In PHP versions 8.2. before 8.2.31, 8.3. before 8.3.31, 8.4. before 8.4.21, and 8.5. before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
In PHP versions 8.1. before 8.1.34, 8.2. before 8.2.30, 8.3. before 8.3.29, 8.4. before 8.4.16, 8.5. before 8.5.1 when using the PDO PostgreSQL driver with PDO::ATTREMULATEPREPARES enabled, an invalid character sequence (such as \x99) in a prepared statement parameter may cause the quoting function PQescapeStringConn to return NULL, leading to a null pointer dereference in pdoparseparams() function. This may lead to crashes (segmentation fault) and affect the availability of the target server.
End of life: 12/31/2029, End of support: 12/31/2027, Latest version: 8.5.9
End of life: 12/31/2027, End of support: 12/31/2025, Latest version: 8.3.33
End of life: 12/31/2027, End of support: 12/31/2025, Latest version: 8.3.33
End of life: 12/31/2028, End of support: 12/31/2026, Latest version: 8.4.24
End of life: 12/31/2028, End of support: 12/31/2026, Latest version: 8.4.24
End of life: 12/31/2026, End of support: 12/31/2024, Latest version: 8.2.33
End of life: 12/31/2026, End of support: 12/31/2024, Latest version: 8.2.33
End of life: 12/31/2025, End of support: 11/25/2023, Latest version: 8.1.34
End of life: 12/31/2025, End of support: 11/25/2023, Latest version: 8.1.34
According to https://www.php.net/manual/en/security.cgi-bin.force-redirect.php, the configuration directive cgi.forceredirect prevents anyone from calling PHP directly with a URL like http://host.example/cgi-bin/php/secretdir/script.php. The default value of cgi.forceredirect is 1.
But there is a bug that can cause attackers to bypass restrictions and access php-cgi directly.
USN-3953-1 fixed several vulnerabilities in PHP. This update provides the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM. Original advisory details: It was discovered that PHP incorrectly handled certain exif tags in JPEG images. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code.