1. Ubuntu Security Notices
  2. USN-5905-1

USN-5905-1: PHP vulnerabilities

Publication date

2 March 2023

Overview

Several security issues were fixed in PHP.

Releases

Packages

  • php7.0 - HTML-embedded scripting language interpreter

Details

It was discovered that PHP incorrectly handled certain gzip files.
An attacker could possibly use this issue to cause a denial of service.
(CVE-2022-31628)

It was discovered that PHP incorrectly handled certain cookies.
An attacker could possibly use this issue to compromise data integrity.
(CVE-2022-31629)

It was discovered that PHP incorrectly handled certain inputs.
An attacker could possibly use this issue to cause a crash or
execute arbitrary code. (CVE-2022-31631)

It was discovered that PHP incorrectly handled resolving long paths. A
remote attacker could possibly use this issue to obtain or modify sensitive
information. (CVE-2023-0568)

It was discovered that PHP incorrectly handled a large number of field and file
parts in HTTP form uploads. A remote...

It was discovered that PHP incorrectly handled certain gzip files.
An attacker could possibly use this issue to cause a denial of service.
(CVE-2022-31628)

It was discovered that PHP incorrectly handled certain cookies.
An attacker could possibly use this issue to compromise data integrity.
(CVE-2022-31629)

It was discovered that PHP incorrectly handled certain inputs.
An attacker could possibly use this issue to cause a crash or
execute arbitrary code. (CVE-2022-31631)

It was discovered that PHP incorrectly handled resolving long paths. A
remote attacker could possibly use this issue to obtain or modify sensitive
information. (CVE-2023-0568)

It was discovered that PHP incorrectly handled a large number of field and file
parts in HTTP form uploads. A remote attacker could possibly use this issue to
cause PHP to consume resources, leading to a denial of service. (CVE-2023-0662)

Update instructions

In general, a standard system update will make all the necessary changes.

Learn more about how to get the fixes.

The problem can be corrected by updating your system to the following package versions:

Ubuntu Release Package Version
16.04 xenial php7.0-cgi –  7.0.33-0ubuntu0.16.04.16+esm5  
php7.0-fpm –  7.0.33-0ubuntu0.16.04.16+esm5  
php7.0-cli –  7.0.33-0ubuntu0.16.04.16+esm5  
php7.0-sqlite3 –  7.0.33-0ubuntu0.16.04.16+esm5  
libapache2-mod-php7.0 –  7.0.33-0ubuntu0.16.04.16+esm5  
php7.0-zip –  7.0.33-0ubuntu0.16.04.16+esm5  
php7.0 –  7.0.33-0ubuntu0.16.04.16+esm5  

Reduce your security exposure

Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

Get Ubuntu Pro

References

Have additional questions?

Talk to a member of the team ›