USN-7049-1: PHP vulnerabilities

Published Oct 1, 2024
·
Updated

It was discovered that PHP incorrectly handled parsing multipart form data. A remote attacker could possibly use this issue to inject payloads and cause PHP to ignore legitimate data. (CVE-2024-8925) It was discovered that PHP incorrectly handled the cgi.forceredirect configuration option due to environment variable collisions. In certain configurations, an attacker could possibly use this issue bypass forceredirect restrictions. (CVE-2024-8927) It was discovered that PHP-FPM incorrectly handled logging. A remote attacker could possibly use this issue to alter and inject arbitrary contents into log files. This issue only affected Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS. (CVE-2024-9026)

Affected Software

24 affected componentsFixes available
All of the following
ubuntu/libapache2-mod-php8.3<8.3.6-0ubuntu0.24.04.2
8.3.6-0ubuntu0.24.04.2
Ubuntu Ubuntu=24.04
All of the following
ubuntu/php8.3-cgi<8.3.6-0ubuntu0.24.04.2
8.3.6-0ubuntu0.24.04.2
Ubuntu Ubuntu=24.04
All of the following
ubuntu/php8.3-cli<8.3.6-0ubuntu0.24.04.2
8.3.6-0ubuntu0.24.04.2
Ubuntu Ubuntu=24.04
All of the following
ubuntu/php8.3-fpm<8.3.6-0ubuntu0.24.04.2
8.3.6-0ubuntu0.24.04.2
Ubuntu Ubuntu=24.04
All of the following
ubuntu/libapache2-mod-php8.1<8.1.2-1ubuntu2.19
8.1.2-1ubuntu2.19
Ubuntu Ubuntu=22.04
All of the following
ubuntu/php8.1-cgi<8.1.2-1ubuntu2.19
8.1.2-1ubuntu2.19
Ubuntu Ubuntu=22.04
All of the following
ubuntu/php8.1-cli<8.1.2-1ubuntu2.19
8.1.2-1ubuntu2.19
Ubuntu Ubuntu=22.04
All of the following
ubuntu/php8.1-fpm<8.1.2-1ubuntu2.19
8.1.2-1ubuntu2.19
Ubuntu Ubuntu=22.04
All of the following
ubuntu/libapache2-mod-php7.4<7.4.3-4ubuntu2.24
7.4.3-4ubuntu2.24
Ubuntu Ubuntu=20.04
All of the following
ubuntu/php7.4-cgi<7.4.3-4ubuntu2.24
7.4.3-4ubuntu2.24
Ubuntu Ubuntu=20.04
All of the following
ubuntu/php7.4-cli<7.4.3-4ubuntu2.24
7.4.3-4ubuntu2.24
Ubuntu Ubuntu=20.04
All of the following
ubuntu/php7.4-fpm<7.4.3-4ubuntu2.24
7.4.3-4ubuntu2.24
Ubuntu Ubuntu=20.04

Event History

Oct 1, 2024
Advisory Published
via Ubuntu·12:00 AM

Child vulnerabilities

Contains the following vulnerabilities.

Frequently Asked Questions

1

What is the severity of USN-7049-1?

The severity of USN-7049-1 is considered to be critical due to the potential for remote code execution and payload injection vulnerabilities.

2

How do I fix USN-7049-1?

To fix USN-7049-1, update the affected PHP packages to the recommended versions specified in the security notice.

3

Which PHP versions are affected by USN-7049-1?

USN-7049-1 affects PHP versions 8.3, 8.1, and 7.4 on specific Ubuntu releases.

4

Can USN-7049-1 be exploited remotely?

Yes, USN-7049-1 can be exploited remotely, allowing attackers to inject malicious payloads into PHP applications.

5

What Ubuntu releases are impacted by USN-7049-1?

USN-7049-1 impacts Ubuntu releases 20.04, 22.04, and 24.04.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203