: before 7.4.33-150200.3.46.2

php7-xmlrpc: before 7.4.33-150200.3.46.2

php7-xmlreader-debuginfo: before 7.4.33-150200.3.46.2

php7-xmlreader: before 7.4.33-150200.3.46.2

php7-tokenizer-debuginfo: before 7.4.33-150200.3.46.2

php7-tokenizer: before 7.4.33-150200.3.46.2

php7-tidy-debuginfo: before 7.4.33-150200.3.46.2

php7-tidy: before 7.4.33-150200.3.46.2

php7-test: before 7.4.33-150200.3.46.2

php7-sysvshm-debuginfo: before 7.4.33-150200.3.46.2

php7-sysvshm: before 7.4.33-150200.3.46.2

php7-sysvsem-debuginfo: before 7.4.33-150200.3.46.2

php7-sysvsem: before 7.4.33-150200.3.46.2

php7-sysvmsg-debuginfo: before 7.4.33-150200.3.46.2

php7-sysvmsg: before 7.4.33-150200.3.46.2

php7-sqlite-debuginfo: before 7.4.33-150200.3.46.2

php7-sqlite: before 7.4.33-150200.3.46.2

php7-sodium-debuginfo: before 7.4.33-150200.3.46.2

php7-sodium: before 7.4.33-150200.3.46.2

php7-sockets-debuginfo: before 7.4.33-150200.3.46.2

php7-sockets: before 7.4.33-150200.3.46.2

php7-soap-debuginfo: before 7.4.33-150200.3.46.2

php7-soap: before 7.4.33-150200.3.46.2

php7-snmp-debuginfo: before 7.4.33-150200.3.46.2

php7-snmp: before 7.4.33-150200.3.46.2

php7-shmop-debuginfo: before 7.4.33-150200.3.46.2

php7-shmop: before 7.4.33-150200.3.46.2

php7-readline-debuginfo: before 7.4.33-150200.3.46.2

php7-readline: before 7.4.33-150200.3.46.2

php7-posix-debuginfo: before 7.4.33-150200.3.46.2

php7-posix: before 7.4.33-150200.3.46.2

php7-phar-debuginfo: before 7.4.33-150200.3.46.2

php7-phar: before 7.4.33-150200.3.46.2

php7-pgsql-debuginfo: before 7.4.33-150200.3.46.2

php7-pgsql: before 7.4.33-150200.3.46.2

php7-pdo-debuginfo: before 7.4.33-150200.3.46.2

php7-pdo: before 7.4.33-150200.3.46.2

php7-pcntl-debuginfo: before 7.4.33-150200.3.46.2

php7-pcntl: before 7.4.33-150200.3.46.2

php7-openssl-debuginfo: before 7.4.33-150200.3.46.2

php7-openssl: before 7.4.33-150200.3.46.2

php7-opcache-debuginfo: before 7.4.33-150200.3.46.2

php7-opcache: before 7.4.33-150200.3.46.2

php7-odbc-debuginfo: before 7.4.33-150200.3.46.2

php7-odbc: before 7.4.33-150200.3.46.2

php7-mysql-debuginfo: before 7.4.33-150200.3.46.2

php7-mysql: before 7.4.33-150200.3.46.2

php7-mbstring-debuginfo: before 7.4.33-150200.3.46.2

php7-mbstring: before 7.4.33-150200.3.46.2

php7-ldap-debuginfo: before 7.4.33-150200.3.46.2

php7-ldap: before 7.4.33-150200.3.46.2

php7-json-debuginfo: before 7.4.33-150200.3.46.2

php7-json: before 7.4.33-150200.3.46.2

php7-intl-debuginfo: before 7.4.33-150200.3.46.2

php7-intl: before 7.4.33-150200.3.46.2

php7-iconv-debuginfo: before 7.4.33-150200.3.46.2

php7-iconv: before 7.4.33-150200.3.46.2

php7-gmp-debuginfo: before 7.4.33-150200.3.46.2

php7-gmp: before 7.4.33-150200.3.46.2

php7-gettext-debuginfo: before 7.4.33-150200.3.46.2

php7-gettext: before 7.4.33-150200.3.46.2

php7-gd-debuginfo: before 7.4.33-150200.3.46.2

php7-gd: before 7.4.33-150200.3.46.2

php7-ftp-debuginfo: before 7.4.33-150200.3.46.2

php7-ftp: before 7.4.33-150200.3.46.2

php7-fpm-debuginfo: before 7.4.33-150200.3.46.2

php7-fpm: before 7.4.33-150200.3.46.2

php7-fileinfo-debuginfo: before 7.4.33-150200.3.46.2

php7-fileinfo: before 7.4.33-150200.3.46.2

php7-fastcgi-debuginfo: before 7.4.33-150200.3.46.2

php7-fastcgi: before 7.4.33-150200.3.46.2

php7-exif-debuginfo: before 7.4.33-150200.3.46.2

php7-exif: before 7.4.33-150200.3.46.2

php7-enchant-debuginfo: before 7.4.33-150200.3.46.2

php7-enchant: before 7.4.33-150200.3.46.2

php7-embed-debuginfo: before 7.4.33-150200.3.46.2

php7-embed: before 7.4.33-150200.3.46.2

php7-dom-debuginfo: before 7.4.33-150200.3.46.2

php7-dom: before 7.4.33-150200.3.46.2

php7-devel: before 7.4.33-150200.3.46.2

php7-debugsource: before 7.4.33-150200.3.46.2

php7-debuginfo: before 7.4.33-150200.3.46.2

php7-dba-debuginfo: before 7.4.33-150200.3.46.2

php7-dba: before 7.4.33-150200.3.46.2

php7-curl-debuginfo: before 7.4.33-150200.3.46.2

php7-curl: before 7.4.33-150200.3.46.2

php7-ctype-debuginfo: before 7.4.33-150200.3.46.2

php7-ctype: before 7.4.33-150200.3.46.2

php7-calendar-debuginfo: before 7.4.33-150200.3.46.2

php7-calendar: before 7.4.33-150200.3.46.2

php7-bz2-debuginfo: before 7.4.33-150200.3.46.2

php7-bz2: before 7.4.33-150200.3.46.2

php7-bcmath-debuginfo: before 7.4.33-150200.3.46.2

php7-bcmath: before 7.4.33-150200.3.46.2

php7: before 7.4.33-150200.3.46.2

apache2-mod_php7-debuginfo: before 7.4.33-150200.3.46.2

apache2-mod_php7: before 7.4.33-150200.3.46.2

php7-firebird-debuginfo: before 7.4.33-150200.3.46.2

php7-firebird: before 7.4.33-150200.3.46.2

CPE2.3

• cpe:2.3:o:suse:suse_enterprise_storage:7.1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_module_for_web_scripting:15-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_retail_branch_server:4.1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_retail_branch_server:4.2:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_server:4.1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_server:4.2:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_proxy:4.1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_proxy:4.2:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap:15-SP2:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server:15-SP2-LTSS:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing:15-SP2-LTSS:*:*:*:*:*:*:*
• cpe:2.3:o:suse:opensuse_leap:15.3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications:15-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_module_for_packagehub_subpackages:15-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:php7-zlib-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-zlib:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-zip-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-zip:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xsl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xsl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xmlwriter-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xmlwriter:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xmlrpc-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xmlrpc:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xmlreader-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xmlreader:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-tokenizer-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-tokenizer:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-tidy-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-tidy:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-test:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sysvshm-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sysvshm:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sysvsem-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sysvsem:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sysvmsg-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sysvmsg:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sqlite-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sqlite:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sodium-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sodium:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sockets-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sockets:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-soap-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-soap:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-snmp-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-snmp:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-shmop-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-shmop:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-readline-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-readline:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-posix-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-posix:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-phar-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-phar:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-pgsql-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-pgsql:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-pdo-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-pdo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-pcntl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-pcntl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-openssl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-openssl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-opcache-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-opcache:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-odbc-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-odbc:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-mysql-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-mysql:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-mbstring-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-mbstring:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-ldap-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-ldap:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-json-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-json:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-intl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-intl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-iconv-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-iconv:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-gmp-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-gmp:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-gettext-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-gettext:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-gd-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-gd:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-ftp-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-ftp:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-fpm-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-fpm:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-fileinfo-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-fileinfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-fastcgi-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-fastcgi:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-exif-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-exif:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-enchant-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-enchant:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-embed-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-embed:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-dom-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-dom:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-devel:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-debugsource:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-dba-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-dba:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-curl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-curl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-ctype-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-ctype:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-calendar-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-calendar:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-bz2-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-bz2:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-bcmath-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-bcmath:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:apache2-mod_php7-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:apache2-mod_php7:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-firebird-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-firebird:*:*:*:*:*:suse_linux:*:*

External links

https://www.suse.com/support/update/announcement/2022/suse-su-20224069-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Out-of-bounds write

EUVDB-ID: #VU57656

Risk: Low

CVSSv4.0: 7.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Clear]

CVE-ID: CVE-2021-21703

CWE-ID: CWE-787 - Out-of-bounds write

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists in the way PHP handles shared memory access, when using PHP FPM SAPI with main FPM daemon process running as root and child worker processes running as lower-privileged users. A child process can access shared memory with the main process and write to it. As a result, it is possible to cause the root process to conduct invalid memory reads and writes with root privileges. A local user can trigger an out-of-bounds write error and execute arbitrary code on the system with root privileges.

Mitigation

Update the affected package php7 to the latest version.

Vulnerable software versions

SUSE Enterprise Storage: 7.1

SUSE Linux Enterprise Module for Web Scripting: 15-SP3

SUSE Manager Retail Branch Server: 4.1 - 4.2

SUSE Manager Server: 4.1 - 4.2

SUSE Manager Proxy: 4.1 - 4.2

SUSE Linux Enterprise Server for SAP: 15-SP2

SUSE Linux Enterprise Server: 15-SP2-LTSS - 15-SP3

SUSE Linux Enterprise High Performance Computing: 15-SP2-LTSS - 15-SP3

openSUSE Leap: 15.3 - 15.4

SUSE Linux Enterprise Server for SAP Applications: 15-SP3

SUSE Linux Enterprise Module for Packagehub Subpackages: 15-SP3

php7-zlib-debuginfo: before 7.4.33-150200.3.46.2

php7-zlib: before 7.4.33-150200.3.46.2

php7-zip-debuginfo: before 7.4.33-150200.3.46.2

php7-zip: before 7.4.33-150200.3.46.2

php7-xsl-debuginfo: before 7.4.33-150200.3.46.2

php7-xsl: before 7.4.33-150200.3.46.2

php7-xmlwriter-debuginfo: before 7.4.33-150200.3.46.2

php7-xmlwriter: before 7.4.33-150200.3.46.2

php7-xmlrpc-debuginfo: before 7.4.33-150200.3.46.2

php7-xmlrpc: before 7.4.33-150200.3.46.2

php7-xmlreader-debuginfo: before 7.4.33-150200.3.46.2

php7-xmlreader: before 7.4.33-150200.3.46.2

php7-tokenizer-debuginfo: before 7.4.33-150200.3.46.2

php7-tokenizer: before 7.4.33-150200.3.46.2

php7-tidy-debuginfo: before 7.4.33-150200.3.46.2

php7-tidy: before 7.4.33-150200.3.46.2

php7-test: before 7.4.33-150200.3.46.2

php7-sysvshm-debuginfo: before 7.4.33-150200.3.46.2

php7-sysvshm: before 7.4.33-150200.3.46.2

php7-sysvsem-debuginfo: before 7.4.33-150200.3.46.2

php7-sysvsem: before 7.4.33-150200.3.46.2

php7-sysvmsg-debuginfo: before 7.4.33-150200.3.46.2

php7-sysvmsg: before 7.4.33-150200.3.46.2

php7-sqlite-debuginfo: before 7.4.33-150200.3.46.2

php7-sqlite: before 7.4.33-150200.3.46.2

php7-sodium-debuginfo: before 7.4.33-150200.3.46.2

php7-sodium: before 7.4.33-150200.3.46.2

php7-sockets-debuginfo: before 7.4.33-150200.3.46.2

php7-sockets: before 7.4.33-150200.3.46.2

php7-soap-debuginfo: before 7.4.33-150200.3.46.2

php7-soap: before 7.4.33-150200.3.46.2

php7-snmp-debuginfo: before 7.4.33-150200.3.46.2

php7-snmp: before 7.4.33-150200.3.46.2

php7-shmop-debuginfo: before 7.4.33-150200.3.46.2

php7-shmop: before 7.4.33-150200.3.46.2

php7-readline-debuginfo: before 7.4.33-150200.3.46.2

php7-readline: before 7.4.33-150200.3.46.2

php7-posix-debuginfo: before 7.4.33-150200.3.46.2

php7-posix: before 7.4.33-150200.3.46.2

php7-phar-debuginfo: before 7.4.33-150200.3.46.2

php7-phar: before 7.4.33-150200.3.46.2

php7-pgsql-debuginfo: before 7.4.33-150200.3.46.2

php7-pgsql: before 7.4.33-150200.3.46.2

php7-pdo-debuginfo: before 7.4.33-150200.3.46.2

php7-pdo: before 7.4.33-150200.3.46.2

php7-pcntl-debuginfo: before 7.4.33-150200.3.46.2

php7-pcntl: before 7.4.33-150200.3.46.2

php7-openssl-debuginfo: before 7.4.33-150200.3.46.2

php7-openssl: before 7.4.33-150200.3.46.2

php7-opcache-debuginfo: before 7.4.33-150200.3.46.2

php7-opcache: before 7.4.33-150200.3.46.2

php7-odbc-debuginfo: before 7.4.33-150200.3.46.2

php7-odbc: before 7.4.33-150200.3.46.2

php7-mysql-debuginfo: before 7.4.33-150200.3.46.2

php7-mysql: before 7.4.33-150200.3.46.2

php7-mbstring-debuginfo: before 7.4.33-150200.3.46.2

php7-mbstring: before 7.4.33-150200.3.46.2

php7-ldap-debuginfo: before 7.4.33-150200.3.46.2

php7-ldap: before 7.4.33-150200.3.46.2

php7-json-debuginfo: before 7.4.33-150200.3.46.2

php7-json: before 7.4.33-150200.3.46.2

php7-intl-debuginfo: before 7.4.33-150200.3.46.2

php7-intl: before 7.4.33-150200.3.46.2

php7-iconv-debuginfo: before 7.4.33-150200.3.46.2

php7-iconv: before 7.4.33-150200.3.46.2

php7-gmp-debuginfo: before 7.4.33-150200.3.46.2

php7-gmp: before 7.4.33-150200.3.46.2

php7-gettext-debuginfo: before 7.4.33-150200.3.46.2

php7-gettext: before 7.4.33-150200.3.46.2

php7-gd-debuginfo: before 7.4.33-150200.3.46.2

php7-gd: before 7.4.33-150200.3.46.2

php7-ftp-debuginfo: before 7.4.33-150200.3.46.2

php7-ftp: before 7.4.33-150200.3.46.2

php7-fpm-debuginfo: before 7.4.33-150200.3.46.2

php7-fpm: before 7.4.33-150200.3.46.2

php7-fileinfo-debuginfo: before 7.4.33-150200.3.46.2

php7-fileinfo: before 7.4.33-150200.3.46.2

php7-fastcgi-debuginfo: before 7.4.33-150200.3.46.2

php7-fastcgi: before 7.4.33-150200.3.46.2

php7-exif-debuginfo: before 7.4.33-150200.3.46.2

php7-exif: before 7.4.33-150200.3.46.2

php7-enchant-debuginfo: before 7.4.33-150200.3.46.2

php7-enchant: before 7.4.33-150200.3.46.2

php7-embed-debuginfo: before 7.4.33-150200.3.46.2

php7-embed: before 7.4.33-150200.3.46.2

php7-dom-debuginfo: before 7.4.33-150200.3.46.2

php7-dom: before 7.4.33-150200.3.46.2

php7-devel: before 7.4.33-150200.3.46.2

php7-debugsource: before 7.4.33-150200.3.46.2

php7-debuginfo: before 7.4.33-150200.3.46.2

php7-dba-debuginfo: before 7.4.33-150200.3.46.2

php7-dba: before 7.4.33-150200.3.46.2

php7-curl-debuginfo: before 7.4.33-150200.3.46.2

php7-curl: before 7.4.33-150200.3.46.2

php7-ctype-debuginfo: before 7.4.33-150200.3.46.2

php7-ctype: before 7.4.33-150200.3.46.2

php7-calendar-debuginfo: before 7.4.33-150200.3.46.2

php7-calendar: before 7.4.33-150200.3.46.2

php7-bz2-debuginfo: before 7.4.33-150200.3.46.2

php7-bz2: before 7.4.33-150200.3.46.2

php7-bcmath-debuginfo: before 7.4.33-150200.3.46.2

php7-bcmath: before 7.4.33-150200.3.46.2

php7: before 7.4.33-150200.3.46.2

apache2-mod_php7-debuginfo: before 7.4.33-150200.3.46.2

apache2-mod_php7: before 7.4.33-150200.3.46.2

php7-firebird-debuginfo: before 7.4.33-150200.3.46.2

php7-firebird: before 7.4.33-150200.3.46.2

CPE2.3

• cpe:2.3:o:suse:suse_enterprise_storage:7.1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_module_for_web_scripting:15-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_retail_branch_server:4.1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_retail_branch_server:4.2:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_server:4.1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_server:4.2:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_proxy:4.1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_proxy:4.2:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap:15-SP2:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server:15-SP2-LTSS:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing:15-SP2-LTSS:*:*:*:*:*:*:*
• cpe:2.3:o:suse:opensuse_leap:15.3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications:15-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_module_for_packagehub_subpackages:15-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:php7-zlib-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-zlib:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-zip-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-zip:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xsl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xsl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xmlwriter-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xmlwriter:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xmlrpc-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xmlrpc:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xmlreader-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xmlreader:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-tokenizer-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-tokenizer:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-tidy-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-tidy:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-test:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sysvshm-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sysvshm:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sysvsem-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sysvsem:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sysvmsg-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sysvmsg:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sqlite-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sqlite:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sodium-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sodium:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sockets-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sockets:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-soap-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-soap:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-snmp-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-snmp:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-shmop-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-shmop:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-readline-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-readline:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-posix-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-posix:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-phar-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-phar:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-pgsql-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-pgsql:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-pdo-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-pdo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-pcntl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-pcntl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-openssl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-openssl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-opcache-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-opcache:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-odbc-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-odbc:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-mysql-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-mysql:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-mbstring-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-mbstring:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-ldap-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-ldap:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-json-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-json:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-intl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-intl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-iconv-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-iconv:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-gmp-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-gmp:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-gettext-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-gettext:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-gd-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-gd:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-ftp-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-ftp:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-fpm-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-fpm:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-fileinfo-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-fileinfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-fastcgi-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-fastcgi:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-exif-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-exif:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-enchant-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-enchant:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-embed-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-embed:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-dom-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-dom:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-devel:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-debugsource:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-dba-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-dba:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-curl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-curl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-ctype-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-ctype:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-calendar-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-calendar:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-bz2-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-bz2:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-bcmath-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-bcmath:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:apache2-mod_php7-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:apache2-mod_php7:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-firebird-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-firebird:*:*:*:*:*:suse_linux:*:*

External links

https://www.suse.com/support/update/announcement/2022/suse-su-20224069-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

8) Stack-based buffer overflow

EUVDB-ID: #VU54566

Risk: High

CVSSv4.0: 7.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2021-21704

CWE-ID: CWE-121 - Stack-based buffer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

Multiple boundary errors exists within firebird_info_cb(), firebird_handle_doer(), firebird_stmt_execute(), and firebird_fetch_blob() function. A remote attacker can pass specially crafted input to the application, trigger a stack-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update the affected package php7 to the latest version.

Vulnerable software versions

SUSE Enterprise Storage: 7.1

SUSE Linux Enterprise Module for Web Scripting: 15-SP3

SUSE Manager Retail Branch Server: 4.1 - 4.2

SUSE Manager Server: 4.1 - 4.2

SUSE Manager Proxy: 4.1 - 4.2

SUSE Linux Enterprise Server for SAP: 15-SP2

SUSE Linux Enterprise Server: 15-SP2-LTSS - 15-SP3

SUSE Linux Enterprise High Performance Computing: 15-SP2-LTSS - 15-SP3

openSUSE Leap: 15.3 - 15.4

SUSE Linux Enterprise Server for SAP Applications: 15-SP3

SUSE Linux Enterprise Module for Packagehub Subpackages: 15-SP3

php7-zlib-debuginfo: before 7.4.33-150200.3.46.2

php7-zlib: before 7.4.33-150200.3.46.2

php7-zip-debuginfo: before 7.4.33-150200.3.46.2

php7-zip: before 7.4.33-150200.3.46.2

php7-xsl-debuginfo: before 7.4.33-150200.3.46.2

php7-xsl: before 7.4.33-150200.3.46.2

php7-xmlwriter-debuginfo: before 7.4.33-150200.3.46.2

php7-xmlwriter: before 7.4.33-150200.3.46.2

php7-xmlrpc-debuginfo: before 7.4.33-150200.3.46.2

php7-xmlrpc: before 7.4.33-150200.3.46.2

php7-xmlreader-debuginfo: before 7.4.33-150200.3.46.2

php7-xmlreader: before 7.4.33-150200.3.46.2

php7-tokenizer-debuginfo: before 7.4.33-150200.3.46.2

php7-tokenizer: before 7.4.33-150200.3.46.2

php7-tidy-debuginfo: before 7.4.33-150200.3.46.2

php7-tidy: before 7.4.33-150200.3.46.2

php7-test: before 7.4.33-150200.3.46.2

php7-sysvshm-debuginfo: before 7.4.33-150200.3.46.2

php7-sysvshm: before 7.4.33-150200.3.46.2

php7-sysvsem-debuginfo: before 7.4.33-150200.3.46.2

php7-sysvsem: before 7.4.33-150200.3.46.2

php7-sysvmsg-debuginfo: before 7.4.33-150200.3.46.2

php7-sysvmsg: before 7.4.33-150200.3.46.2

php7-sqlite-debuginfo: before 7.4.33-150200.3.46.2

php7-sqlite: before 7.4.33-150200.3.46.2

php7-sodium-debuginfo: before 7.4.33-150200.3.46.2

php7-sodium: before 7.4.33-150200.3.46.2

php7-sockets-debuginfo: before 7.4.33-150200.3.46.2

php7-sockets: before 7.4.33-150200.3.46.2

php7-soap-debuginfo: before 7.4.33-150200.3.46.2

php7-soap: before 7.4.33-150200.3.46.2

php7-snmp-debuginfo: before 7.4.33-150200.3.46.2

php7-snmp: before 7.4.33-150200.3.46.2

php7-shmop-debuginfo: before 7.4.33-150200.3.46.2

php7-shmop: before 7.4.33-150200.3.46.2

php7-readline-debuginfo: before 7.4.33-150200.3.46.2

php7-readline: before 7.4.33-150200.3.46.2

php7-posix-debuginfo: before 7.4.33-150200.3.46.2

php7-posix: before 7.4.33-150200.3.46.2

php7-phar-debuginfo: before 7.4.33-150200.3.46.2

php7-phar: before 7.4.33-150200.3.46.2

php7-pgsql-debuginfo: before 7.4.33-150200.3.46.2

php7-pgsql: before 7.4.33-150200.3.46.2

php7-pdo-debuginfo: before 7.4.33-150200.3.46.2

php7-pdo: before 7.4.33-150200.3.46.2

php7-pcntl-debuginfo: before 7.4.33-150200.3.46.2

php7-pcntl: before 7.4.33-150200.3.46.2

php7-openssl-debuginfo: before 7.4.33-150200.3.46.2

php7-openssl: before 7.4.33-150200.3.46.2

php7-opcache-debuginfo: before 7.4.33-150200.3.46.2

php7-opcache: before 7.4.33-150200.3.46.2

php7-odbc-debuginfo: before 7.4.33-150200.3.46.2

php7-odbc: before 7.4.33-150200.3.46.2

php7-mysql-debuginfo: before 7.4.33-150200.3.46.2

php7-mysql: before 7.4.33-150200.3.46.2

php7-mbstring-debuginfo: before 7.4.33-150200.3.46.2

php7-mbstring: before 7.4.33-150200.3.46.2

php7-ldap-debuginfo: before 7.4.33-150200.3.46.2

php7-ldap: before 7.4.33-150200.3.46.2

php7-json-debuginfo: before 7.4.33-150200.3.46.2

php7-json: before 7.4.33-150200.3.46.2

php7-intl-debuginfo: before 7.4.33-150200.3.46.2

php7-intl: before 7.4.33-150200.3.46.2

php7-iconv-debuginfo: before 7.4.33-150200.3.46.2

php7-iconv: before 7.4.33-150200.3.46.2

php7-gmp-debuginfo: before 7.4.33-150200.3.46.2

php7-gmp: before 7.4.33-150200.3.46.2

php7-gettext-debuginfo: before 7.4.33-150200.3.46.2

php7-gettext: before 7.4.33-150200.3.46.2

php7-gd-debuginfo: before 7.4.33-150200.3.46.2

php7-gd: before 7.4.33-150200.3.46.2

php7-ftp-debuginfo: before 7.4.33-150200.3.46.2

php7-ftp: before 7.4.33-150200.3.46.2

php7-fpm-debuginfo: before 7.4.33-150200.3.46.2

php7-fpm: before 7.4.33-150200.3.46.2

php7-fileinfo-debuginfo: before 7.4.33-150200.3.46.2

php7-fileinfo: before 7.4.33-150200.3.46.2

php7-fastcgi-debuginfo: before 7.4.33-150200.3.46.2

php7-fastcgi: before 7.4.33-150200.3.46.2

php7-exif-debuginfo: before 7.4.33-150200.3.46.2

php7-exif: before 7.4.33-150200.3.46.2

php7-enchant-debuginfo: before 7.4.33-150200.3.46.2

php7-enchant: before 7.4.33-150200.3.46.2

php7-embed-debuginfo: before 7.4.33-150200.3.46.2

php7-embed: before 7.4.33-150200.3.46.2

php7-dom-debuginfo: before 7.4.33-150200.3.46.2

php7-dom: before 7.4.33-150200.3.46.2

php7-devel: before 7.4.33-150200.3.46.2

php7-debugsource: before 7.4.33-150200.3.46.2

php7-debuginfo: before 7.4.33-150200.3.46.2

php7-dba-debuginfo: before 7.4.33-150200.3.46.2

php7-dba: before 7.4.33-150200.3.46.2

php7-curl-debuginfo: before 7.4.33-150200.3.46.2

php7-curl: before 7.4.33-150200.3.46.2

php7-ctype-debuginfo: before 7.4.33-150200.3.46.2

php7-ctype: before 7.4.33-150200.3.46.2

php7-calendar-debuginfo: before 7.4.33-150200.3.46.2

php7-calendar: before 7.4.33-150200.3.46.2

php7-bz2-debuginfo: before 7.4.33-150200.3.46.2

php7-bz2: before 7.4.33-150200.3.46.2

php7-bcmath-debuginfo: before 7.4.33-150200.3.46.2

php7-bcmath: before 7.4.33-150200.3.46.2

php7: before 7.4.33-150200.3.46.2

apache2-mod_php7-debuginfo: before 7.4.33-150200.3.46.2

apache2-mod_php7: before 7.4.33-150200.3.46.2

php7-firebird-debuginfo: before 7.4.33-150200.3.46.2

php7-firebird: before 7.4.33-150200.3.46.2

CPE2.3

• cpe:2.3:o:suse:suse_enterprise_storage:7.1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_module_for_web_scripting:15-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_retail_branch_server:4.1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_retail_branch_server:4.2:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_server:4.1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_server:4.2:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_proxy:4.1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_proxy:4.2:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap:15-SP2:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server:15-SP2-LTSS:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing:15-SP2-LTSS:*:*:*:*:*:*:*
• cpe:2.3:o:suse:opensuse_leap:15.3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications:15-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_module_for_packagehub_subpackages:15-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:php7-zlib-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-zlib:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-zip-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-zip:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xsl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xsl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xmlwriter-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xmlwriter:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xmlrpc-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xmlrpc:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xmlreader-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xmlreader:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-tokenizer-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-tokenizer:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-tidy-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-tidy:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-test:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sysvshm-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sysvshm:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sysvsem-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sysvsem:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sysvmsg-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sysvmsg:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sqlite-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sqlite:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sodium-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sodium:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sockets-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sockets:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-soap-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-soap:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-snmp-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-snmp:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-shmop-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-shmop:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-readline-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-readline:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-posix-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-posix:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-phar-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-phar:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-pgsql-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-pgsql:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-pdo-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-pdo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-pcntl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-pcntl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-openssl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-openssl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-opcache-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-opcache:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-odbc-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-odbc:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-mysql-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-mysql:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-mbstring-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-mbstring:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-ldap-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-ldap:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-json-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-json:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-intl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-intl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-iconv-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-iconv:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-gmp-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-gmp:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-gettext-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-gettext:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-gd-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-gd:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-ftp-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-ftp:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-fpm-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-fpm:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-fileinfo-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-fileinfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-fastcgi-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-fastcgi:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-exif-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-exif:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-enchant-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-enchant:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-embed-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-embed:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-dom-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-dom:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-devel:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-debugsource:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-dba-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-dba:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-curl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-curl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-ctype-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-ctype:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-calendar-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-calendar:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-bz2-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-bz2:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-bcmath-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-bcmath:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:apache2-mod_php7-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:apache2-mod_php7:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-firebird-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-firebird:*:*:*:*:*:suse_linux:*:*

External links

https://www.suse.com/support/update/announcement/2022/suse-su-20224069-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Server-Side Request Forgery (SSRF)

EUVDB-ID: #VU54565

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2021-21705

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

Exploit availability: No

Description

The disclosed vulnerability allows a remote attacker to perform SSRF attacks.

The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can send a specially crafted HTTP request, bypass the FILTER_VALIDATE_URL and trick the application to initiate requests to arbitrary systems.

Successful exploitation of this vulnerability may allow a remote attacker gain access to sensitive data, located in the local network or send malicious requests to other servers from the vulnerable system.

Mitigation

Update the affected package php7 to the latest version.

Vulnerable software versions

SUSE Enterprise Storage: 7.1

SUSE Linux Enterprise Module for Web Scripting: 15-SP3

SUSE Manager Retail Branch Server: 4.1 - 4.2

SUSE Manager Server: 4.1 - 4.2

SUSE Manager Proxy: 4.1 - 4.2

SUSE Linux Enterprise Server for SAP: 15-SP2

SUSE Linux Enterprise Server: 15-SP2-LTSS - 15-SP3

SUSE Linux Enterprise High Performance Computing: 15-SP2-LTSS - 15-SP3

openSUSE Leap: 15.3 - 15.4

SUSE Linux Enterprise Server for SAP Applications: 15-SP3

SUSE Linux Enterprise Module for Packagehub Subpackages: 15-SP3

php7-zlib-debuginfo: before 7.4.33-150200.3.46.2

php7-zlib: before 7.4.33-150200.3.46.2

php7-zip-debuginfo: before 7.4.33-150200.3.46.2

php7-zip: before 7.4.33-150200.3.46.2

php7-xsl-debuginfo: before 7.4.33-150200.3.46.2

php7-xsl: before 7.4.33-150200.3.46.2

php7-xmlwriter-debuginfo: before 7.4.33-150200.3.46.2

php7-xmlwriter: before 7.4.33-150200.3.46.2

php7-xmlrpc-debuginfo: before 7.4.33-150200.3.46.2

php7-xmlrpc: before 7.4.33-150200.3.46.2

php7-xmlreader-debuginfo: before 7.4.33-150200.3.46.2

php7-xmlreader: before 7.4.33-150200.3.46.2

php7-tokenizer-debuginfo: before 7.4.33-150200.3.46.2

php7-tokenizer: before 7.4.33-150200.3.46.2

php7-tidy-debuginfo: before 7.4.33-150200.3.46.2

php7-tidy: before 7.4.33-150200.3.46.2

php7-test: before 7.4.33-150200.3.46.2

php7-sysvshm-debuginfo: before 7.4.33-150200.3.46.2

php7-sysvshm: before 7.4.33-150200.3.46.2

php7-sysvsem-debuginfo: before 7.4.33-150200.3.46.2

php7-sysvsem: before 7.4.33-150200.3.46.2

php7-sysvmsg-debuginfo: before 7.4.33-150200.3.46.2

php7-sysvmsg: before 7.4.33-150200.3.46.2

php7-sqlite-debuginfo: before 7.4.33-150200.3.46.2

php7-sqlite: before 7.4.33-150200.3.46.2

php7-sodium-debuginfo: before 7.4.33-150200.3.46.2

php7-sodium: before 7.4.33-150200.3.46.2

php7-sockets-debuginfo: before 7.4.33-150200.3.46.2

php7-sockets: before 7.4.33-150200.3.46.2

php7-soap-debuginfo: before 7.4.33-150200.3.46.2

php7-soap: before 7.4.33-150200.3.46.2

php7-snmp-debuginfo: before 7.4.33-150200.3.46.2

php7-snmp: before 7.4.33-150200.3.46.2

php7-shmop-debuginfo: before 7.4.33-150200.3.46.2

php7-shmop: before 7.4.33-150200.3.46.2

php7-readline-debuginfo: before 7.4.33-150200.3.46.2

php7-readline: before 7.4.33-150200.3.46.2

php7-posix-debuginfo: before 7.4.33-150200.3.46.2

php7-posix: before 7.4.33-150200.3.46.2

php7-phar-debuginfo: before 7.4.33-150200.3.46.2

php7-phar: before 7.4.33-150200.3.46.2

php7-pgsql-debuginfo: before 7.4.33-150200.3.46.2

php7-pgsql: before 7.4.33-150200.3.46.2

php7-pdo-debuginfo: before 7.4.33-150200.3.46.2

php7-pdo: before 7.4.33-150200.3.46.2

php7-pcntl-debuginfo: before 7.4.33-150200.3.46.2

php7-pcntl: before 7.4.33-150200.3.46.2

php7-openssl-debuginfo: before 7.4.33-150200.3.46.2

php7-openssl: before 7.4.33-150200.3.46.2

php7-opcache-debuginfo: before 7.4.33-150200.3.46.2

php7-opcache: before 7.4.33-150200.3.46.2

php7-odbc-debuginfo: before 7.4.33-150200.3.46.2

php7-odbc: before 7.4.33-150200.3.46.2

php7-mysql-debuginfo: before 7.4.33-150200.3.46.2

php7-mysql: before 7.4.33-150200.3.46.2

php7-mbstring-debuginfo: before 7.4.33-150200.3.46.2

php7-mbstring: before 7.4.33-150200.3.46.2

php7-ldap-debuginfo: before 7.4.33-150200.3.46.2

php7-ldap: before 7.4.33-150200.3.46.2

php7-json-debuginfo: before 7.4.33-150200.3.46.2

php7-json: before 7.4.33-150200.3.46.2

php7-intl-debuginfo: before 7.4.33-150200.3.46.2

php7-intl: before 7.4.33-150200.3.46.2

php7-iconv-debuginfo: before 7.4.33-150200.3.46.2

php7-iconv: before 7.4.33-150200.3.46.2

php7-gmp-debuginfo: before 7.4.33-150200.3.46.2

php7-gmp: before 7.4.33-150200.3.46.2

php7-gettext-debuginfo: before 7.4.33-150200.3.46.2

php7-gettext: before 7.4.33-150200.3.46.2

php7-gd-debuginfo: before 7.4.33-150200.3.46.2

php7-gd: before 7.4.33-150200.3.46.2

php7-ftp-debuginfo: before 7.4.33-150200.3.46.2

php7-ftp: before 7.4.33-150200.3.46.2

php7-fpm-debuginfo: before 7.4.33-150200.3.46.2

php7-fpm: before 7.4.33-150200.3.46.2

php7-fileinfo-debuginfo: before 7.4.33-150200.3.46.2

php7-fileinfo: before 7.4.33-150200.3.46.2

php7-fastcgi-debuginfo: before 7.4.33-150200.3.46.2

php7-fastcgi: before 7.4.33-150200.3.46.2

php7-exif-debuginfo: before 7.4.33-150200.3.46.2

php7-exif: before 7.4.33-150200.3.46.2

php7-enchant-debuginfo: before 7.4.33-150200.3.46.2

php7-enchant: before 7.4.33-150200.3.46.2

php7-embed-debuginfo: before 7.4.33-150200.3.46.2

php7-embed: before 7.4.33-150200.3.46.2

php7-dom-debuginfo: before 7.4.33-150200.3.46.2

php7-dom: before 7.4.33-150200.3.46.2

php7-devel: before 7.4.33-150200.3.46.2

php7-debugsource: before 7.4.33-150200.3.46.2

php7-debuginfo: before 7.4.33-150200.3.46.2

php7-dba-debuginfo: before 7.4.33-150200.3.46.2

php7-dba: before 7.4.33-150200.3.46.2

php7-curl-debuginfo: before 7.4.33-150200.3.46.2

php7-curl: before 7.4.33-150200.3.46.2

php7-ctype-debuginfo: before 7.4.33-150200.3.46.2

php7-ctype: before 7.4.33-150200.3.46.2

php7-calendar-debuginfo: before 7.4.33-150200.3.46.2

php7-calendar: before 7.4.33-150200.3.46.2

php7-bz2-debuginfo: before 7.4.33-150200.3.46.2

php7-bz2: before 7.4.33-150200.3.46.2

php7-bcmath-debuginfo: before 7.4.33-150200.3.46.2

php7-bcmath: before 7.4.33-150200.3.46.2

php7: before 7.4.33-150200.3.46.2

apache2-mod_php7-debuginfo: before 7.4.33-150200.3.46.2

apache2-mod_php7: before 7.4.33-150200.3.46.2

php7-firebird-debuginfo: before 7.4.33-150200.3.46.2

php7-firebird: before 7.4.33-150200.3.46.2

CPE2.3

• cpe:2.3:o:suse:suse_enterprise_storage:7.1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_module_for_web_scripting:15-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_retail_branch_server:4.1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_retail_branch_server:4.2:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_server:4.1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_server:4.2:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_proxy:4.1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_proxy:4.2:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap:15-SP2:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server:15-SP2-LTSS:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing:15-SP2-LTSS:*:*:*:*:*:*:*
• cpe:2.3:o:suse:opensuse_leap:15.3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications:15-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_module_for_packagehub_subpackages:15-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:php7-zlib-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-zlib:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-zip-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-zip:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xsl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xsl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xmlwriter-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xmlwriter:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xmlrpc-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xmlrpc:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xmlreader-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xmlreader:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-tokenizer-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-tokenizer:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-tidy-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-tidy:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-test:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sysvshm-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sysvshm:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sysvsem-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sysvsem:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sysvmsg-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sysvmsg:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sqlite-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sqlite:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sodium-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sodium:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sockets-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sockets:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-soap-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-soap:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-snmp-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-snmp:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-shmop-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-shmop:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-readline-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-readline:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-posix-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-posix:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-phar-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-phar:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-pgsql-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-pgsql:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-pdo-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-pdo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-pcntl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-pcntl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-openssl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-openssl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-opcache-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-opcache:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-odbc-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-odbc:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-mysql-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-mysql:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-mbstring-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-mbstring:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-ldap-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-ldap:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-json-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-json:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-intl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-intl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-iconv-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-iconv:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-gmp-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-gmp:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-gettext-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-gettext:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-gd-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-gd:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-ftp-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-ftp:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-fpm-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-fpm:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-fileinfo-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-fileinfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-fastcgi-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-fastcgi:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-exif-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-exif:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-enchant-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-enchant:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-embed-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-embed:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-dom-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-dom:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-devel:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-debugsource:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-dba-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-dba:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-curl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-curl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-ctype-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-ctype:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-calendar-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-calendar:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-bz2-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-bz2:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-bcmath-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-bcmath:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:apache2-mod_php7-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:apache2-mod_php7:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-firebird-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-firebird:*:*:*:*:*:suse_linux:*:*

External links

https://www.suse.com/support/update/announcement/2022/suse-su-20224069-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Absolute Path Traversal

EUVDB-ID: #VU56905

Risk: Medium

CVSSv4.0: 6.9 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2021-21706

CWE-ID: CWE-36 - Absolute Path Traversal

Exploit availability: No

Description

The vulnerability allows a remote attacker overwrite files on the system.

The vulnerability exists due to insufficient filtration of file names in the php_zip_make_relative_path() function on Windows systems. A remote attacker can construct a specially crafted ZIP archive, which once extracted by the ZipArchive::extractTo() function, can overwrite files outside of the destination directory.

Successful exploitation of the vulnerability may allow an attacker to overwrite arbitrary files on the system with privileges of the web server, but requires that the web application is running on Windows.

Mitigation

Update the affected package php7 to the latest version.

Vulnerable software versions

SUSE Enterprise Storage: 7.1

SUSE Linux Enterprise Module for Web Scripting: 15-SP3

SUSE Manager Retail Branch Server: 4.1 - 4.2

SUSE Manager Server: 4.1 - 4.2

SUSE Manager Proxy: 4.1 - 4.2

SUSE Linux Enterprise Server for SAP: 15-SP2

SUSE Linux Enterprise Server: 15-SP2-LTSS - 15-SP3

SUSE Linux Enterprise High Performance Computing: 15-SP2-LTSS - 15-SP3

openSUSE Leap: 15.3 - 15.4

SUSE Linux Enterprise Server for SAP Applications: 15-SP3

SUSE Linux Enterprise Module for Packagehub Subpackages: 15-SP3

php7-zlib-debuginfo: before 7.4.33-150200.3.46.2

php7-zlib: before 7.4.33-150200.3.46.2

php7-zip-debuginfo: before 7.4.33-150200.3.46.2

php7-zip: before 7.4.33-150200.3.46.2

php7-xsl-debuginfo: before 7.4.33-150200.3.46.2

php7-xsl: before 7.4.33-150200.3.46.2

php7-xmlwriter-debuginfo: before 7.4.33-150200.3.46.2

php7-xmlwriter: before 7.4.33-150200.3.46.2

php7-xmlrpc-debuginfo: before 7.4.33-150200.3.46.2

php7-xmlrpc: before 7.4.33-150200.3.46.2

php7-xmlreader-debuginfo: before 7.4.33-150200.3.46.2

php7-xmlreader: before 7.4.33-150200.3.46.2

php7-tokenizer-debuginfo: before 7.4.33-150200.3.46.2

php7-tokenizer: before 7.4.33-150200.3.46.2

php7-tidy-debuginfo: before 7.4.33-150200.3.46.2

php7-tidy: before 7.4.33-150200.3.46.2

php7-test: before 7.4.33-150200.3.46.2

php7-sysvshm-debuginfo: before 7.4.33-150200.3.46.2

php7-sysvshm: before 7.4.33-150200.3.46.2

php7-sysvsem-debuginfo: before 7.4.33-150200.3.46.2

php7-sysvsem: before 7.4.33-150200.3.46.2

php7-sysvmsg-debuginfo: before 7.4.33-150200.3.46.2

php7-sysvmsg: before 7.4.33-150200.3.46.2

php7-sqlite-debuginfo: before 7.4.33-150200.3.46.2

php7-sqlite: before 7.4.33-150200.3.46.2

php7-sodium-debuginfo: before 7.4.33-150200.3.46.2

php7-sodium: before 7.4.33-150200.3.46.2

php7-sockets-debuginfo: before 7.4.33-150200.3.46.2

php7-sockets: before 7.4.33-150200.3.46.2

php7-soap-debuginfo: before 7.4.33-150200.3.46.2

php7-soap: before 7.4.33-150200.3.46.2

php7-snmp-debuginfo: before 7.4.33-150200.3.46.2

php7-snmp: before 7.4.33-150200.3.46.2

php7-shmop-debuginfo: before 7.4.33-150200.3.46.2

php7-shmop: before 7.4.33-150200.3.46.2

php7-readline-debuginfo: before 7.4.33-150200.3.46.2

php7-readline: before 7.4.33-150200.3.46.2

php7-posix-debuginfo: before 7.4.33-150200.3.46.2

php7-posix: before 7.4.33-150200.3.46.2

php7-phar-debuginfo: before 7.4.33-150200.3.46.2

php7-phar: before 7.4.33-150200.3.46.2

php7-pgsql-debuginfo: before 7.4.33-150200.3.46.2

php7-pgsql: before 7.4.33-150200.3.46.2

php7-pdo-debuginfo: before 7.4.33-150200.3.46.2

php7-pdo: before 7.4.33-150200.3.46.2

php7-pcntl-debuginfo: before 7.4.33-150200.3.46.2

php7-pcntl: before 7.4.33-150200.3.46.2

php7-openssl-debuginfo: before 7.4.33-150200.3.46.2

php7-openssl: before 7.4.33-150200.3.46.2

php7-opcache-debuginfo: before 7.4.33-150200.3.46.2

php7-opcache: before 7.4.33-150200.3.46.2

php7-odbc-debuginfo: before 7.4.33-150200.3.46.2

php7-odbc: before 7.4.33-150200.3.46.2

php7-mysql-debuginfo: before 7.4.33-150200.3.46.2

php7-mysql: before 7.4.33-150200.3.46.2

php7-mbstring-debuginfo: before 7.4.33-150200.3.46.2

php7-mbstring: before 7.4.33-150200.3.46.2

php7-ldap-debuginfo: before 7.4.33-150200.3.46.2

php7-ldap: before 7.4.33-150200.3.46.2

php7-json-debuginfo: before 7.4.33-150200.3.46.2

php7-json: before 7.4.33-150200.3.46.2

php7-intl-debuginfo: before 7.4.33-150200.3.46.2

php7-intl: before 7.4.33-150200.3.46.2

php7-iconv-debuginfo: before 7.4.33-150200.3.46.2

php7-iconv: before 7.4.33-150200.3.46.2

php7-gmp-debuginfo: before 7.4.33-150200.3.46.2

php7-gmp: before 7.4.33-150200.3.46.2

php7-gettext-debuginfo: before 7.4.33-150200.3.46.2

php7-gettext: before 7.4.33-150200.3.46.2

php7-gd-debuginfo: before 7.4.33-150200.3.46.2

php7-gd: before 7.4.33-150200.3.46.2

php7-ftp-debuginfo: before 7.4.33-150200.3.46.2

php7-ftp: before 7.4.33-150200.3.46.2

php7-fpm-debuginfo: before 7.4.33-150200.3.46.2

php7-fpm: before 7.4.33-150200.3.46.2

php7-fileinfo-debuginfo: before 7.4.33-150200.3.46.2

php7-fileinfo: before 7.4.33-150200.3.46.2

php7-fastcgi-debuginfo: before 7.4.33-150200.3.46.2

php7-fastcgi: before 7.4.33-150200.3.46.2

php7-exif-debuginfo: before 7.4.33-150200.3.46.2

php7-exif: before 7.4.33-150200.3.46.2

php7-enchant-debuginfo: before 7.4.33-150200.3.46.2

php7-enchant: before 7.4.33-150200.3.46.2

php7-embed-debuginfo: before 7.4.33-150200.3.46.2

php7-embed: before 7.4.33-150200.3.46.2

php7-dom-debuginfo: before 7.4.33-150200.3.46.2

php7-dom: before 7.4.33-150200.3.46.2

php7-devel: before 7.4.33-150200.3.46.2

php7-debugsource: before 7.4.33-150200.3.46.2

php7-debuginfo: before 7.4.33-150200.3.46.2

php7-dba-debuginfo: before 7.4.33-150200.3.46.2

php7-dba: before 7.4.33-150200.3.46.2

php7-curl-debuginfo: before 7.4.33-150200.3.46.2

php7-curl: before 7.4.33-150200.3.46.2

php7-ctype-debuginfo: before 7.4.33-150200.3.46.2

php7-ctype: before 7.4.33-150200.3.46.2

php7-calendar-debuginfo: before 7.4.33-150200.3.46.2

php7-calendar: before 7.4.33-150200.3.46.2

php7-bz2-debuginfo: before 7.4.33-150200.3.46.2

php7-bz2: before 7.4.33-150200.3.46.2

php7-bcmath-debuginfo: before 7.4.33-150200.3.46.2

php7-bcmath: before 7.4.33-150200.3.46.2

php7: before 7.4.33-150200.3.46.2

apache2-mod_php7-debuginfo: before 7.4.33-150200.3.46.2

apache2-mod_php7: before 7.4.33-150200.3.46.2

php7-firebird-debuginfo: before 7.4.33-150200.3.46.2

php7-firebird: before 7.4.33-150200.3.46.2

CPE2.3

• cpe:2.3:o:suse:suse_enterprise_storage:7.1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_module_for_web_scripting:15-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_retail_branch_server:4.1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_retail_branch_server:4.2:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_server:4.1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_server:4.2:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_proxy:4.1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_proxy:4.2:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap:15-SP2:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server:15-SP2-LTSS:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing:15-SP2-LTSS:*:*:*:*:*:*:*
• cpe:2.3:o:suse:opensuse_leap:15.3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications:15-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_module_for_packagehub_subpackages:15-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:php7-zlib-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-zlib:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-zip-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-zip:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xsl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xsl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xmlwriter-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xmlwriter:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xmlrpc-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xmlrpc:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xmlreader-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xmlreader:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-tokenizer-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-tokenizer:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-tidy-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-tidy:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-test:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sysvshm-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sysvshm:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sysvsem-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sysvsem:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sysvmsg-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sysvmsg:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sqlite-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sqlite:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sodium-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sodium:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sockets-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sockets:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-soap-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-soap:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-snmp-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-snmp:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-shmop-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-shmop:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-readline-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-readline:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-posix-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-posix:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-phar-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-phar:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-pgsql-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-pgsql:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-pdo-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-pdo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-pcntl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-pcntl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-openssl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-openssl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-opcache-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-opcache:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-odbc-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-odbc:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-mysql-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-mysql:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-mbstring-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-mbstring:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-ldap-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-ldap:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-json-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-json:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-intl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-intl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-iconv-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-iconv:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-gmp-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-gmp:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-gettext-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-gettext:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-gd-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-gd:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-ftp-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-ftp:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-fpm-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-fpm:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-fileinfo-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-fileinfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-fastcgi-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-fastcgi:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-exif-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-exif:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-enchant-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-enchant:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-embed-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-embed:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-dom-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-dom:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-devel:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-debugsource:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-dba-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-dba:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-curl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-curl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-ctype-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-ctype:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-calendar-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-calendar:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-bz2-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-bz2:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-bcmath-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-bcmath:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:apache2-mod_php7-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:apache2-mod_php7:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-firebird-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-firebird:*:*:*:*:*:suse_linux:*:*

External links

https://www.suse.com/support/update/announcement/2022/suse-su-20224069-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

11) Input validation error

EUVDB-ID: #VU58331

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2021-21707

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to inject arbitrary XML code.

The vulnerability exists due to insufficient validation of user-supplied input within the simplexml_load_file() PHP function when processing NULL byte character (e.g. %00). A remote attacker can pass specially crafted URL to the application and bypass implemented security restrictions.

Mitigation

Update the affected package php7 to the latest version.

Vulnerable software versions

SUSE Enterprise Storage: 7.1

SUSE Linux Enterprise Module for Web Scripting: 15-SP3

SUSE Manager Retail Branch Server: 4.1 - 4.2

SUSE Manager Server: 4.1 - 4.2

SUSE Manager Proxy: 4.1 - 4.2

SUSE Linux Enterprise Server for SAP: 15-SP2

SUSE Linux Enterprise Server: 15-SP2-LTSS - 15-SP3

SUSE Linux Enterprise High Performance Computing: 15-SP2-LTSS - 15-SP3

openSUSE Leap: 15.3 - 15.4

SUSE Linux Enterprise Server for SAP Applications: 15-SP3

SUSE Linux Enterprise Module for Packagehub Subpackages: 15-SP3

php7-zlib-debuginfo: before 7.4.33-150200.3.46.2

php7-zlib: before 7.4.33-150200.3.46.2

php7-zip-debuginfo: before 7.4.33-150200.3.46.2

php7-zip: before 7.4.33-150200.3.46.2

php7-xsl-debuginfo: before 7.4.33-150200.3.46.2

php7-xsl: before 7.4.33-150200.3.46.2

php7-xmlwriter-debuginfo: before 7.4.33-150200.3.46.2

php7-xmlwriter: before 7.4.33-150200.3.46.2

php7-xmlrpc-debuginfo: before 7.4.33-150200.3.46.2

php7-xmlrpc: before 7.4.33-150200.3.46.2

php7-xmlreader-debuginfo: before 7.4.33-150200.3.46.2

php7-xmlreader: before 7.4.33-150200.3.46.2

php7-tokenizer-debuginfo: before 7.4.33-150200.3.46.2

php7-tokenizer: before 7.4.33-150200.3.46.2

php7-tidy-debuginfo: before 7.4.33-150200.3.46.2

php7-tidy: before 7.4.33-150200.3.46.2

php7-test: before 7.4.33-150200.3.46.2

php7-sysvshm-debuginfo: before 7.4.33-150200.3.46.2

php7-sysvshm: before 7.4.33-150200.3.46.2

php7-sysvsem-debuginfo: before 7.4.33-150200.3.46.2

php7-sysvsem: before 7.4.33-150200.3.46.2

php7-sysvmsg-debuginfo: before 7.4.33-150200.3.46.2

php7-sysvmsg: before 7.4.33-150200.3.46.2

php7-sqlite-debuginfo: before 7.4.33-150200.3.46.2

php7-sqlite: before 7.4.33-150200.3.46.2

php7-sodium-debuginfo: before 7.4.33-150200.3.46.2

php7-sodium: before 7.4.33-150200.3.46.2

php7-sockets-debuginfo: before 7.4.33-150200.3.46.2

php7-sockets: before 7.4.33-150200.3.46.2

php7-soap-debuginfo: before 7.4.33-150200.3.46.2

php7-soap: before 7.4.33-150200.3.46.2

php7-snmp-debuginfo: before 7.4.33-150200.3.46.2

php7-snmp: before 7.4.33-150200.3.46.2

php7-shmop-debuginfo: before 7.4.33-150200.3.46.2

php7-shmop: before 7.4.33-150200.3.46.2

php7-readline-debuginfo: before 7.4.33-150200.3.46.2

php7-readline: before 7.4.33-150200.3.46.2

php7-posix-debuginfo: before 7.4.33-150200.3.46.2

php7-posix: before 7.4.33-150200.3.46.2

php7-phar-debuginfo: before 7.4.33-150200.3.46.2

php7-phar: before 7.4.33-150200.3.46.2

php7-pgsql-debuginfo: before 7.4.33-150200.3.46.2

php7-pgsql: before 7.4.33-150200.3.46.2

php7-pdo-debuginfo: before 7.4.33-150200.3.46.2

php7-pdo: before 7.4.33-150200.3.46.2

php7-pcntl-debuginfo: before 7.4.33-150200.3.46.2

php7-pcntl: before 7.4.33-150200.3.46.2

php7-openssl-debuginfo: before 7.4.33-150200.3.46.2

php7-openssl: before 7.4.33-150200.3.46.2

php7-opcache-debuginfo: before 7.4.33-150200.3.46.2

php7-opcache: before 7.4.33-150200.3.46.2

php7-odbc-debuginfo: before 7.4.33-150200.3.46.2

php7-odbc: before 7.4.33-150200.3.46.2

php7-mysql-debuginfo: before 7.4.33-150200.3.46.2

php7-mysql: before 7.4.33-150200.3.46.2

php7-mbstring-debuginfo: before 7.4.33-150200.3.46.2

php7-mbstring: before 7.4.33-150200.3.46.2

php7-ldap-debuginfo: before 7.4.33-150200.3.46.2

php7-ldap: before 7.4.33-150200.3.46.2

php7-json-debuginfo: before 7.4.33-150200.3.46.2

php7-json: before 7.4.33-150200.3.46.2

php7-intl-debuginfo: before 7.4.33-150200.3.46.2

php7-intl: before 7.4.33-150200.3.46.2

php7-iconv-debuginfo: before 7.4.33-150200.3.46.2

php7-iconv: before 7.4.33-150200.3.46.2

php7-gmp-debuginfo: before 7.4.33-150200.3.46.2

php7-gmp: before 7.4.33-150200.3.46.2

php7-gettext-debuginfo: before 7.4.33-150200.3.46.2

php7-gettext: before 7.4.33-150200.3.46.2

php7-gd-debuginfo: before 7.4.33-150200.3.46.2

php7-gd: before 7.4.33-150200.3.46.2

php7-ftp-debuginfo: before 7.4.33-150200.3.46.2

php7-ftp: before 7.4.33-150200.3.46.2

php7-fpm-debuginfo: before 7.4.33-150200.3.46.2

php7-fpm: before 7.4.33-150200.3.46.2

php7-fileinfo-debuginfo: before 7.4.33-150200.3.46.2

php7-fileinfo: before 7.4.33-150200.3.46.2

php7-fastcgi-debuginfo: before 7.4.33-150200.3.46.2

php7-fastcgi: before 7.4.33-150200.3.46.2

php7-exif-debuginfo: before 7.4.33-150200.3.46.2

php7-exif: before 7.4.33-150200.3.46.2

php7-enchant-debuginfo: before 7.4.33-150200.3.46.2

php7-enchant: before 7.4.33-150200.3.46.2

php7-embed-debuginfo: before 7.4.33-150200.3.46.2

php7-embed: before 7.4.33-150200.3.46.2

php7-dom-debuginfo: before 7.4.33-150200.3.46.2

php7-dom: before 7.4.33-150200.3.46.2

php7-devel: before 7.4.33-150200.3.46.2

php7-debugsource: before 7.4.33-150200.3.46.2

php7-debuginfo: before 7.4.33-150200.3.46.2

php7-dba-debuginfo: before 7.4.33-150200.3.46.2

php7-dba: before 7.4.33-150200.3.46.2

php7-curl-debuginfo: before 7.4.33-150200.3.46.2

php7-curl: before 7.4.33-150200.3.46.2

php7-ctype-debuginfo: before 7.4.33-150200.3.46.2

php7-ctype: before 7.4.33-150200.3.46.2

php7-calendar-debuginfo: before 7.4.33-150200.3.46.2

php7-calendar: before 7.4.33-150200.3.46.2

php7-bz2-debuginfo: before 7.4.33-150200.3.46.2

php7-bz2: before 7.4.33-150200.3.46.2

php7-bcmath-debuginfo: before 7.4.33-150200.3.46.2

php7-bcmath: before 7.4.33-150200.3.46.2

php7: before 7.4.33-150200.3.46.2

apache2-mod_php7-debuginfo: before 7.4.33-150200.3.46.2

apache2-mod_php7: before 7.4.33-150200.3.46.2

php7-firebird-debuginfo: before 7.4.33-150200.3.46.2

php7-firebird: before 7.4.33-150200.3.46.2

CPE2.3

• cpe:2.3:o:suse:suse_enterprise_storage:7.1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_module_for_web_scripting:15-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_retail_branch_server:4.1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_retail_branch_server:4.2:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_server:4.1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_server:4.2:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_proxy:4.1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_proxy:4.2:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap:15-SP2:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server:15-SP2-LTSS:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing:15-SP2-LTSS:*:*:*:*:*:*:*
• cpe:2.3:o:suse:opensuse_leap:15.3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications:15-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_module_for_packagehub_subpackages:15-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:php7-zlib-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-zlib:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-zip-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-zip:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xsl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xsl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xmlwriter-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xmlwriter:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xmlrpc-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xmlrpc:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xmlreader-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xmlreader:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-tokenizer-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-tokenizer:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-tidy-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-tidy:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-test:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sysvshm-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sysvshm:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sysvsem-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sysvsem:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sysvmsg-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sysvmsg:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sqlite-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sqlite:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sodium-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sodium:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sockets-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sockets:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-soap-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-soap:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-snmp-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-snmp:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-shmop-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-shmop:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-readline-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-readline:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-posix-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-posix:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-phar-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-phar:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-pgsql-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-pgsql:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-pdo-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-pdo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-pcntl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-pcntl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-openssl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-openssl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-opcache-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-opcache:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-odbc-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-odbc:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-mysql-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-mysql:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-mbstring-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-mbstring:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-ldap-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-ldap:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-json-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-json:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-intl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-intl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-iconv-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-iconv:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-gmp-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-gmp:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-gettext-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-gettext:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-gd-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-gd:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-ftp-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-ftp:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-fpm-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-fpm:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-fileinfo-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-fileinfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-fastcgi-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-fastcgi:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-exif-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-exif:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-enchant-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-enchant:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-embed-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-embed:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-dom-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-dom:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-devel:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-debugsource:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-dba-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-dba:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-curl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-curl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-ctype-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-ctype:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-calendar-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-calendar:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-bz2-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-bz2:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-bcmath-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-bcmath:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:apache2-mod_php7-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:apache2-mod_php7:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-firebird-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-firebird:*:*:*:*:*:suse_linux:*:*

External links

https://www.suse.com/support/update/announcement/2022/suse-su-20224069-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

12) Use-after-free

EUVDB-ID: #VU60707

Risk: Medium

CVSSv4.0: 5.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/U:Green]

CVE-ID: CVE-2021-21708

CWE-ID: CWE-416 - Use After Free

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a use-after-free error within the "php_filter_float()" function. A remote attacker can pass specially crafted input to the application that uses the affected PHP function, trigger a use-after-free error and crash the php-fpm process.

Mitigation

Update the affected package php7 to the latest version.

Vulnerable software versions

SUSE Enterprise Storage: 7.1

SUSE Linux Enterprise Module for Web Scripting: 15-SP3

SUSE Manager Retail Branch Server: 4.1 - 4.2

SUSE Manager Server: 4.1 - 4.2

SUSE Manager Proxy: 4.1 - 4.2

SUSE Linux Enterprise Server for SAP: 15-SP2

SUSE Linux Enterprise Server: 15-SP2-LTSS - 15-SP3

SUSE Linux Enterprise High Performance Computing: 15-SP2-LTSS - 15-SP3

openSUSE Leap: 15.3 - 15.4

SUSE Linux Enterprise Server for SAP Applications: 15-SP3

SUSE Linux Enterprise Module for Packagehub Subpackages: 15-SP3

php7-zlib-debuginfo: before 7.4.33-150200.3.46.2

php7-zlib: before 7.4.33-150200.3.46.2

php7-zip-debuginfo: before 7.4.33-150200.3.46.2

php7-zip: before 7.4.33-150200.3.46.2

php7-xsl-debuginfo: before 7.4.33-150200.3.46.2

php7-xsl: before 7.4.33-150200.3.46.2

php7-xmlwriter-debuginfo: before 7.4.33-150200.3.46.2

php7-xmlwriter: before 7.4.33-150200.3.46.2

php7-xmlrpc-debuginfo: before 7.4.33-150200.3.46.2

php7-xmlrpc: before 7.4.33-150200.3.46.2

php7-xmlreader-debuginfo: before 7.4.33-150200.3.46.2

php7-xmlreader: before 7.4.33-150200.3.46.2

php7-tokenizer-debuginfo: before 7.4.33-150200.3.46.2

php7-tokenizer: before 7.4.33-150200.3.46.2

php7-tidy-debuginfo: before 7.4.33-150200.3.46.2

php7-tidy: before 7.4.33-150200.3.46.2

php7-test: before 7.4.33-150200.3.46.2

php7-sysvshm-debuginfo: before 7.4.33-150200.3.46.2

php7-sysvshm: before 7.4.33-150200.3.46.2

php7-sysvsem-debuginfo: before 7.4.33-150200.3.46.2

php7-sysvsem: before 7.4.33-150200.3.46.2

php7-sysvmsg-debuginfo: before 7.4.33-150200.3.46.2

php7-sysvmsg: before 7.4.33-150200.3.46.2

php7-sqlite-debuginfo: before 7.4.33-150200.3.46.2

php7-sqlite: before 7.4.33-150200.3.46.2

php7-sodium-debuginfo: before 7.4.33-150200.3.46.2

php7-sodium: before 7.4.33-150200.3.46.2

php7-sockets-debuginfo: before 7.4.33-150200.3.46.2

php7-sockets: before 7.4.33-150200.3.46.2

php7-soap-debuginfo: before 7.4.33-150200.3.46.2

php7-soap: before 7.4.33-150200.3.46.2

php7-snmp-debuginfo: before 7.4.33-150200.3.46.2

php7-snmp: before 7.4.33-150200.3.46.2

php7-shmop-debuginfo: before 7.4.33-150200.3.46.2

php7-shmop: before 7.4.33-150200.3.46.2

php7-readline-debuginfo: before 7.4.33-150200.3.46.2

php7-readline: before 7.4.33-150200.3.46.2

php7-posix-debuginfo: before 7.4.33-150200.3.46.2

php7-posix: before 7.4.33-150200.3.46.2

php7-phar-debuginfo: before 7.4.33-150200.3.46.2

php7-phar: before 7.4.33-150200.3.46.2

php7-pgsql-debuginfo: before 7.4.33-150200.3.46.2

php7-pgsql: before 7.4.33-150200.3.46.2

php7-pdo-debuginfo: before 7.4.33-150200.3.46.2

php7-pdo: before 7.4.33-150200.3.46.2

php7-pcntl-debuginfo: before 7.4.33-150200.3.46.2

php7-pcntl: before 7.4.33-150200.3.46.2

php7-openssl-debuginfo: before 7.4.33-150200.3.46.2

php7-openssl: before 7.4.33-150200.3.46.2

php7-opcache-debuginfo: before 7.4.33-150200.3.46.2

php7-opcache: before 7.4.33-150200.3.46.2

php7-odbc-debuginfo: before 7.4.33-150200.3.46.2

php7-odbc: before 7.4.33-150200.3.46.2

php7-mysql-debuginfo: before 7.4.33-150200.3.46.2

php7-mysql: before 7.4.33-150200.3.46.2

php7-mbstring-debuginfo: before 7.4.33-150200.3.46.2

php7-mbstring: before 7.4.33-150200.3.46.2

php7-ldap-debuginfo: before 7.4.33-150200.3.46.2

php7-ldap: before 7.4.33-150200.3.46.2

php7-json-debuginfo: before 7.4.33-150200.3.46.2

php7-json: before 7.4.33-150200.3.46.2

php7-intl-debuginfo: before 7.4.33-150200.3.46.2

php7-intl: before 7.4.33-150200.3.46.2

php7-iconv-debuginfo: before 7.4.33-150200.3.46.2

php7-iconv: before 7.4.33-150200.3.46.2

php7-gmp-debuginfo: before 7.4.33-150200.3.46.2

php7-gmp: before 7.4.33-150200.3.46.2

php7-gettext-debuginfo: before 7.4.33-150200.3.46.2

php7-gettext: before 7.4.33-150200.3.46.2

php7-gd-debuginfo: before 7.4.33-150200.3.46.2

php7-gd: before 7.4.33-150200.3.46.2

php7-ftp-debuginfo: before 7.4.33-150200.3.46.2

php7-ftp: before 7.4.33-150200.3.46.2

php7-fpm-debuginfo: before 7.4.33-150200.3.46.2

php7-fpm: before 7.4.33-150200.3.46.2

php7-fileinfo-debuginfo: before 7.4.33-150200.3.46.2

php7-fileinfo: before 7.4.33-150200.3.46.2

php7-fastcgi-debuginfo: before 7.4.33-150200.3.46.2

php7-fastcgi: before 7.4.33-150200.3.46.2

php7-exif-debuginfo: before 7.4.33-150200.3.46.2

php7-exif: before 7.4.33-150200.3.46.2

php7-enchant-debuginfo: before 7.4.33-150200.3.46.2

php7-enchant: before 7.4.33-150200.3.46.2

php7-embed-debuginfo: before 7.4.33-150200.3.46.2

php7-embed: before 7.4.33-150200.3.46.2

php7-dom-debuginfo: before 7.4.33-150200.3.46.2

php7-dom: before 7.4.33-150200.3.46.2

php7-devel: before 7.4.33-150200.3.46.2

php7-debugsource: before 7.4.33-150200.3.46.2

php7-debuginfo: before 7.4.33-150200.3.46.2

php7-dba-debuginfo: before 7.4.33-150200.3.46.2

php7-dba: before 7.4.33-150200.3.46.2

php7-curl-debuginfo: before 7.4.33-150200.3.46.2

php7-curl: before 7.4.33-150200.3.46.2

php7-ctype-debuginfo: before 7.4.33-150200.3.46.2

php7-ctype: before 7.4.33-150200.3.46.2

php7-calendar-debuginfo: before 7.4.33-150200.3.46.2

php7-calendar: before 7.4.33-150200.3.46.2

php7-bz2-debuginfo: before 7.4.33-150200.3.46.2

php7-bz2: before 7.4.33-150200.3.46.2

php7-bcmath-debuginfo: before 7.4.33-150200.3.46.2

php7-bcmath: before 7.4.33-150200.3.46.2

php7: before 7.4.33-150200.3.46.2

apache2-mod_php7-debuginfo: before 7.4.33-150200.3.46.2

apache2-mod_php7: before 7.4.33-150200.3.46.2

php7-firebird-debuginfo: before 7.4.33-150200.3.46.2

php7-firebird: before 7.4.33-150200.3.46.2

CPE2.3

• cpe:2.3:o:suse:suse_enterprise_storage:7.1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_module_for_web_scripting:15-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_retail_branch_server:4.1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_retail_branch_server:4.2:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_server:4.1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_server:4.2:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_proxy:4.1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_proxy:4.2:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap:15-SP2:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server:15-SP2-LTSS:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing:15-SP2-LTSS:*:*:*:*:*:*:*
• cpe:2.3:o:suse:opensuse_leap:15.3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications:15-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_module_for_packagehub_subpackages:15-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:php7-zlib-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-zlib:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-zip-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-zip:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xsl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xsl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xmlwriter-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xmlwriter:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xmlrpc-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xmlrpc:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xmlreader-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xmlreader:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-tokenizer-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-tokenizer:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-tidy-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-tidy:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-test:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sysvshm-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sysvshm:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sysvsem-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sysvsem:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sysvmsg-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sysvmsg:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sqlite-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sqlite:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sodium-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sodium:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sockets-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sockets:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-soap-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-soap:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-snmp-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-snmp:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-shmop-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-shmop:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-readline-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-readline:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-posix-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-posix:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-phar-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-phar:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-pgsql-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-pgsql:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-pdo-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-pdo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-pcntl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-pcntl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-openssl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-openssl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-opcache-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-opcache:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-odbc-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-odbc:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-mysql-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-mysql:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-mbstring-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-mbstring:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-ldap-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-ldap:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-json-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-json:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-intl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-intl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-iconv-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-iconv:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-gmp-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-gmp:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-gettext-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-gettext:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-gd-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-gd:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-ftp-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-ftp:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-fpm-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-fpm:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-fileinfo-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-fileinfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-fastcgi-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-fastcgi:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-exif-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-exif:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-enchant-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-enchant:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-embed-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-embed:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-dom-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-dom:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-devel:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-debugsource:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-dba-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-dba:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-curl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-curl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-ctype-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-ctype:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-calendar-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-calendar:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-bz2-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-bz2:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-bcmath-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-bcmath:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:apache2-mod_php7-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:apache2-mod_php7:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-firebird-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-firebird:*:*:*:*:*:suse_linux:*:*

External links

https://www.suse.com/support/update/announcement/2022/suse-su-20224069-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

13) Use of uninitialized resource

EUVDB-ID: #VU64232

Risk: High

CVSSv4.0: 7.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2022-31625

CWE-ID: CWE-908 - Use of Uninitialized Resource

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the system.

The vulnerability exists due to usage of uninitialized array in the pg_query_params() function. A remote attacker with ability to control query parameters can trigger memory corruption and execute arbitrary code on the system.

Mitigation

Update the affected package php7 to the latest version.

Vulnerable software versions

SUSE Enterprise Storage: 7.1

SUSE Linux Enterprise Module for Web Scripting: 15-SP3

SUSE Manager Retail Branch Server: 4.1 - 4.2

SUSE Manager Server: 4.1 - 4.2

SUSE Manager Proxy: 4.1 - 4.2

SUSE Linux Enterprise Server for SAP: 15-SP2

SUSE Linux Enterprise Server: 15-SP2-LTSS - 15-SP3

SUSE Linux Enterprise High Performance Computing: 15-SP2-LTSS - 15-SP3

openSUSE Leap: 15.3 - 15.4

SUSE Linux Enterprise Server for SAP Applications: 15-SP3

SUSE Linux Enterprise Module for Packagehub Subpackages: 15-SP3

php7-zlib-debuginfo: before 7.4.33-150200.3.46.2

php7-zlib: before 7.4.33-150200.3.46.2

php7-zip-debuginfo: before 7.4.33-150200.3.46.2

php7-zip: before 7.4.33-150200.3.46.2

php7-xsl-debuginfo: before 7.4.33-150200.3.46.2

php7-xsl: before 7.4.33-150200.3.46.2

php7-xmlwriter-debuginfo: before 7.4.33-150200.3.46.2

php7-xmlwriter: before 7.4.33-150200.3.46.2

php7-xmlrpc-debuginfo: before 7.4.33-150200.3.46.2

php7-xmlrpc: before 7.4.33-150200.3.46.2

php7-xmlreader-debuginfo: before 7.4.33-150200.3.46.2

php7-xmlreader: before 7.4.33-150200.3.46.2

php7-tokenizer-debuginfo: before 7.4.33-150200.3.46.2

php7-tokenizer: before 7.4.33-150200.3.46.2

php7-tidy-debuginfo: before 7.4.33-150200.3.46.2

php7-tidy: before 7.4.33-150200.3.46.2

php7-test: before 7.4.33-150200.3.46.2

php7-sysvshm-debuginfo: before 7.4.33-150200.3.46.2

php7-sysvshm: before 7.4.33-150200.3.46.2

php7-sysvsem-debuginfo: before 7.4.33-150200.3.46.2

php7-sysvsem: before 7.4.33-150200.3.46.2

php7-sysvmsg-debuginfo: before 7.4.33-150200.3.46.2

php7-sysvmsg: before 7.4.33-150200.3.46.2

php7-sqlite-debuginfo: before 7.4.33-150200.3.46.2

php7-sqlite: before 7.4.33-150200.3.46.2

php7-sodium-debuginfo: before 7.4.33-150200.3.46.2

php7-sodium: before 7.4.33-150200.3.46.2

php7-sockets-debuginfo: before 7.4.33-150200.3.46.2

php7-sockets: before 7.4.33-150200.3.46.2

php7-soap-debuginfo: before 7.4.33-150200.3.46.2

php7-soap: before 7.4.33-150200.3.46.2

php7-snmp-debuginfo: before 7.4.33-150200.3.46.2

php7-snmp: before 7.4.33-150200.3.46.2

php7-shmop-debuginfo: before 7.4.33-150200.3.46.2

php7-shmop: before 7.4.33-150200.3.46.2

php7-readline-debuginfo: before 7.4.33-150200.3.46.2

php7-readline: before 7.4.33-150200.3.46.2

php7-posix-debuginfo: before 7.4.33-150200.3.46.2

php7-posix: before 7.4.33-150200.3.46.2

php7-phar-debuginfo: before 7.4.33-150200.3.46.2

php7-phar: before 7.4.33-150200.3.46.2

php7-pgsql-debuginfo: before 7.4.33-150200.3.46.2

php7-pgsql: before 7.4.33-150200.3.46.2

php7-pdo-debuginfo: before 7.4.33-150200.3.46.2

php7-pdo: before 7.4.33-150200.3.46.2

php7-pcntl-debuginfo: before 7.4.33-150200.3.46.2

php7-pcntl: before 7.4.33-150200.3.46.2

php7-openssl-debuginfo: before 7.4.33-150200.3.46.2

php7-openssl: before 7.4.33-150200.3.46.2

php7-opcache-debuginfo: before 7.4.33-150200.3.46.2

php7-opcache: before 7.4.33-150200.3.46.2

php7-odbc-debuginfo: before 7.4.33-150200.3.46.2

php7-odbc: before 7.4.33-150200.3.46.2

php7-mysql-debuginfo: before 7.4.33-150200.3.46.2

php7-mysql: before 7.4.33-150200.3.46.2

php7-mbstring-debuginfo: before 7.4.33-150200.3.46.2

php7-mbstring: before 7.4.33-150200.3.46.2

php7-ldap-debuginfo: before 7.4.33-150200.3.46.2

php7-ldap: before 7.4.33-150200.3.46.2

php7-json-debuginfo: before 7.4.33-150200.3.46.2

php7-json: before 7.4.33-150200.3.46.2

php7-intl-debuginfo: before 7.4.33-150200.3.46.2

php7-intl: before 7.4.33-150200.3.46.2

php7-iconv-debuginfo: before 7.4.33-150200.3.46.2

php7-iconv: before 7.4.33-150200.3.46.2

php7-gmp-debuginfo: before 7.4.33-150200.3.46.2

php7-gmp: before 7.4.33-150200.3.46.2

php7-gettext-debuginfo: before 7.4.33-150200.3.46.2

php7-gettext: before 7.4.33-150200.3.46.2

php7-gd-debuginfo: before 7.4.33-150200.3.46.2

php7-gd: before 7.4.33-150200.3.46.2

php7-ftp-debuginfo: before 7.4.33-150200.3.46.2

php7-ftp: before 7.4.33-150200.3.46.2

php7-fpm-debuginfo: before 7.4.33-150200.3.46.2

php7-fpm: before 7.4.33-150200.3.46.2

php7-fileinfo-debuginfo: before 7.4.33-150200.3.46.2

php7-fileinfo: before 7.4.33-150200.3.46.2

php7-fastcgi-debuginfo: before 7.4.33-150200.3.46.2

php7-fastcgi: before 7.4.33-150200.3.46.2

php7-exif-debuginfo: before 7.4.33-150200.3.46.2

php7-exif: before 7.4.33-150200.3.46.2

php7-enchant-debuginfo: before 7.4.33-150200.3.46.2

php7-enchant: before 7.4.33-150200.3.46.2

php7-embed-debuginfo: before 7.4.33-150200.3.46.2

php7-embed: before 7.4.33-150200.3.46.2

php7-dom-debuginfo: before 7.4.33-150200.3.46.2

php7-dom: before 7.4.33-150200.3.46.2

php7-devel: before 7.4.33-150200.3.46.2

php7-debugsource: before 7.4.33-150200.3.46.2

php7-debuginfo: before 7.4.33-150200.3.46.2

php7-dba-debuginfo: before 7.4.33-150200.3.46.2

php7-dba: before 7.4.33-150200.3.46.2

php7-curl-debuginfo: before 7.4.33-150200.3.46.2

php7-curl: before 7.4.33-150200.3.46.2

php7-ctype-debuginfo: before 7.4.33-150200.3.46.2

php7-ctype: before 7.4.33-150200.3.46.2

php7-calendar-debuginfo: before 7.4.33-150200.3.46.2

php7-calendar: before 7.4.33-150200.3.46.2

php7-bz2-debuginfo: before 7.4.33-150200.3.46.2

php7-bz2: before 7.4.33-150200.3.46.2

php7-bcmath-debuginfo: before 7.4.33-150200.3.46.2

php7-bcmath: before 7.4.33-150200.3.46.2

php7: before 7.4.33-150200.3.46.2

apache2-mod_php7-debuginfo: before 7.4.33-150200.3.46.2

apache2-mod_php7: before 7.4.33-150200.3.46.2

php7-firebird-debuginfo: before 7.4.33-150200.3.46.2

php7-firebird: before 7.4.33-150200.3.46.2

CPE2.3

• cpe:2.3:o:suse:suse_enterprise_storage:7.1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_module_for_web_scripting:15-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_retail_branch_server:4.1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_retail_branch_server:4.2:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_server:4.1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_server:4.2:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_proxy:4.1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_proxy:4.2:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap:15-SP2:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server:15-SP2-LTSS:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing:15-SP2-LTSS:*:*:*:*:*:*:*
• cpe:2.3:o:suse:opensuse_leap:15.3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications:15-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_module_for_packagehub_subpackages:15-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:php7-zlib-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-zlib:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-zip-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-zip:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xsl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xsl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xmlwriter-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xmlwriter:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xmlrpc-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xmlrpc:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xmlreader-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xmlreader:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-tokenizer-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-tokenizer:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-tidy-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-tidy:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-test:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sysvshm-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sysvshm:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sysvsem-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sysvsem:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sysvmsg-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sysvmsg:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sqlite-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sqlite:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sodium-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sodium:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sockets-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sockets:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-soap-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-soap:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-snmp-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-snmp:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-shmop-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-shmop:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-readline-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-readline:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-posix-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-posix:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-phar-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-phar:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-pgsql-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-pgsql:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-pdo-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-pdo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-pcntl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-pcntl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-openssl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-openssl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-opcache-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-opcache:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-odbc-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-odbc:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-mysql-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-mysql:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-mbstring-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-mbstring:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-ldap-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-ldap:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-json-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-json:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-intl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-intl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-iconv-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-iconv:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-gmp-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-gmp:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-gettext-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-gettext:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-gd-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-gd:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-ftp-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-ftp:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-fpm-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-fpm:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-fileinfo-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-fileinfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-fastcgi-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-fastcgi:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-exif-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-exif:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-enchant-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-enchant:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-embed-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-embed:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-dom-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-dom:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-devel:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-debugsource:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-dba-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-dba:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-curl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-curl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-ctype-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-ctype:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-calendar-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-calendar:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-bz2-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-bz2:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-bcmath-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-bcmath:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:apache2-mod_php7-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:apache2-mod_php7:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-firebird-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-firebird:*:*:*:*:*:suse_linux:*:*

External links

https://www.suse.com/support/update/announcement/2022/suse-su-20224069-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

14) Buffer overflow

EUVDB-ID: #VU64231

Risk: High

CVSSv4.0: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Amber]

CVE-ID: CVE-2022-31626

CWE-ID: CWE-119 - Memory corruption

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing password in mysqlnd/pdo in mysqlnd_wireprotocol.c. A remote attacker with ability to control password that is passed via PDO to MySQL server can trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update the affected package php7 to the latest version.

Vulnerable software versions

SUSE Enterprise Storage: 7.1

SUSE Linux Enterprise Module for Web Scripting: 15-SP3

SUSE Manager Retail Branch Server: 4.1 - 4.2

SUSE Manager Server: 4.1 - 4.2

SUSE Manager Proxy: 4.1 - 4.2

SUSE Linux Enterprise Server for SAP: 15-SP2

SUSE Linux Enterprise Server: 15-SP2-LTSS - 15-SP3

SUSE Linux Enterprise High Performance Computing: 15-SP2-LTSS - 15-SP3

openSUSE Leap: 15.3 - 15.4

SUSE Linux Enterprise Server for SAP Applications: 15-SP3

SUSE Linux Enterprise Module for Packagehub Subpackages: 15-SP3

php7-zlib-debuginfo: before 7.4.33-150200.3.46.2

php7-zlib: before 7.4.33-150200.3.46.2

php7-zip-debuginfo: before 7.4.33-150200.3.46.2

php7-zip: before 7.4.33-150200.3.46.2

php7-xsl-debuginfo: before 7.4.33-150200.3.46.2

php7-xsl: before 7.4.33-150200.3.46.2

php7-xmlwriter-debuginfo: before 7.4.33-150200.3.46.2

php7-xmlwriter: before 7.4.33-150200.3.46.2

php7-xmlrpc-debuginfo: before 7.4.33-150200.3.46.2

php7-xmlrpc: before 7.4.33-150200.3.46.2

php7-xmlreader-debuginfo: before 7.4.33-150200.3.46.2

php7-xmlreader: before 7.4.33-150200.3.46.2

php7-tokenizer-debuginfo: before 7.4.33-150200.3.46.2

php7-tokenizer: before 7.4.33-150200.3.46.2

php7-tidy-debuginfo: before 7.4.33-150200.3.46.2

php7-tidy: before 7.4.33-150200.3.46.2

php7-test: before 7.4.33-150200.3.46.2

php7-sysvshm-debuginfo: before 7.4.33-150200.3.46.2

php7-sysvshm: before 7.4.33-150200.3.46.2

php7-sysvsem-debuginfo: before 7.4.33-150200.3.46.2

php7-sysvsem: before 7.4.33-150200.3.46.2

php7-sysvmsg-debuginfo: before 7.4.33-150200.3.46.2

php7-sysvmsg: before 7.4.33-150200.3.46.2

php7-sqlite-debuginfo: before 7.4.33-150200.3.46.2

php7-sqlite: before 7.4.33-150200.3.46.2

php7-sodium-debuginfo: before 7.4.33-150200.3.46.2

php7-sodium: before 7.4.33-150200.3.46.2

php7-sockets-debuginfo: before 7.4.33-150200.3.46.2

php7-sockets: before 7.4.33-150200.3.46.2

php7-soap-debuginfo: before 7.4.33-150200.3.46.2

php7-soap: before 7.4.33-150200.3.46.2

php7-snmp-debuginfo: before 7.4.33-150200.3.46.2

php7-snmp: before 7.4.33-150200.3.46.2

php7-shmop-debuginfo: before 7.4.33-150200.3.46.2

php7-shmop: before 7.4.33-150200.3.46.2

php7-readline-debuginfo: before 7.4.33-150200.3.46.2

php7-readline: before 7.4.33-150200.3.46.2

php7-posix-debuginfo: before 7.4.33-150200.3.46.2

php7-posix: before 7.4.33-150200.3.46.2

php7-phar-debuginfo: before 7.4.33-150200.3.46.2

php7-phar: before 7.4.33-150200.3.46.2

php7-pgsql-debuginfo: before 7.4.33-150200.3.46.2

php7-pgsql: before 7.4.33-150200.3.46.2

php7-pdo-debuginfo: before 7.4.33-150200.3.46.2

php7-pdo: before 7.4.33-150200.3.46.2

php7-pcntl-debuginfo: before 7.4.33-150200.3.46.2

php7-pcntl: before 7.4.33-150200.3.46.2

php7-openssl-debuginfo: before 7.4.33-150200.3.46.2

php7-openssl: before 7.4.33-150200.3.46.2

php7-opcache-debuginfo: before 7.4.33-150200.3.46.2

php7-opcache: before 7.4.33-150200.3.46.2

php7-odbc-debuginfo: before 7.4.33-150200.3.46.2

php7-odbc: before 7.4.33-150200.3.46.2

php7-mysql-debuginfo: before 7.4.33-150200.3.46.2

php7-mysql: before 7.4.33-150200.3.46.2

php7-mbstring-debuginfo: before 7.4.33-150200.3.46.2

php7-mbstring: before 7.4.33-150200.3.46.2

php7-ldap-debuginfo: before 7.4.33-150200.3.46.2

php7-ldap: before 7.4.33-150200.3.46.2

php7-json-debuginfo: before 7.4.33-150200.3.46.2

php7-json: before 7.4.33-150200.3.46.2

php7-intl-debuginfo: before 7.4.33-150200.3.46.2

php7-intl: before 7.4.33-150200.3.46.2

php7-iconv-debuginfo: before 7.4.33-150200.3.46.2

php7-iconv: before 7.4.33-150200.3.46.2

php7-gmp-debuginfo: before 7.4.33-150200.3.46.2

php7-gmp: before 7.4.33-150200.3.46.2

php7-gettext-debuginfo: before 7.4.33-150200.3.46.2

php7-gettext: before 7.4.33-150200.3.46.2

php7-gd-debuginfo: before 7.4.33-150200.3.46.2

php7-gd: before 7.4.33-150200.3.46.2

php7-ftp-debuginfo: before 7.4.33-150200.3.46.2

php7-ftp: before 7.4.33-150200.3.46.2

php7-fpm-debuginfo: before 7.4.33-150200.3.46.2

php7-fpm: before 7.4.33-150200.3.46.2

php7-fileinfo-debuginfo: before 7.4.33-150200.3.46.2

php7-fileinfo: before 7.4.33-150200.3.46.2

php7-fastcgi-debuginfo: before 7.4.33-150200.3.46.2

php7-fastcgi: before 7.4.33-150200.3.46.2

php7-exif-debuginfo: before 7.4.33-150200.3.46.2

php7-exif: before 7.4.33-150200.3.46.2

php7-enchant-debuginfo: before 7.4.33-150200.3.46.2

php7-enchant: before 7.4.33-150200.3.46.2

php7-embed-debuginfo: before 7.4.33-150200.3.46.2

php7-embed: before 7.4.33-150200.3.46.2

php7-dom-debuginfo: before 7.4.33-150200.3.46.2

php7-dom: before 7.4.33-150200.3.46.2

php7-devel: before 7.4.33-150200.3.46.2

php7-debugsource: before 7.4.33-150200.3.46.2

php7-debuginfo: before 7.4.33-150200.3.46.2

php7-dba-debuginfo: before 7.4.33-150200.3.46.2

php7-dba: before 7.4.33-150200.3.46.2

php7-curl-debuginfo: before 7.4.33-150200.3.46.2

php7-curl: before 7.4.33-150200.3.46.2

php7-ctype-debuginfo: before 7.4.33-150200.3.46.2

php7-ctype: before 7.4.33-150200.3.46.2

php7-calendar-debuginfo: before 7.4.33-150200.3.46.2

php7-calendar: before 7.4.33-150200.3.46.2

php7-bz2-debuginfo: before 7.4.33-150200.3.46.2

php7-bz2: before 7.4.33-150200.3.46.2

php7-bcmath-debuginfo: before 7.4.33-150200.3.46.2

php7-bcmath: before 7.4.33-150200.3.46.2

php7: before 7.4.33-150200.3.46.2

apache2-mod_php7-debuginfo: before 7.4.33-150200.3.46.2

apache2-mod_php7: before 7.4.33-150200.3.46.2

php7-firebird-debuginfo: before 7.4.33-150200.3.46.2

php7-firebird: before 7.4.33-150200.3.46.2

CPE2.3

• cpe:2.3:o:suse:suse_enterprise_storage:7.1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_module_for_web_scripting:15-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_retail_branch_server:4.1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_retail_branch_server:4.2:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_server:4.1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_server:4.2:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_proxy:4.1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_proxy:4.2:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap:15-SP2:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server:15-SP2-LTSS:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing:15-SP2-LTSS:*:*:*:*:*:*:*
• cpe:2.3:o:suse:opensuse_leap:15.3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications:15-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_module_for_packagehub_subpackages:15-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:php7-zlib-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-zlib:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-zip-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-zip:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xsl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xsl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xmlwriter-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xmlwriter:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xmlrpc-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xmlrpc:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xmlreader-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xmlreader:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-tokenizer-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-tokenizer:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-tidy-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-tidy:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-test:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sysvshm-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sysvshm:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sysvsem-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sysvsem:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sysvmsg-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sysvmsg:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sqlite-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sqlite:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sodium-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sodium:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sockets-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sockets:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-soap-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-soap:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-snmp-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-snmp:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-shmop-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-shmop:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-readline-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-readline:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-posix-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-posix:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-phar-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-phar:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-pgsql-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-pgsql:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-pdo-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-pdo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-pcntl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-pcntl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-openssl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-openssl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-opcache-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-opcache:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-odbc-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-odbc:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-mysql-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-mysql:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-mbstring-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-mbstring:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-ldap-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-ldap:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-json-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-json:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-intl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-intl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-iconv-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-iconv:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-gmp-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-gmp:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-gettext-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-gettext:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-gd-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-gd:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-ftp-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-ftp:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-fpm-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-fpm:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-fileinfo-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-fileinfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-fastcgi-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-fastcgi:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-exif-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-exif:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-enchant-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-enchant:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-embed-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-embed:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-dom-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-dom:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-devel:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-debugsource:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-dba-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-dba:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-curl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-curl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-ctype-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-ctype:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-calendar-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-calendar:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-bz2-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-bz2:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-bcmath-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-bcmath:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:apache2-mod_php7-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:apache2-mod_php7:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-firebird-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-firebird:*:*:*:*:*:suse_linux:*:*

External links

https://www.suse.com/support/update/announcement/2022/suse-su-20224069-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

15) Infinite loop

EUVDB-ID: #VU67755

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2022-31628

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop within the phar uncompressor code when processing "quines" gzip files. A remote attacker can pass a specially crafted archive to the application, consume all available system resources and cause denial of service conditions.

Mitigation

Update the affected package php7 to the latest version.

Vulnerable software versions

SUSE Enterprise Storage: 7.1

SUSE Linux Enterprise Module for Web Scripting: 15-SP3

SUSE Manager Retail Branch Server: 4.1 - 4.2

SUSE Manager Server: 4.1 - 4.2

SUSE Manager Proxy: 4.1 - 4.2

SUSE Linux Enterprise Server for SAP: 15-SP2

SUSE Linux Enterprise Server: 15-SP2-LTSS - 15-SP3

SUSE Linux Enterprise High Performance Computing: 15-SP2-LTSS - 15-SP3

openSUSE Leap: 15.3 - 15.4

SUSE Linux Enterprise Server for SAP Applications: 15-SP3

SUSE Linux Enterprise Module for Packagehub Subpackages: 15-SP3

php7-zlib-debuginfo: before 7.4.33-150200.3.46.2

php7-zlib: before 7.4.33-150200.3.46.2

php7-zip-debuginfo: before 7.4.33-150200.3.46.2

php7-zip: before 7.4.33-150200.3.46.2

php7-xsl-debuginfo: before 7.4.33-150200.3.46.2

php7-xsl: before 7.4.33-150200.3.46.2

php7-xmlwriter-debuginfo: before 7.4.33-150200.3.46.2

php7-xmlwriter: before 7.4.33-150200.3.46.2

php7-xmlrpc-debuginfo: before 7.4.33-150200.3.46.2

php7-xmlrpc: before 7.4.33-150200.3.46.2

php7-xmlreader-debuginfo: before 7.4.33-150200.3.46.2

php7-xmlreader: before 7.4.33-150200.3.46.2

php7-tokenizer-debuginfo: before 7.4.33-150200.3.46.2

php7-tokenizer: before 7.4.33-150200.3.46.2

php7-tidy-debuginfo: before 7.4.33-150200.3.46.2

php7-tidy: before 7.4.33-150200.3.46.2

php7-test: before 7.4.33-150200.3.46.2

php7-sysvshm-debuginfo: before 7.4.33-150200.3.46.2

php7-sysvshm: before 7.4.33-150200.3.46.2

php7-sysvsem-debuginfo: before 7.4.33-150200.3.46.2

php7-sysvsem: before 7.4.33-150200.3.46.2

php7-sysvmsg-debuginfo: before 7.4.33-150200.3.46.2

php7-sysvmsg: before 7.4.33-150200.3.46.2

php7-sqlite-debuginfo: before 7.4.33-150200.3.46.2

php7-sqlite: before 7.4.33-150200.3.46.2

php7-sodium-debuginfo: before 7.4.33-150200.3.46.2

php7-sodium: before 7.4.33-150200.3.46.2

php7-sockets-debuginfo: before 7.4.33-150200.3.46.2

php7-sockets: before 7.4.33-150200.3.46.2

php7-soap-debuginfo: before 7.4.33-150200.3.46.2

php7-soap: before 7.4.33-150200.3.46.2

php7-snmp-debuginfo: before 7.4.33-150200.3.46.2

php7-snmp: before 7.4.33-150200.3.46.2

php7-shmop-debuginfo: before 7.4.33-150200.3.46.2

php7-shmop: before 7.4.33-150200.3.46.2

php7-readline-debuginfo: before 7.4.33-150200.3.46.2

php7-readline: before 7.4.33-150200.3.46.2

php7-posix-debuginfo: before 7.4.33-150200.3.46.2

php7-posix: before 7.4.33-150200.3.46.2

php7-phar-debuginfo: before 7.4.33-150200.3.46.2

php7-phar: before 7.4.33-150200.3.46.2

php7-pgsql-debuginfo: before 7.4.33-150200.3.46.2

php7-pgsql: before 7.4.33-150200.3.46.2

php7-pdo-debuginfo: before 7.4.33-150200.3.46.2

php7-pdo: before 7.4.33-150200.3.46.2

php7-pcntl-debuginfo: before 7.4.33-150200.3.46.2

php7-pcntl: before 7.4.33-150200.3.46.2

php7-openssl-debuginfo: before 7.4.33-150200.3.46.2

php7-openssl: before 7.4.33-150200.3.46.2

php7-opcache-debuginfo: before 7.4.33-150200.3.46.2

php7-opcache: before 7.4.33-150200.3.46.2

php7-odbc-debuginfo: before 7.4.33-150200.3.46.2

php7-odbc: before 7.4.33-150200.3.46.2

php7-mysql-debuginfo: before 7.4.33-150200.3.46.2

php7-mysql: before 7.4.33-150200.3.46.2

php7-mbstring-debuginfo: before 7.4.33-150200.3.46.2

php7-mbstring: before 7.4.33-150200.3.46.2

php7-ldap-debuginfo: before 7.4.33-150200.3.46.2

php7-ldap: before 7.4.33-150200.3.46.2

php7-json-debuginfo: before 7.4.33-150200.3.46.2

php7-json: before 7.4.33-150200.3.46.2

php7-intl-debuginfo: before 7.4.33-150200.3.46.2

php7-intl: before 7.4.33-150200.3.46.2

php7-iconv-debuginfo: before 7.4.33-150200.3.46.2

php7-iconv: before 7.4.33-150200.3.46.2

php7-gmp-debuginfo: before 7.4.33-150200.3.46.2

php7-gmp: before 7.4.33-150200.3.46.2

php7-gettext-debuginfo: before 7.4.33-150200.3.46.2

php7-gettext: before 7.4.33-150200.3.46.2

php7-gd-debuginfo: before 7.4.33-150200.3.46.2

php7-gd: before 7.4.33-150200.3.46.2

php7-ftp-debuginfo: before 7.4.33-150200.3.46.2

php7-ftp: before 7.4.33-150200.3.46.2

php7-fpm-debuginfo: before 7.4.33-150200.3.46.2

php7-fpm: before 7.4.33-150200.3.46.2

php7-fileinfo-debuginfo: before 7.4.33-150200.3.46.2

php7-fileinfo: before 7.4.33-150200.3.46.2

php7-fastcgi-debuginfo: before 7.4.33-150200.3.46.2

php7-fastcgi: before 7.4.33-150200.3.46.2

php7-exif-debuginfo: before 7.4.33-150200.3.46.2

php7-exif: before 7.4.33-150200.3.46.2

php7-enchant-debuginfo: before 7.4.33-150200.3.46.2

php7-enchant: before 7.4.33-150200.3.46.2

php7-embed-debuginfo: before 7.4.33-150200.3.46.2

php7-embed: before 7.4.33-150200.3.46.2

php7-dom-debuginfo: before 7.4.33-150200.3.46.2

php7-dom: before 7.4.33-150200.3.46.2

php7-devel: before 7.4.33-150200.3.46.2

php7-debugsource: before 7.4.33-150200.3.46.2

php7-debuginfo: before 7.4.33-150200.3.46.2

php7-dba-debuginfo: before 7.4.33-150200.3.46.2

php7-dba: before 7.4.33-150200.3.46.2

php7-curl-debuginfo: before 7.4.33-150200.3.46.2

php7-curl: before 7.4.33-150200.3.46.2

php7-ctype-debuginfo: before 7.4.33-150200.3.46.2

php7-ctype: before 7.4.33-150200.3.46.2

php7-calendar-debuginfo: before 7.4.33-150200.3.46.2

php7-calendar: before 7.4.33-150200.3.46.2

php7-bz2-debuginfo: before 7.4.33-150200.3.46.2

php7-bz2: before 7.4.33-150200.3.46.2

php7-bcmath-debuginfo: before 7.4.33-150200.3.46.2

php7-bcmath: before 7.4.33-150200.3.46.2

php7: before 7.4.33-150200.3.46.2

apache2-mod_php7-debuginfo: before 7.4.33-150200.3.46.2

apache2-mod_php7: before 7.4.33-150200.3.46.2

php7-firebird-debuginfo: before 7.4.33-150200.3.46.2

php7-firebird: before 7.4.33-150200.3.46.2

CPE2.3

• cpe:2.3:o:suse:suse_enterprise_storage:7.1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_module_for_web_scripting:15-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_retail_branch_server:4.1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_retail_branch_server:4.2:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_server:4.1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_server:4.2:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_proxy:4.1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_proxy:4.2:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap:15-SP2:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server:15-SP2-LTSS:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing:15-SP2-LTSS:*:*:*:*:*:*:*
• cpe:2.3:o:suse:opensuse_leap:15.3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications:15-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_module_for_packagehub_subpackages:15-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:php7-zlib-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-zlib:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-zip-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-zip:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xsl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xsl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xmlwriter-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xmlwriter:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xmlrpc-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xmlrpc:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xmlreader-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xmlreader:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-tokenizer-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-tokenizer:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-tidy-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-tidy:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-test:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sysvshm-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sysvshm:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sysvsem-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sysvsem:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sysvmsg-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sysvmsg:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sqlite-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sqlite:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sodium-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sodium:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sockets-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sockets:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-soap-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-soap:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-snmp-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-snmp:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-shmop-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-shmop:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-readline-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-readline:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-posix-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-posix:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-phar-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-phar:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-pgsql-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-pgsql:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-pdo-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-pdo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-pcntl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-pcntl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-openssl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-openssl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-opcache-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-opcache:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-odbc-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-odbc:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-mysql-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-mysql:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-mbstring-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-mbstring:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-ldap-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-ldap:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-json-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-json:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-intl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-intl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-iconv-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-iconv:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-gmp-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-gmp:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-gettext-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-gettext:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-gd-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-gd:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-ftp-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-ftp:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-fpm-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-fpm:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-fileinfo-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-fileinfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-fastcgi-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-fastcgi:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-exif-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-exif:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-enchant-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-enchant:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-embed-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-embed:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-dom-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-dom:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-devel:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-debugsource:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-dba-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-dba:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-curl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-curl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-ctype-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-ctype:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-calendar-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-calendar:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-bz2-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-bz2:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-bcmath-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-bcmath:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:apache2-mod_php7-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:apache2-mod_php7:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-firebird-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-firebird:*:*:*:*:*:suse_linux:*:*

External links

https://www.suse.com/support/update/announcement/2022/suse-su-20224069-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

16) Security features bypass

EUVDB-ID: #VU67756

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/U:Clear]

CVE-ID: CVE-2022-31629

CWE-ID: CWE-254 - Security Features

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to the way PHP handles HTTP variable names. A remote attacker can set a standard insecure cookie in the victim's browser which is treated as a `__Host-` or `__Secure-` cookie by PHP applications.

Mitigation

Update the affected package php7 to the latest version.

Vulnerable software versions

SUSE Enterprise Storage: 7.1

SUSE Linux Enterprise Module for Web Scripting: 15-SP3

SUSE Manager Retail Branch Server: 4.1 - 4.2

SUSE Manager Server: 4.1 - 4.2

SUSE Manager Proxy: 4.1 - 4.2

SUSE Linux Enterprise Server for SAP: 15-SP2

SUSE Linux Enterprise Server: 15-SP2-LTSS - 15-SP3

SUSE Linux Enterprise High Performance Computing: 15-SP2-LTSS - 15-SP3

openSUSE Leap: 15.3 - 15.4

SUSE Linux Enterprise Server for SAP Applications: 15-SP3

SUSE Linux Enterprise Module for Packagehub Subpackages: 15-SP3

php7-zlib-debuginfo: before 7.4.33-150200.3.46.2

php7-zlib: before 7.4.33-150200.3.46.2

php7-zip-debuginfo: before 7.4.33-150200.3.46.2

php7-zip: before 7.4.33-150200.3.46.2

php7-xsl-debuginfo: before 7.4.33-150200.3.46.2

php7-xsl: before 7.4.33-150200.3.46.2

php7-xmlwriter-debuginfo: before 7.4.33-150200.3.46.2

php7-xmlwriter: before 7.4.33-150200.3.46.2

php7-xmlrpc-debuginfo: before 7.4.33-150200.3.46.2

php7-xmlrpc: before 7.4.33-150200.3.46.2

php7-xmlreader-debuginfo: before 7.4.33-150200.3.46.2

php7-xmlreader: before 7.4.33-150200.3.46.2

php7-tokenizer-debuginfo: before 7.4.33-150200.3.46.2

php7-tokenizer: before 7.4.33-150200.3.46.2

php7-tidy-debuginfo: before 7.4.33-150200.3.46.2

php7-tidy: before 7.4.33-150200.3.46.2

php7-test: before 7.4.33-150200.3.46.2

php7-sysvshm-debuginfo: before 7.4.33-150200.3.46.2

php7-sysvshm: before 7.4.33-150200.3.46.2

php7-sysvsem-debuginfo: before 7.4.33-150200.3.46.2

php7-sysvsem: before 7.4.33-150200.3.46.2

php7-sysvmsg-debuginfo: before 7.4.33-150200.3.46.2

php7-sysvmsg: before 7.4.33-150200.3.46.2

php7-sqlite-debuginfo: before 7.4.33-150200.3.46.2

php7-sqlite: before 7.4.33-150200.3.46.2

php7-sodium-debuginfo: before 7.4.33-150200.3.46.2

php7-sodium: before 7.4.33-150200.3.46.2

php7-sockets-debuginfo: before 7.4.33-150200.3.46.2

php7-sockets: before 7.4.33-150200.3.46.2

php7-soap-debuginfo: before 7.4.33-150200.3.46.2

php7-soap: before 7.4.33-150200.3.46.2

php7-snmp-debuginfo: before 7.4.33-150200.3.46.2

php7-snmp: before 7.4.33-150200.3.46.2

php7-shmop-debuginfo: before 7.4.33-150200.3.46.2

php7-shmop: before 7.4.33-150200.3.46.2

php7-readline-debuginfo: before 7.4.33-150200.3.46.2

php7-readline: before 7.4.33-150200.3.46.2

php7-posix-debuginfo: before 7.4.33-150200.3.46.2

php7-posix: before 7.4.33-150200.3.46.2

php7-phar-debuginfo: before 7.4.33-150200.3.46.2

php7-phar: before 7.4.33-150200.3.46.2

php7-pgsql-debuginfo: before 7.4.33-150200.3.46.2

php7-pgsql: before 7.4.33-150200.3.46.2

php7-pdo-debuginfo: before 7.4.33-150200.3.46.2

php7-pdo: before 7.4.33-150200.3.46.2

php7-pcntl-debuginfo: before 7.4.33-150200.3.46.2

php7-pcntl: before 7.4.33-150200.3.46.2

php7-openssl-debuginfo: before 7.4.33-150200.3.46.2

php7-openssl: before 7.4.33-150200.3.46.2

php7-opcache-debuginfo: before 7.4.33-150200.3.46.2

php7-opcache: before 7.4.33-150200.3.46.2

php7-odbc-debuginfo: before 7.4.33-150200.3.46.2

php7-odbc: before 7.4.33-150200.3.46.2

php7-mysql-debuginfo: before 7.4.33-150200.3.46.2

php7-mysql: before 7.4.33-150200.3.46.2

php7-mbstring-debuginfo: before 7.4.33-150200.3.46.2

php7-mbstring: before 7.4.33-150200.3.46.2

php7-ldap-debuginfo: before 7.4.33-150200.3.46.2

php7-ldap: before 7.4.33-150200.3.46.2

php7-json-debuginfo: before 7.4.33-150200.3.46.2

php7-json: before 7.4.33-150200.3.46.2

php7-intl-debuginfo: before 7.4.33-150200.3.46.2

php7-intl: before 7.4.33-150200.3.46.2

php7-iconv-debuginfo: before 7.4.33-150200.3.46.2

php7-iconv: before 7.4.33-150200.3.46.2

php7-gmp-debuginfo: before 7.4.33-150200.3.46.2

php7-gmp: before 7.4.33-150200.3.46.2

php7-gettext-debuginfo: before 7.4.33-150200.3.46.2

php7-gettext: before 7.4.33-150200.3.46.2

php7-gd-debuginfo: before 7.4.33-150200.3.46.2

php7-gd: before 7.4.33-150200.3.46.2

php7-ftp-debuginfo: before 7.4.33-150200.3.46.2

php7-ftp: before 7.4.33-150200.3.46.2

php7-fpm-debuginfo: before 7.4.33-150200.3.46.2

php7-fpm: before 7.4.33-150200.3.46.2

php7-fileinfo-debuginfo: before 7.4.33-150200.3.46.2

php7-fileinfo: before 7.4.33-150200.3.46.2

php7-fastcgi-debuginfo: before 7.4.33-150200.3.46.2

php7-fastcgi: before 7.4.33-150200.3.46.2

php7-exif-debuginfo: before 7.4.33-150200.3.46.2

php7-exif: before 7.4.33-150200.3.46.2

php7-enchant-debuginfo: before 7.4.33-150200.3.46.2

php7-enchant: before 7.4.33-150200.3.46.2

php7-embed-debuginfo: before 7.4.33-150200.3.46.2

php7-embed: before 7.4.33-150200.3.46.2

php7-dom-debuginfo: before 7.4.33-150200.3.46.2

php7-dom: before 7.4.33-150200.3.46.2

php7-devel: before 7.4.33-150200.3.46.2

php7-debugsource: before 7.4.33-150200.3.46.2

php7-debuginfo: before 7.4.33-150200.3.46.2

php7-dba-debuginfo: before 7.4.33-150200.3.46.2

php7-dba: before 7.4.33-150200.3.46.2

php7-curl-debuginfo: before 7.4.33-150200.3.46.2

php7-curl: before 7.4.33-150200.3.46.2

php7-ctype-debuginfo: before 7.4.33-150200.3.46.2

php7-ctype: before 7.4.33-150200.3.46.2

php7-calendar-debuginfo: before 7.4.33-150200.3.46.2

php7-calendar: before 7.4.33-150200.3.46.2

php7-bz2-debuginfo: before 7.4.33-150200.3.46.2

php7-bz2: before 7.4.33-150200.3.46.2

php7-bcmath-debuginfo: before 7.4.33-150200.3.46.2

php7-bcmath: before 7.4.33-150200.3.46.2

php7: before 7.4.33-150200.3.46.2

apache2-mod_php7-debuginfo: before 7.4.33-150200.3.46.2

apache2-mod_php7: before 7.4.33-150200.3.46.2

php7-firebird-debuginfo: before 7.4.33-150200.3.46.2

php7-firebird: before 7.4.33-150200.3.46.2

CPE2.3

• cpe:2.3:o:suse:suse_enterprise_storage:7.1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_module_for_web_scripting:15-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_retail_branch_server:4.1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_retail_branch_server:4.2:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_server:4.1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_server:4.2:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_proxy:4.1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_proxy:4.2:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap:15-SP2:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server:15-SP2-LTSS:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing:15-SP2-LTSS:*:*:*:*:*:*:*
• cpe:2.3:o:suse:opensuse_leap:15.3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications:15-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_module_for_packagehub_subpackages:15-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:php7-zlib-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-zlib:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-zip-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-zip:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xsl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xsl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xmlwriter-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xmlwriter:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xmlrpc-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xmlrpc:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xmlreader-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xmlreader:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-tokenizer-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-tokenizer:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-tidy-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-tidy:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-test:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sysvshm-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sysvshm:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sysvsem-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sysvsem:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sysvmsg-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sysvmsg:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sqlite-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sqlite:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sodium-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sodium:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sockets-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sockets:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-soap-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-soap:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-snmp-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-snmp:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-shmop-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-shmop:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-readline-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-readline:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-posix-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-posix:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-phar-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-phar:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-pgsql-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-pgsql:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-pdo-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-pdo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-pcntl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-pcntl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-openssl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-openssl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-opcache-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-opcache:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-odbc-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-odbc:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-mysql-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-mysql:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-mbstring-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-mbstring:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-ldap-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-ldap:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-json-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-json:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-intl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-intl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-iconv-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-iconv:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-gmp-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-gmp:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-gettext-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-gettext:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-gd-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-gd:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-ftp-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-ftp:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-fpm-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-fpm:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-fileinfo-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-fileinfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-fastcgi-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-fastcgi:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-exif-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-exif:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-enchant-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-enchant:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-embed-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-embed:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-dom-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-dom:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-devel:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-debugsource:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-dba-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-dba:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-curl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-curl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-ctype-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-ctype:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-calendar-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-calendar:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-bz2-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-bz2:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-bcmath-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-bcmath:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:apache2-mod_php7-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:apache2-mod_php7:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-firebird-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-firebird:*:*:*:*:*:suse_linux:*:*

External links

https://www.suse.com/support/update/announcement/2022/suse-su-20224069-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

17) Out-of-bounds read

EUVDB-ID: #VU68886

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2022-31630

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition within the imageloadfont() function. A remote attacker can pass specially crafted data to the web application, trigger an out-of-bounds read error and read contents of memory on the system.

Mitigation

Update the affected package php7 to the latest version.

Vulnerable software versions

SUSE Enterprise Storage: 7.1

SUSE Linux Enterprise Module for Web Scripting: 15-SP3

SUSE Manager Retail Branch Server: 4.1 - 4.2

SUSE Manager Server: 4.1 - 4.2

SUSE Manager Proxy: 4.1 - 4.2

SUSE Linux Enterprise Server for SAP: 15-SP2

SUSE Linux Enterprise Server: 15-SP2-LTSS - 15-SP3

SUSE Linux Enterprise High Performance Computing: 15-SP2-LTSS - 15-SP3

openSUSE Leap: 15.3 - 15.4

SUSE Linux Enterprise Server for SAP Applications: 15-SP3

SUSE Linux Enterprise Module for Packagehub Subpackages: 15-SP3

php7-zlib-debuginfo: before 7.4.33-150200.3.46.2

php7-zlib: before 7.4.33-150200.3.46.2

php7-zip-debuginfo: before 7.4.33-150200.3.46.2

php7-zip: before 7.4.33-150200.3.46.2

php7-xsl-debuginfo: before 7.4.33-150200.3.46.2

php7-xsl: before 7.4.33-150200.3.46.2

php7-xmlwriter-debuginfo: before 7.4.33-150200.3.46.2

php7-xmlwriter: before 7.4.33-150200.3.46.2

php7-xmlrpc-debuginfo: before 7.4.33-150200.3.46.2

php7-xmlrpc: before 7.4.33-150200.3.46.2

php7-xmlreader-debuginfo: before 7.4.33-150200.3.46.2

php7-xmlreader: before 7.4.33-150200.3.46.2

php7-tokenizer-debuginfo: before 7.4.33-150200.3.46.2

php7-tokenizer: before 7.4.33-150200.3.46.2

php7-tidy-debuginfo: before 7.4.33-150200.3.46.2

php7-tidy: before 7.4.33-150200.3.46.2

php7-test: before 7.4.33-150200.3.46.2

php7-sysvshm-debuginfo: before 7.4.33-150200.3.46.2

php7-sysvshm: before 7.4.33-150200.3.46.2

php7-sysvsem-debuginfo: before 7.4.33-150200.3.46.2

php7-sysvsem: before 7.4.33-150200.3.46.2

php7-sysvmsg-debuginfo: before 7.4.33-150200.3.46.2

php7-sysvmsg: before 7.4.33-150200.3.46.2

php7-sqlite-debuginfo: before 7.4.33-150200.3.46.2

php7-sqlite: before 7.4.33-150200.3.46.2

php7-sodium-debuginfo: before 7.4.33-150200.3.46.2

php7-sodium: before 7.4.33-150200.3.46.2

php7-sockets-debuginfo: before 7.4.33-150200.3.46.2

php7-sockets: before 7.4.33-150200.3.46.2

php7-soap-debuginfo: before 7.4.33-150200.3.46.2

php7-soap: before 7.4.33-150200.3.46.2

php7-snmp-debuginfo: before 7.4.33-150200.3.46.2

php7-snmp: before 7.4.33-150200.3.46.2

php7-shmop-debuginfo: before 7.4.33-150200.3.46.2

php7-shmop: before 7.4.33-150200.3.46.2

php7-readline-debuginfo: before 7.4.33-150200.3.46.2

php7-readline: before 7.4.33-150200.3.46.2

php7-posix-debuginfo: before 7.4.33-150200.3.46.2

php7-posix: before 7.4.33-150200.3.46.2

php7-phar-debuginfo: before 7.4.33-150200.3.46.2

php7-phar: before 7.4.33-150200.3.46.2

php7-pgsql-debuginfo: before 7.4.33-150200.3.46.2

php7-pgsql: before 7.4.33-150200.3.46.2

php7-pdo-debuginfo: before 7.4.33-150200.3.46.2

php7-pdo: before 7.4.33-150200.3.46.2

php7-pcntl-debuginfo: before 7.4.33-150200.3.46.2

php7-pcntl: before 7.4.33-150200.3.46.2

php7-openssl-debuginfo: before 7.4.33-150200.3.46.2

php7-openssl: before 7.4.33-150200.3.46.2

php7-opcache-debuginfo: before 7.4.33-150200.3.46.2

php7-opcache: before 7.4.33-150200.3.46.2

php7-odbc-debuginfo: before 7.4.33-150200.3.46.2

php7-odbc: before 7.4.33-150200.3.46.2

php7-mysql-debuginfo: before 7.4.33-150200.3.46.2

php7-mysql: before 7.4.33-150200.3.46.2

php7-mbstring-debuginfo: before 7.4.33-150200.3.46.2

php7-mbstring: before 7.4.33-150200.3.46.2

php7-ldap-debuginfo: before 7.4.33-150200.3.46.2

php7-ldap: before 7.4.33-150200.3.46.2

php7-json-debuginfo: before 7.4.33-150200.3.46.2

php7-json: before 7.4.33-150200.3.46.2

php7-intl-debuginfo: before 7.4.33-150200.3.46.2

php7-intl: before 7.4.33-150200.3.46.2

php7-iconv-debuginfo: before 7.4.33-150200.3.46.2

php7-iconv: before 7.4.33-150200.3.46.2

php7-gmp-debuginfo: before 7.4.33-150200.3.46.2

php7-gmp: before 7.4.33-150200.3.46.2

php7-gettext-debuginfo: before 7.4.33-150200.3.46.2

php7-gettext: before 7.4.33-150200.3.46.2

php7-gd-debuginfo: before 7.4.33-150200.3.46.2

php7-gd: before 7.4.33-150200.3.46.2

php7-ftp-debuginfo: before 7.4.33-150200.3.46.2

php7-ftp: before 7.4.33-150200.3.46.2

php7-fpm-debuginfo: before 7.4.33-150200.3.46.2

php7-fpm: before 7.4.33-150200.3.46.2

php7-fileinfo-debuginfo: before 7.4.33-150200.3.46.2

php7-fileinfo: before 7.4.33-150200.3.46.2

php7-fastcgi-debuginfo: before 7.4.33-150200.3.46.2

php7-fastcgi: before 7.4.33-150200.3.46.2

php7-exif-debuginfo: before 7.4.33-150200.3.46.2

php7-exif: before 7.4.33-150200.3.46.2

php7-enchant-debuginfo: before 7.4.33-150200.3.46.2

php7-enchant: before 7.4.33-150200.3.46.2

php7-embed-debuginfo: before 7.4.33-150200.3.46.2

php7-embed: before 7.4.33-150200.3.46.2

php7-dom-debuginfo: before 7.4.33-150200.3.46.2

php7-dom: before 7.4.33-150200.3.46.2

php7-devel: before 7.4.33-150200.3.46.2

php7-debugsource: before 7.4.33-150200.3.46.2

php7-debuginfo: before 7.4.33-150200.3.46.2

php7-dba-debuginfo: before 7.4.33-150200.3.46.2

php7-dba: before 7.4.33-150200.3.46.2

php7-curl-debuginfo: before 7.4.33-150200.3.46.2

php7-curl: before 7.4.33-150200.3.46.2

php7-ctype-debuginfo: before 7.4.33-150200.3.46.2

php7-ctype: before 7.4.33-150200.3.46.2

php7-calendar-debuginfo: before 7.4.33-150200.3.46.2

php7-calendar: before 7.4.33-150200.3.46.2

php7-bz2-debuginfo: before 7.4.33-150200.3.46.2

php7-bz2: before 7.4.33-150200.3.46.2

php7-bcmath-debuginfo: before 7.4.33-150200.3.46.2

php7-bcmath: before 7.4.33-150200.3.46.2

php7: before 7.4.33-150200.3.46.2

apache2-mod_php7-debuginfo: before 7.4.33-150200.3.46.2

apache2-mod_php7: before 7.4.33-150200.3.46.2

php7-firebird-debuginfo: before 7.4.33-150200.3.46.2

php7-firebird: before 7.4.33-150200.3.46.2

CPE2.3

• cpe:2.3:o:suse:suse_enterprise_storage:7.1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_module_for_web_scripting:15-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_retail_branch_server:4.1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_retail_branch_server:4.2:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_server:4.1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_server:4.2:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_proxy:4.1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_proxy:4.2:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap:15-SP2:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server:15-SP2-LTSS:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing:15-SP2-LTSS:*:*:*:*:*:*:*
• cpe:2.3:o:suse:opensuse_leap:15.3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications:15-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_module_for_packagehub_subpackages:15-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:php7-zlib-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-zlib:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-zip-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-zip:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xsl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xsl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xmlwriter-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xmlwriter:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xmlrpc-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xmlrpc:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xmlreader-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xmlreader:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-tokenizer-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-tokenizer:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-tidy-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-tidy:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-test:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sysvshm-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sysvshm:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sysvsem-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sysvsem:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sysvmsg-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sysvmsg:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sqlite-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sqlite:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sodium-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sodium:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sockets-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sockets:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-soap-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-soap:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-snmp-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-snmp:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-shmop-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-shmop:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-readline-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-readline:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-posix-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-posix:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-phar-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-phar:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-pgsql-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-pgsql:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-pdo-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-pdo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-pcntl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-pcntl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-openssl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-openssl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-opcache-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-opcache:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-odbc-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-odbc:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-mysql-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-mysql:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-mbstring-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-mbstring:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-ldap-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-ldap:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-json-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-json:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-intl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-intl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-iconv-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-iconv:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-gmp-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-gmp:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-gettext-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-gettext:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-gd-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-gd:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-ftp-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-ftp:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-fpm-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-fpm:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-fileinfo-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-fileinfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-fastcgi-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-fastcgi:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-exif-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-exif:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-enchant-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-enchant:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-embed-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-embed:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-dom-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-dom:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-devel:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-debugsource:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-dba-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-dba:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-curl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-curl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-ctype-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-ctype:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-calendar-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-calendar:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-bz2-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-bz2:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-bcmath-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-bcmath:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:apache2-mod_php7-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:apache2-mod_php7:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-firebird-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-firebird:*:*:*:*:*:suse_linux:*:*

External links

https://www.suse.com/support/update/announcement/2022/suse-su-20224069-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

18) Integer overflow

EUVDB-ID: #VU68887

Risk: High

CVSSv4.0: 8.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Amber]

CVE-ID: CVE-2022-37454

CWE-ID: CWE-190 - Integer overflow

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow within the Keccak XKCP SHA-3 reference implementation. A remote attacker can pass specially crafted data to the application, trigger an integer overflow and execute arbitrary code on the target system or eliminate expected cryptographic properties.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update the affected package php7 to the latest version.

Vulnerable software versions

SUSE Enterprise Storage: 7.1

SUSE Linux Enterprise Module for Web Scripting: 15-SP3

SUSE Manager Retail Branch Server: 4.1 - 4.2

SUSE Manager Server: 4.1 - 4.2

SUSE Manager Proxy: 4.1 - 4.2

SUSE Linux Enterprise Server for SAP: 15-SP2

SUSE Linux Enterprise Server: 15-SP2-LTSS - 15-SP3

SUSE Linux Enterprise High Performance Computing: 15-SP2-LTSS - 15-SP3

openSUSE Leap: 15.3 - 15.4

SUSE Linux Enterprise Server for SAP Applications: 15-SP3

SUSE Linux Enterprise Module for Packagehub Subpackages: 15-SP3

php7-zlib-debuginfo: before 7.4.33-150200.3.46.2

php7-zlib: before 7.4.33-150200.3.46.2

php7-zip-debuginfo: before 7.4.33-150200.3.46.2

php7-zip: before 7.4.33-150200.3.46.2

php7-xsl-debuginfo: before 7.4.33-150200.3.46.2

php7-xsl: before 7.4.33-150200.3.46.2

php7-xmlwriter-debuginfo: before 7.4.33-150200.3.46.2

php7-xmlwriter: before 7.4.33-150200.3.46.2

php7-xmlrpc-debuginfo: before 7.4.33-150200.3.46.2

php7-xmlrpc: before 7.4.33-150200.3.46.2

php7-xmlreader-debuginfo: before 7.4.33-150200.3.46.2

php7-xmlreader: before 7.4.33-150200.3.46.2

php7-tokenizer-debuginfo: before 7.4.33-150200.3.46.2

php7-tokenizer: before 7.4.33-150200.3.46.2

php7-tidy-debuginfo: before 7.4.33-150200.3.46.2

php7-tidy: before 7.4.33-150200.3.46.2

php7-test: before 7.4.33-150200.3.46.2

php7-sysvshm-debuginfo: before 7.4.33-150200.3.46.2

php7-sysvshm: before 7.4.33-150200.3.46.2

php7-sysvsem-debuginfo: before 7.4.33-150200.3.46.2

php7-sysvsem: before 7.4.33-150200.3.46.2

php7-sysvmsg-debuginfo: before 7.4.33-150200.3.46.2

php7-sysvmsg: before 7.4.33-150200.3.46.2

php7-sqlite-debuginfo: before 7.4.33-150200.3.46.2

php7-sqlite: before 7.4.33-150200.3.46.2

php7-sodium-debuginfo: before 7.4.33-150200.3.46.2

php7-sodium: before 7.4.33-150200.3.46.2

php7-sockets-debuginfo: before 7.4.33-150200.3.46.2

php7-sockets: before 7.4.33-150200.3.46.2

php7-soap-debuginfo: before 7.4.33-150200.3.46.2

php7-soap: before 7.4.33-150200.3.46.2

php7-snmp-debuginfo: before 7.4.33-150200.3.46.2

php7-snmp: before 7.4.33-150200.3.46.2

php7-shmop-debuginfo: before 7.4.33-150200.3.46.2

php7-shmop: before 7.4.33-150200.3.46.2

php7-readline-debuginfo: before 7.4.33-150200.3.46.2

php7-readline: before 7.4.33-150200.3.46.2

php7-posix-debuginfo: before 7.4.33-150200.3.46.2

php7-posix: before 7.4.33-150200.3.46.2

php7-phar-debuginfo: before 7.4.33-150200.3.46.2

php7-phar: before 7.4.33-150200.3.46.2

php7-pgsql-debuginfo: before 7.4.33-150200.3.46.2

php7-pgsql: before 7.4.33-150200.3.46.2

php7-pdo-debuginfo: before 7.4.33-150200.3.46.2

php7-pdo: before 7.4.33-150200.3.46.2

php7-pcntl-debuginfo: before 7.4.33-150200.3.46.2

php7-pcntl: before 7.4.33-150200.3.46.2

php7-openssl-debuginfo: before 7.4.33-150200.3.46.2

php7-openssl: before 7.4.33-150200.3.46.2

php7-opcache-debuginfo: before 7.4.33-150200.3.46.2

php7-opcache: before 7.4.33-150200.3.46.2

php7-odbc-debuginfo: before 7.4.33-150200.3.46.2

php7-odbc: before 7.4.33-150200.3.46.2

php7-mysql-debuginfo: before 7.4.33-150200.3.46.2

php7-mysql: before 7.4.33-150200.3.46.2

php7-mbstring-debuginfo: before 7.4.33-150200.3.46.2

php7-mbstring: before 7.4.33-150200.3.46.2

php7-ldap-debuginfo: before 7.4.33-150200.3.46.2

php7-ldap: before 7.4.33-150200.3.46.2

php7-json-debuginfo: before 7.4.33-150200.3.46.2

php7-json: before 7.4.33-150200.3.46.2

php7-intl-debuginfo: before 7.4.33-150200.3.46.2

php7-intl: before 7.4.33-150200.3.46.2

php7-iconv-debuginfo: before 7.4.33-150200.3.46.2

php7-iconv: before 7.4.33-150200.3.46.2

php7-gmp-debuginfo: before 7.4.33-150200.3.46.2

php7-gmp: before 7.4.33-150200.3.46.2

php7-gettext-debuginfo: before 7.4.33-150200.3.46.2

php7-gettext: before 7.4.33-150200.3.46.2

php7-gd-debuginfo: before 7.4.33-150200.3.46.2

php7-gd: before 7.4.33-150200.3.46.2

php7-ftp-debuginfo: before 7.4.33-150200.3.46.2

php7-ftp: before 7.4.33-150200.3.46.2

php7-fpm-debuginfo: before 7.4.33-150200.3.46.2

php7-fpm: before 7.4.33-150200.3.46.2

php7-fileinfo-debuginfo: before 7.4.33-150200.3.46.2

php7-fileinfo: before 7.4.33-150200.3.46.2

php7-fastcgi-debuginfo: before 7.4.33-150200.3.46.2

php7-fastcgi: before 7.4.33-150200.3.46.2

php7-exif-debuginfo: before 7.4.33-150200.3.46.2

php7-exif: before 7.4.33-150200.3.46.2

php7-enchant-debuginfo: before 7.4.33-150200.3.46.2

php7-enchant: before 7.4.33-150200.3.46.2

php7-embed-debuginfo: before 7.4.33-150200.3.46.2

php7-embed: before 7.4.33-150200.3.46.2

php7-dom-debuginfo: before 7.4.33-150200.3.46.2

php7-dom: before 7.4.33-150200.3.46.2

php7-devel: before 7.4.33-150200.3.46.2

php7-debugsource: before 7.4.33-150200.3.46.2

php7-debuginfo: before 7.4.33-150200.3.46.2

php7-dba-debuginfo: before 7.4.33-150200.3.46.2

php7-dba: before 7.4.33-150200.3.46.2

php7-curl-debuginfo: before 7.4.33-150200.3.46.2

php7-curl: before 7.4.33-150200.3.46.2

php7-ctype-debuginfo: before 7.4.33-150200.3.46.2

php7-ctype: before 7.4.33-150200.3.46.2

php7-calendar-debuginfo: before 7.4.33-150200.3.46.2

php7-calendar: before 7.4.33-150200.3.46.2

php7-bz2-debuginfo: before 7.4.33-150200.3.46.2

php7-bz2: before 7.4.33-150200.3.46.2

php7-bcmath-debuginfo: before 7.4.33-150200.3.46.2

php7-bcmath: before 7.4.33-150200.3.46.2

php7: before 7.4.33-150200.3.46.2

apache2-mod_php7-debuginfo: before 7.4.33-150200.3.46.2

apache2-mod_php7: before 7.4.33-150200.3.46.2

php7-firebird-debuginfo: before 7.4.33-150200.3.46.2

php7-firebird: before 7.4.33-150200.3.46.2

CPE2.3

• cpe:2.3:o:suse:suse_enterprise_storage:7.1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_module_for_web_scripting:15-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_retail_branch_server:4.1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_retail_branch_server:4.2:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_server:4.1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_server:4.2:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_proxy:4.1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_proxy:4.2:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap:15-SP2:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server:15-SP2-LTSS:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing:15-SP2-LTSS:*:*:*:*:*:*:*
• cpe:2.3:o:suse:opensuse_leap:15.3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications:15-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_module_for_packagehub_subpackages:15-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:php7-zlib-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-zlib:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-zip-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-zip:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xsl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xsl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xmlwriter-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xmlwriter:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xmlrpc-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xmlrpc:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xmlreader-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-xmlreader:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-tokenizer-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-tokenizer:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-tidy-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-tidy:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-test:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sysvshm-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sysvshm:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sysvsem-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sysvsem:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sysvmsg-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sysvmsg:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sqlite-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sqlite:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sodium-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sodium:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sockets-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-sockets:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-soap-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-soap:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-snmp-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-snmp:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-shmop-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-shmop:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-readline-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-readline:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-posix-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-posix:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-phar-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-phar:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-pgsql-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-pgsql:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-pdo-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-pdo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-pcntl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-pcntl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-openssl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-openssl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-opcache-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-opcache:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-odbc-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-odbc:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-mysql-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-mysql:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-mbstring-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-mbstring:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-ldap-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-ldap:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-json-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-json:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-intl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-intl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-iconv-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-iconv:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-gmp-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-gmp:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-gettext-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-gettext:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-gd-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-gd:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-ftp-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-ftp:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-fpm-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-fpm:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-fileinfo-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-fileinfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-fastcgi-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-fastcgi:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-exif-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-exif:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-enchant-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-enchant:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-embed-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-embed:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-dom-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-dom:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-devel:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-debugsource:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-dba-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-dba:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-curl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-curl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-ctype-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-ctype:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-calendar-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-calendar:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-bz2-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-bz2:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-bcmath-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-bcmath:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:apache2-mod_php7-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:apache2-mod_php7:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-firebird-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:php7-firebird:*:*:*:*:*:suse_linux:*:*

External links

https://www.suse.com/support/update/announcement/2022/suse-su-20224069-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.