Home[1] Files[2] News[3] &[SERVICES_TAB] Contact[4] Add New[5]
- Ubuntu Security Notice USN-6757-2[6]
- Authored by Ubuntu[7] | Site security.ubuntu.com[8]
-
Ubuntu Security Notice 6757-2 - USN-6757-1 fixed vulnerabilities in PHP. Unfortunately these fixes were incomplete for Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 23.10. This update fixes the problem. It was discovered that PHP incorrectly handled PHP_CLI_SERVER_WORKERS variable. An attacker could possibly use this issue to cause a crash or execute arbitrary code. This issue only affected Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS.
- systems | linux[9], ubuntu[10]
- advisories | CVE-2022-4900[11], CVE-2024-2756[12], CVE-2024-3096[13]
- SHA-256 |
9657a689d1e137641b5539b1d18e172041c6d3cba27fdc722c254145353f09b5
- Download[14] | Favorite[15] | View[16]
Change Mirror[17] Download[18]
==========================================================================
Ubuntu Security Notice USN-6757-2
May 02, 2024
php7.4, php8.1, php8.2 vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 23.10
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
Summary:
Several security issues were fixed in PHP.
Software Description:
- php8.2: server-side, HTML-embedded scripting language (metapackage)
- php8.1: HTML-embedded scripting language interpreter
- php7.4: HTML-embedded scripting language interpreter
Details:
USN-6757-1 fixed vulnerabilities in PHP. Unfortunately these fixes were incomplete for
Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 23.10. This update fixes the problem.
Original advisory details:
It was discovered that PHP incorrectly handled PHP_CLI_SERVER_WORKERS variable.
An attacker could possibly use this issue to cause a crash or execute
arbitrary code. This issue only affected Ubuntu 20.04 LTS, and
Ubuntu 22.04 LTS. (CVE-2022-4900)
It was discovered that PHP incorrectly handled certain cookies.
An attacker could possibly use this issue to cookie by pass.
(CVE-2024-2756)
It was discovered that PHP incorrectly handled some passwords.
An attacker could possibly use this issue to cause an account takeover
attack. (CVE-2024-3096)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 23.10
libapache2-mod-php8.2 8.2.10-2ubuntu2.1
php8.2 8.2.10-2ubuntu2.1
php8.2-cgi 8.2.10-2ubuntu2.1
php8.2-cli 8.2.10-2ubuntu2.1
php8.2-fpm 8.2.10-2ubuntu2.1
php8.2-xml 8.2.10-2ubuntu2.1
Ubuntu 22.04 LTS
libapache2-mod-php8.1 8.1.2-1ubuntu2.17
php8.1 8.1.2-1ubuntu2.17
php8.1-cgi 8.1.2-1ubuntu2.17
php8.1-cli 8.1.2-1ubuntu2.17
php8.1-fpm 8.1.2-1ubuntu2.17
php8.1-xml 8.1.2-1ubuntu2.17
Ubuntu 20.04 LTS
libapache2-mod-php7.4 7.4.3-4ubuntu2.22
php7.4 7.4.3-4ubuntu2.22
php7.4-cgi 7.4.3-4ubuntu2.22
php7.4-cli 7.4.3-4ubuntu2.22
php7.4-fpm 7.4.3-4ubuntu2.22
php7.4-xml 7.4.3-4ubuntu2.22
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6757-2
https://ubuntu.com/security/notices/USN-6757-1
CVE-2022-4900, CVE-2024-2756, CVE-2024-3096
Package Information:
https://launchpad.net/ubuntu/+source/php8.2/8.2.10-2ubuntu2.1
https://launchpad.net/ubuntu/+source/php8.1/8.1.2-1ubuntu2.17
https://launchpad.net/ubuntu/+source/php7.4/7.4.3-4ubuntu2.22
File Tags
- ActiveX[24] (933)
- Advisory[25] (85,085)
- Arbitrary[26] (16,682)
- BBS[27] (2,859)
- Bypass[28] (1,834)
- CGI[29] (1,032)
- Code Execution[30] (7,643)
- Conference[31] (689)
- Cracker[32] (844)
- CSRF[33] (3,374)
- DoS[34] (24,648)
- Encryption[35] (2,383)
- Exploit[36] (52,862)
- File Inclusion[37] (4,253)
- File Upload[38] (987)
- Firewall[39] (822)
- Info Disclosure[40] (2,855)
- Intrusion Detection[41] (907)
- Java[42] (3,128)
- JavaScript[43] (890)
- Kernel[44] (7,041)
- Local[45] (14,718)
- Magazine[46] (586)
- Overflow[47] (13,082)
- Perl[48] (1,431)
- PHP[49] (5,205)
- Proof of Concept[50] (2,371)
- Protocol[51] (3,703)
- Python[52] (1,604)
- Remote[53] (31,449)
- Root[54] (3,618)
- Rootkit[55] (523)
- Ruby[56] (619)
- Scanner[57] (1,650)
- Security Tool[58] (7,983)
- Shell[59] (3,258)
- Shellcode[60] (1,217)
- Sniffer[61] (900)
- Spoof[62] (2,261)
- SQL Injection[63] (16,542)
- TCP[64] (2,425)
- Trojan[65] (689)
- UDP[66] (899)
- Virus[67] (669)
- Vulnerability[68] (32,652)
- Web[69] (9,885)
- Whitepaper[70] (3,775)
- x86[71] (967)
- XSS[72] (18,184)
- Other[73]
File Archives
- May 2024[74]
- April 2024[75]
- March 2024[76]
- February 2024[77]
- January 2024[78]
- December 2023[79]
- November 2023[80]
- October 2023[81]
- September 2023[82]
- August 2023[83]
- July 2023[84]
- June 2023[85]
- Older[86]
Systems
- AIX[87] (429)
- Apple[88] (2,078)
- BSD[89] (376)
- CentOS[90] (58)
- Cisco[91] (1,927)
- Debian[92] (7,025)
- Fedora[93] (1,693)
- FreeBSD[94] (1,246)
- Gentoo[95] (4,467)
- HPUX[96] (880)
- iOS[97] (373)
- iPhone[98] (108)
- IRIX[99] (220)
- Juniper[100] (69)
- Linux[101] (49,485)
- Mac OS X[102] (691)
- Mandriva[103] (3,105)
- NetBSD[104] (256)
- OpenBSD[105] (488)
- RedHat[106] (15,706)
- Slackware[107] (941)
- Solaris[108] (1,611)
- SUSE[109] (1,444)
- Ubuntu[110] (9,480)
- UNIX[111] (9,394)
- UnixWare[112] (187)
- Windows[113] (6,653)
- Other[114]
- Services
- Security Services[125]
- Hosting By
- Rokasec[126]
Read more https://packetstormsecurity.com/files/178438/USN-6757-2.txt