MGASA-2024-0132

Advisory lineage Upstream: 3 Downstream: 0
Published: 13 Apr 2024, 16:56
Last modified:16 Apr 2026, 04:43

Vulnerability Summary

Overall Risk (default)
minimal
0/100
CVSS Score
No data
EPSS Score
No data
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

13 Apr 2024, 16:56
Published
Vulnerability first disclosed
16 Apr 2026, 04:43
Last Modified
Vulnerability information updated

Description

Updated php packages fix security vulnerabilities Core: - Corrupted memory in destructor with weak references - GC does not scale well with a lot of objects created in destructor DOM: - Add some missing ZPP checks. - Fix potential memory leak in XPath evaluation results. FPM: - Fix incorrect check in fpm_shm_free(). Gettext: - Fixed sigabrt raised with dcgettext/dcngettext calls with gettext 0.22.5 with category set to LC_ALL. MySQLnd: - Fixed handshake response [mysqlnd] - Fix incorrect charset length in check_mb_eucjpms(). Opcache: - JITed QM_ASSIGN may be optimized out when op1 is null - Segmentation fault for enabled observers when calling trait method of internal trait when opcache is loaded PDO: - Fix various PDORow bugs. Random: - Pre-PHP 8.2 compatibility for mt_srand with unknown modes - Global Mt19937 is not properly reset in-between requests when MT_RAND_PHP is used Session: - Segfault with session_decode and compilation error Sockets: - socket_getsockname returns random characters in the end of the socket name SPL: - Unable to resize SplfixedArray after being unserialized in PHP 8.2.15 - Unexpected null pointer in zend_string.h Standard: - Added validation of `\n` in $additional_headers of mail() - Command injection via array-ish $command parameter of proc_open). (CVE-2024-1874) Fixed bug GHSA-wpj3-hf5j-x4v4 (__Host-/__Secure- cookie bypass due to partial CVE-2022-31629 fix). (CVE-2024-2756) - password_verify can erroneously return true, opening ATO risk. (CVE-2024-3096)

Affected Systems

  • mageia•php

    < 8.2.18-1.mga9

References (3)