SB2025012960 - Ubuntu update for php7.0
Published: January 29, 2025
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 4 secuirty vulnerabilities.
1) Buffer Over-read (CVE-ID: CVE-2024-11233)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a one byte over-read in streams when using the convert.quoted-printable-decode filter. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.
2) CRLF injection (CVE-ID: CVE-2024-11234)
The vulnerability allows a remote attacker to perform spoofing attack.
The vulnerability exists due to insufficient validation of URIs in streams component when using proxy. A remote attacker can pass specially crafted data to the application containing CR-LF characters and perform a spoofing attack.
3) Out-of-bounds read (CVE-ID: CVE-2024-8932)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition within the ldap_escape() function. A remote attacker can pass specially crafted input to the application, trigger an out-of-bounds read error and read contents of memory on the system.
4) Buffer Over-read (CVE-ID: CVE-2024-8929)
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due memory leak within the MySQLnd component. A
remote attacker can force the application to leak partial content of
the heap and gain access to sensitive information.
Remediation
Install update from vendor's website.