Missing error checking could result in SQL injection and missing error handling could lead to crashes due to null pointer dereferences.

This is related to https://www.postgresql.org/support/security/CVE-2025-1094/ that was reported to postgres. The reporter used php to showcase the problem.

While working on addressing the report, it was realised that PHP uses the escape functions in a way that does not allow for errors to be reported. Specifically the error parameters is not passed to PQescapeStringConn(), which therefore cannot report an error.

While postgres now tries to make sure that the escaped string will trigger errors on the server-side if the string is invalidly encoded, that still can be insufficient, depending on how the escaped values are used.

It was also noted that several calls to PQescapeIdentifier() do not check for the returned value being NULL, despite that being the documented way that PQescapeIdentifier() (and PQescapeLiteral()) to report errors. Seems like that could cause crashes or at least UB in some of the callsites.

In PHP versions 8.3. before 8.3.19 and 8.4. before 8.4.5, a code sequence involving set handler or ??= operator and exceptions can lead to a use-after-free vulnerability. If the third party can control the memory layout leading to this, for example by supplying specially crafted inputs to the script, it could lead to remote code execution.

A vulnerability was found in PHP where setting the environment variable PHPCLISERVERWORKERS to a large value leads to a heap buffer overflow.

CVE-2023-0567[0]: PHP: Passwordverify() always return true with some hash

[0] https://security-tracker.debian.org/tracker/CVE-2023-0567 https://www.cve.org/CVERecord?id=CVE-2023-0567 https://github.com/php/php-src/security/advisories/GHSA-7fj2-8x79-rjf4

In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, core path resolution function allocate buffer one byte too small. When resolving paths with lengths close to system MAXPATHLEN setting, this may lead to the byte after the allocated buffer being overwritten with NUL value, which might lead to unauthorized data access or modification.

https://bugs.php.net/bug.php?id=81746

In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, excessive number of parts in HTTP form upload can cause high resource consumption and excessive number of log entries. This can cause denial of service on the affected server by exhausting CPU resources or disk space.

https://github.com/php/php-src/security/advisories/GHSA-54hq-v5wp-fqgv

Fixed bug (1-byte array overrun in common path resolve code). (CVE-2023-0568)

Fixed bug GHSA-54hq-v5wp-fqgv (DOS vulnerability when parsing multipart request body). (CVE-2023-0662)

Fixed bug (PDO::quote() may return unquoted string). (CVE-2022-31631)

Fixed bug : OOB read due to insufficient input validation in imageloadfont(). (CVE-2022-31630)

Fixed bug : buffer overflow in hashupdate() on long parameter. (CVE-2022-37454)

$COOKIE names string replacement (. -> ): cookie integrity vulnerabilities

Fixed bug : phar wrapper: DOS when using quine gzip file. (CVE-2022-31628)

In PHP versions 8.1.x below 8.1.8, when fileinfo functions, such as finfobuffer, due to incorrect patch applied to the third party code from libmagic, incorrect function may be used to free allocated memory, which may lead to heap corruption.

Fixed bug : mysqlnd/pdo password buffer overflow. (CVE-2022-31626)

Fixed bug (special character is breaking the path in xml function). (CVE-2021-21707)

Fixed bug (PHP-FPM oob R/W in root process leading to privilege escalation) (CVE-2021-21703).

In PHP versions 7.3.x below 7.3.31, 7.4.x below 7.4.24 and 8.0.x below 8.0.11, in Microsoft Windows environment, ZipArchive::extractTo may be tricked into writing a file outside target directory when extracting a ZIP file, thus potentially causing files to be created or overwritten, subject to OS permissions.

Fixed bug (SSRF bypass in FILTERVALIDATEURL). (CVE-2021-21705)

Fixed bug (Crash while parsing blob data in firebirdfetchblob). (CVE-2021-21704)

XMB is vulnerable to cross-site scripting (XSS) due to inadequate filtering of BBCode input. This bug affects all versions of XMB. All XMB installations must be updated to versions 1.9.12.03 or 1.9.11.16.

Fixed bug (Null Dereference in SoapClient). (CVE-2021-21702)

End of life: 11/26/2023, End of support: 11/26/2022, Latest version: 8.0.30

End of life: 11/26/2023, End of support: 11/26/2022, Latest version: 8.0.30

An issue was discovered in Chadha PHPKB 9.0 Enterprise Edition. installer/test-connection.php (part of the installation process) allows a remote unauthenticated attacker to disclose local files on hosts running PHP before 7.2.16, or on hosts where the MySQL ALLOW LOCAL DATA INFILE option is enabled.

Fixed bug (Use of freed hash key in the pharparsezipfile function). (CVE-2020-7068)

USN-4330-1 fixed vulnerabilities in PHP. This update provides the corresponding update for Ubuntu 20.04 LTS. Original advisory details: It was discovered that PHP incorrectly handled certain EXIF files. An attacker could possibly use this issue to access sensitive information or cause a crash. (CVE-2020-7064) It was discovered that PHP incorrectly handled certain UTF strings. An attacker could possibly use this issue to cause a crash or execute arbitrary code. (CVE-2020-7065) It was discovered that PHP incorrectly handled certain URLs. An attacker could possibly use this issue to expose sensitive information. (CVE-2020-7066)

Fixed bug (OOB Read in urldecode()). (CVE-2020-7067)