CLSA-2022-1646085834
See a problem?- Import Source
- https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2022-1646085834.json
- JSON Data
- https://api.osv.dev/v1/vulns/CLSA-2022-1646085834
- Upstream
- Published
- 2022-02-28T22:03:54Z
- Modified
- 2026-06-04T10:04:26Z
- Summary
- Fix CVE(s): CVE-2017-9118, CVE-2017-9119, CVE-2017-9120, CVE-2021-21707, CVE-2017-8923, CVE-2015-9253
- Details
-
- SECURITY UPDATE: Denial of service
- debian/patches/CVE-2015-9253-pre1.patch: include .inc files used in fpm tests in sapi/fpm/tests/ alogin with other .phpt test scripts.
- debian/patches/CVE-2015-9253-pre2.patch: close the listening socket on sapi/fpm/fpm/fpm_signals.c and added tests in sapi/fpm/tests/bug77934-reload-process-control.phpt.
- debian/patches/CVE-2015-9253.patch: directly listen on socket, instead of dumping it to STDIN in sapi/fpm/fpm/fpm_children.c, sapi/fpm/fpm_stdio.c, and added tests in sapi/fpm/tests/bug73342-nonblocking-stdio.phpt.
- CVE-2015-9253
- SECURITY UPDATE: Integer overflow
- debian/patches/CVE-2017-8923-pre.patch: added ZSTR_MAX_LEN macro in Zend/zend_string.h and make use of it in Zend/zend_operators.c instead of using SIZE_MAX.
- debian/patches/CVE-2017-8923.patch: added a length check before calling zend_string_realloc method in Zend/zend_vm_def.h and Zend/zend_vm_execute.h.
- CVE-2017-8923
- SECURITY UPDATE: Integer overflow
- debian/patches/CVE-2017-9118.patch: added ZSTR_MAX_OVERHEAD macro in Zend/zend_string.h that has the the maximal overhead of a zend_string and uses it in ext/pcre/php_pcre.c to assign a zend_string length value.
- CVE-2017-9118
- SECURITY UPDATE: Use after free
- debian/patches/CVE-2017-9119.patch: changed the decrement of refcount to be made once the string allocation has succeeded in Zend/zend_string.h.
- CVE-2017-9119
- SECURITY UPDATE: Integer overflow
- debian/patches/CVE-2017-9120.patch: changed the string allocation from zend_string_alloc to zend_string_safe_alloc in ext/mysqli/mysqli_api.c.
- CVE-2017-9120
- SECURITY UDPATE: Improper handling of special characters
- debian/patches/CVE-2021-21707.patch: added a string validation to check for improper characters in ext/dom/domimplementation.c and in ext/libxml/libxml.c and added tests in ext/simplexml/tests/bug79971_1.phpt and ext/dom/tests/bug79971_2.phpt.
- CVE-2021-21707
- SECURITY UPDATE: Denial of service
- References