USN-6757-2: PHP vulnerabilities
USN-6757-1 fixed vulnerabilities in PHP. Unfortunately these fixes were incomplete for Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 23.10. This update fixes the problem. Original advisory details: It was discovered that PHP incorrectly handled PHPCLISERVERWORKERS variable. An attacker could possibly use this issue to cause a crash or execute arbitrary code. This issue only affected Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2022-4900) It was discovered that PHP incorrectly handled certain cookies. An attacker could possibly use this issue to cookie by pass. (CVE-2024-2756) It was discovered that PHP incorrectly handled some passwords. An attacker could possibly use this issue to cause an account takeover attack. (CVE-2024-3096)
Affected Software
Event History
Frequently Asked Questions
What is the severity of USN-6757-2?
USN-6757-2 addresses critical vulnerabilities that can lead to potential security risks in affected PHP packages.
How do I fix USN-6757-2?
To resolve the vulnerabilities detailed in USN-6757-2, upgrade to the updated packages for PHP available in your Ubuntu repository.
Which Ubuntu versions are affected by USN-6757-2?
USN-6757-2 affects Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 23.10.
What packages are included in USN-6757-2?
USN-6757-2 includes updates for libapache2-mod-php, php, php-cgi, php-cli, php-fpm, and php-xml packages.
Is USN-6757-2 applicable for PHP 7.4 or PHP 8.1?
Yes, USN-6757-2 applies to both PHP 7.4 and PHP 8.1 as well as PHP 8.2.