Описание
Security update for php74
This update for php74 fixes the following issues:
- CVE-2021-21707: Fixed special character breaks path in xml parsing (bsc#1193041).
Список пакетов
SUSE Linux Enterprise Module for Web and Scripting 12
apache2-mod_php74-7.4.6-1.30.1
php74-7.4.6-1.30.1
php74-bcmath-7.4.6-1.30.1
php74-bz2-7.4.6-1.30.1
php74-calendar-7.4.6-1.30.1
php74-ctype-7.4.6-1.30.1
php74-curl-7.4.6-1.30.1
php74-dba-7.4.6-1.30.1
php74-dom-7.4.6-1.30.1
php74-enchant-7.4.6-1.30.1
php74-exif-7.4.6-1.30.1
php74-fastcgi-7.4.6-1.30.1
php74-fileinfo-7.4.6-1.30.1
php74-fpm-7.4.6-1.30.1
php74-ftp-7.4.6-1.30.1
php74-gd-7.4.6-1.30.1
php74-gettext-7.4.6-1.30.1
php74-gmp-7.4.6-1.30.1
php74-iconv-7.4.6-1.30.1
php74-intl-7.4.6-1.30.1
php74-json-7.4.6-1.30.1
php74-ldap-7.4.6-1.30.1
php74-mbstring-7.4.6-1.30.1
php74-mysql-7.4.6-1.30.1
php74-odbc-7.4.6-1.30.1
php74-opcache-7.4.6-1.30.1
php74-openssl-7.4.6-1.30.1
php74-pcntl-7.4.6-1.30.1
php74-pdo-7.4.6-1.30.1
php74-pgsql-7.4.6-1.30.1
php74-phar-7.4.6-1.30.1
php74-posix-7.4.6-1.30.1
php74-readline-7.4.6-1.30.1
php74-shmop-7.4.6-1.30.1
php74-snmp-7.4.6-1.30.1
php74-soap-7.4.6-1.30.1
php74-sockets-7.4.6-1.30.1
php74-sodium-7.4.6-1.30.1
php74-sqlite-7.4.6-1.30.1
php74-sysvmsg-7.4.6-1.30.1
php74-sysvsem-7.4.6-1.30.1
php74-sysvshm-7.4.6-1.30.1
php74-tidy-7.4.6-1.30.1
php74-tokenizer-7.4.6-1.30.1
php74-xmlreader-7.4.6-1.30.1
php74-xmlrpc-7.4.6-1.30.1
php74-xmlwriter-7.4.6-1.30.1
php74-xsl-7.4.6-1.30.1
php74-zip-7.4.6-1.30.1
php74-zlib-7.4.6-1.30.1
SUSE Linux Enterprise Software Development Kit 12 SP5
php74-devel-7.4.6-1.30.1
Ссылки
- Link for SUSE-SU-2021:3927-1
- E-Mail link for SUSE-SU-2021:3927-1
- SUSE Security Ratings
- SUSE Bug 1193041
- SUSE CVE CVE-2021-21707 page
Описание
In PHP versions 7.3.x below 7.3.33, 7.4.x below 7.4.26 and 8.0.x below 8.0.13, certain XML parsing functions, like simplexml_load_file(), URL-decode the filename passed to them. If that filename contains URL-encoded NUL character, this may cause the function to interpret this as the end of the filename, thus interpreting the filename differently from what the user intended, which may lead it to reading a different file than intended.
Затронутые продукты
SUSE Linux Enterprise Module for Web and Scripting 12:apache2-mod_php74-7.4.6-1.30.1
SUSE Linux Enterprise Module for Web and Scripting 12:php74-7.4.6-1.30.1
SUSE Linux Enterprise Module for Web and Scripting 12:php74-bcmath-7.4.6-1.30.1
SUSE Linux Enterprise Module for Web and Scripting 12:php74-bz2-7.4.6-1.30.1
Ссылки
- CVE-2021-21707
- SUSE Bug 1193041