An update for php is now available for openEuler-20.03-LTS-SP4,openEuler-22.03-LTS-SP1,openEuler-24.03-LTS,openEuler-22.03-LTS-SP4,openEuler-22.03-LTS-SP3 Security Advisory openeuler-security@openeuler.org openEuler security committee openEuler-SA-2024-2248 Final 1.0 1.0 2024-10-12 Initial 2024-10-12 2024-10-12 openEuler SA Tool V1.0 2024-10-12 php security update An update for php is now available for openEuler-20.03-LTS-SP4,openEuler-22.03-LTS-SP1,openEuler-24.03-LTS,openEuler-22.03-LTS-SP4,openEuler-22.03-LTS-SP3 PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts. %if 1 The php package contains the module (often referred to as mod_php) which adds support for the PHP language to Apache HTTP Server when running in prefork mode. This module is deprecated. %endif Security Fix(es):PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts. The php package contains the module (often referred to as mod_php) which adds support for the PHP language to Apache HTTP Server. Security Fix(es): In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, erroneous parsing of multipart form data contained in an HTTP POST request could lead to legitimate data not being processed. This could lead to malicious attacker able to control part of the submitted data being able to exclude portion of other data, potentially leading to erroneous application behavior.(CVE-2024-8925) In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using a certain non-standard configurations of Windows codepages, the fixes for  CVE-2024-4577 https://github.com/advisories/GHSA-vxpp-6299-mxw3  may still be bypassed and the same command injection related to Windows "Best Fit" codepage behavior can be achieved. This may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.(CVE-2024-8926) In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, HTTP_REDIRECT_STATUS variable is used to check whether or not CGI binary is being run by the HTTP server. However, in certain scenarios, the content of this variable can be controlled by the request submitter via HTTP headers, which can lead to cgi.force_redirect option not being correctly applied. In certain configurations this may lead to arbitrary file inclusion in PHP.(CVE-2024-8927) In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using PHP-FPM SAPI and it is configured to catch workers output through catch_workers_output = yes, it may be possible to pollute the final log or remove up to 4 characters from the log messages by manipulating log message content. Additionally, if PHP-FPM is configured to use syslog output, it may be possible to further remove log data using the same vulnerability.(CVE-2024-9026) An update for php is now available for openEuler-20.03-LTS-SP4,openEuler-22.03-LTS-SP1,openEuler-24.03-LTS,openEuler-22.03-LTS-SP4,openEuler-22.03-LTS-SP3. openEuler Security has rated this update as having a security impact of high. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section. High php https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2248 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2024-8925 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2024-8926 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2024-8927 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2024-9026 https://nvd.nist.gov/vuln/detail/CVE-2024-8925 https://nvd.nist.gov/vuln/detail/CVE-2024-8926 https://nvd.nist.gov/vuln/detail/CVE-2024-8927 https://nvd.nist.gov/vuln/detail/CVE-2024-9026 openEuler-20.03-LTS-SP4 openEuler-22.03-LTS-SP1 openEuler-24.03-LTS openEuler-22.03-LTS-SP4 openEuler-22.03-LTS-SP3 php-8.0.30-6.oe2003sp4.aarch64.rpm php-bcmath-8.0.30-6.oe2003sp4.aarch64.rpm php-cli-8.0.30-6.oe2003sp4.aarch64.rpm php-common-8.0.30-6.oe2003sp4.aarch64.rpm php-dba-8.0.30-6.oe2003sp4.aarch64.rpm php-dbg-8.0.30-6.oe2003sp4.aarch64.rpm php-debuginfo-8.0.30-6.oe2003sp4.aarch64.rpm php-debugsource-8.0.30-6.oe2003sp4.aarch64.rpm php-devel-8.0.30-6.oe2003sp4.aarch64.rpm php-embedded-8.0.30-6.oe2003sp4.aarch64.rpm php-enchant-8.0.30-6.oe2003sp4.aarch64.rpm php-ffi-8.0.30-6.oe2003sp4.aarch64.rpm php-fpm-8.0.30-6.oe2003sp4.aarch64.rpm php-gd-8.0.30-6.oe2003sp4.aarch64.rpm php-gmp-8.0.30-6.oe2003sp4.aarch64.rpm php-help-8.0.30-6.oe2003sp4.aarch64.rpm php-intl-8.0.30-6.oe2003sp4.aarch64.rpm php-ldap-8.0.30-6.oe2003sp4.aarch64.rpm php-mbstring-8.0.30-6.oe2003sp4.aarch64.rpm php-mysqlnd-8.0.30-6.oe2003sp4.aarch64.rpm php-odbc-8.0.30-6.oe2003sp4.aarch64.rpm php-opcache-8.0.30-6.oe2003sp4.aarch64.rpm php-pdo-8.0.30-6.oe2003sp4.aarch64.rpm php-pgsql-8.0.30-6.oe2003sp4.aarch64.rpm php-process-8.0.30-6.oe2003sp4.aarch64.rpm php-snmp-8.0.30-6.oe2003sp4.aarch64.rpm php-soap-8.0.30-6.oe2003sp4.aarch64.rpm php-sodium-8.0.30-6.oe2003sp4.aarch64.rpm php-tidy-8.0.30-6.oe2003sp4.aarch64.rpm php-xml-8.0.30-6.oe2003sp4.aarch64.rpm php-8.0.30-6.oe2203sp1.aarch64.rpm php-bcmath-8.0.30-6.oe2203sp1.aarch64.rpm php-cli-8.0.30-6.oe2203sp1.aarch64.rpm php-common-8.0.30-6.oe2203sp1.aarch64.rpm php-dba-8.0.30-6.oe2203sp1.aarch64.rpm php-dbg-8.0.30-6.oe2203sp1.aarch64.rpm php-debuginfo-8.0.30-6.oe2203sp1.aarch64.rpm php-debugsource-8.0.30-6.oe2203sp1.aarch64.rpm php-devel-8.0.30-6.oe2203sp1.aarch64.rpm php-embedded-8.0.30-6.oe2203sp1.aarch64.rpm php-enchant-8.0.30-6.oe2203sp1.aarch64.rpm php-ffi-8.0.30-6.oe2203sp1.aarch64.rpm php-fpm-8.0.30-6.oe2203sp1.aarch64.rpm php-gd-8.0.30-6.oe2203sp1.aarch64.rpm php-gmp-8.0.30-6.oe2203sp1.aarch64.rpm php-help-8.0.30-6.oe2203sp1.aarch64.rpm php-intl-8.0.30-6.oe2203sp1.aarch64.rpm php-ldap-8.0.30-6.oe2203sp1.aarch64.rpm php-mbstring-8.0.30-6.oe2203sp1.aarch64.rpm php-mysqlnd-8.0.30-6.oe2203sp1.aarch64.rpm php-odbc-8.0.30-6.oe2203sp1.aarch64.rpm php-opcache-8.0.30-6.oe2203sp1.aarch64.rpm php-pdo-8.0.30-6.oe2203sp1.aarch64.rpm php-pgsql-8.0.30-6.oe2203sp1.aarch64.rpm php-process-8.0.30-6.oe2203sp1.aarch64.rpm php-snmp-8.0.30-6.oe2203sp1.aarch64.rpm php-soap-8.0.30-6.oe2203sp1.aarch64.rpm php-sodium-8.0.30-6.oe2203sp1.aarch64.rpm php-tidy-8.0.30-6.oe2203sp1.aarch64.rpm php-xml-8.0.30-6.oe2203sp1.aarch64.rpm php-8.3.12-1.oe2403.aarch64.rpm php-bcmath-8.3.12-1.oe2403.aarch64.rpm php-cli-8.3.12-1.oe2403.aarch64.rpm php-common-8.3.12-1.oe2403.aarch64.rpm php-dba-8.3.12-1.oe2403.aarch64.rpm php-dbg-8.3.12-1.oe2403.aarch64.rpm php-debuginfo-8.3.12-1.oe2403.aarch64.rpm php-debugsource-8.3.12-1.oe2403.aarch64.rpm php-devel-8.3.12-1.oe2403.aarch64.rpm php-embedded-8.3.12-1.oe2403.aarch64.rpm php-enchant-8.3.12-1.oe2403.aarch64.rpm php-ffi-8.3.12-1.oe2403.aarch64.rpm php-fpm-8.3.12-1.oe2403.aarch64.rpm php-gd-8.3.12-1.oe2403.aarch64.rpm php-gmp-8.3.12-1.oe2403.aarch64.rpm php-help-8.3.12-1.oe2403.aarch64.rpm php-intl-8.3.12-1.oe2403.aarch64.rpm php-ldap-8.3.12-1.oe2403.aarch64.rpm php-mbstring-8.3.12-1.oe2403.aarch64.rpm php-mysqlnd-8.3.12-1.oe2403.aarch64.rpm php-odbc-8.3.12-1.oe2403.aarch64.rpm php-opcache-8.3.12-1.oe2403.aarch64.rpm php-pdo-8.3.12-1.oe2403.aarch64.rpm php-pgsql-8.3.12-1.oe2403.aarch64.rpm php-process-8.3.12-1.oe2403.aarch64.rpm php-snmp-8.3.12-1.oe2403.aarch64.rpm php-soap-8.3.12-1.oe2403.aarch64.rpm php-sodium-8.3.12-1.oe2403.aarch64.rpm php-tidy-8.3.12-1.oe2403.aarch64.rpm php-xml-8.3.12-1.oe2403.aarch64.rpm php-8.0.30-6.oe2203sp4.aarch64.rpm php-bcmath-8.0.30-6.oe2203sp4.aarch64.rpm php-cli-8.0.30-6.oe2203sp4.aarch64.rpm php-common-8.0.30-6.oe2203sp4.aarch64.rpm php-dba-8.0.30-6.oe2203sp4.aarch64.rpm php-dbg-8.0.30-6.oe2203sp4.aarch64.rpm php-debuginfo-8.0.30-6.oe2203sp4.aarch64.rpm php-debugsource-8.0.30-6.oe2203sp4.aarch64.rpm php-devel-8.0.30-6.oe2203sp4.aarch64.rpm php-embedded-8.0.30-6.oe2203sp4.aarch64.rpm php-enchant-8.0.30-6.oe2203sp4.aarch64.rpm php-ffi-8.0.30-6.oe2203sp4.aarch64.rpm php-fpm-8.0.30-6.oe2203sp4.aarch64.rpm php-gd-8.0.30-6.oe2203sp4.aarch64.rpm php-gmp-8.0.30-6.oe2203sp4.aarch64.rpm php-help-8.0.30-6.oe2203sp4.aarch64.rpm php-intl-8.0.30-6.oe2203sp4.aarch64.rpm php-ldap-8.0.30-6.oe2203sp4.aarch64.rpm php-mbstring-8.0.30-6.oe2203sp4.aarch64.rpm php-mysqlnd-8.0.30-6.oe2203sp4.aarch64.rpm php-odbc-8.0.30-6.oe2203sp4.aarch64.rpm php-opcache-8.0.30-6.oe2203sp4.aarch64.rpm php-pdo-8.0.30-6.oe2203sp4.aarch64.rpm php-pgsql-8.0.30-6.oe2203sp4.aarch64.rpm php-process-8.0.30-6.oe2203sp4.aarch64.rpm php-snmp-8.0.30-6.oe2203sp4.aarch64.rpm php-soap-8.0.30-6.oe2203sp4.aarch64.rpm php-sodium-8.0.30-6.oe2203sp4.aarch64.rpm php-tidy-8.0.30-6.oe2203sp4.aarch64.rpm php-xml-8.0.30-6.oe2203sp4.aarch64.rpm php-8.0.30-6.oe2203sp3.aarch64.rpm php-bcmath-8.0.30-6.oe2203sp3.aarch64.rpm php-cli-8.0.30-6.oe2203sp3.aarch64.rpm php-common-8.0.30-6.oe2203sp3.aarch64.rpm php-dba-8.0.30-6.oe2203sp3.aarch64.rpm php-dbg-8.0.30-6.oe2203sp3.aarch64.rpm php-debuginfo-8.0.30-6.oe2203sp3.aarch64.rpm php-debugsource-8.0.30-6.oe2203sp3.aarch64.rpm php-devel-8.0.30-6.oe2203sp3.aarch64.rpm php-embedded-8.0.30-6.oe2203sp3.aarch64.rpm php-enchant-8.0.30-6.oe2203sp3.aarch64.rpm php-ffi-8.0.30-6.oe2203sp3.aarch64.rpm php-fpm-8.0.30-6.oe2203sp3.aarch64.rpm php-gd-8.0.30-6.oe2203sp3.aarch64.rpm php-gmp-8.0.30-6.oe2203sp3.aarch64.rpm php-help-8.0.30-6.oe2203sp3.aarch64.rpm php-intl-8.0.30-6.oe2203sp3.aarch64.rpm php-ldap-8.0.30-6.oe2203sp3.aarch64.rpm php-mbstring-8.0.30-6.oe2203sp3.aarch64.rpm php-mysqlnd-8.0.30-6.oe2203sp3.aarch64.rpm php-odbc-8.0.30-6.oe2203sp3.aarch64.rpm php-opcache-8.0.30-6.oe2203sp3.aarch64.rpm php-pdo-8.0.30-6.oe2203sp3.aarch64.rpm php-pgsql-8.0.30-6.oe2203sp3.aarch64.rpm php-process-8.0.30-6.oe2203sp3.aarch64.rpm php-snmp-8.0.30-6.oe2203sp3.aarch64.rpm php-soap-8.0.30-6.oe2203sp3.aarch64.rpm php-sodium-8.0.30-6.oe2203sp3.aarch64.rpm php-tidy-8.0.30-6.oe2203sp3.aarch64.rpm php-xml-8.0.30-6.oe2203sp3.aarch64.rpm php-8.0.30-6.oe2003sp4.src.rpm php-8.0.30-6.oe2203sp1.src.rpm php-8.3.12-1.oe2403.src.rpm php-8.0.30-6.oe2203sp4.src.rpm php-8.0.30-6.oe2203sp3.src.rpm php-8.0.30-6.oe2003sp4.x86_64.rpm php-bcmath-8.0.30-6.oe2003sp4.x86_64.rpm php-cli-8.0.30-6.oe2003sp4.x86_64.rpm php-common-8.0.30-6.oe2003sp4.x86_64.rpm php-dba-8.0.30-6.oe2003sp4.x86_64.rpm php-dbg-8.0.30-6.oe2003sp4.x86_64.rpm php-debuginfo-8.0.30-6.oe2003sp4.x86_64.rpm php-debugsource-8.0.30-6.oe2003sp4.x86_64.rpm php-devel-8.0.30-6.oe2003sp4.x86_64.rpm php-embedded-8.0.30-6.oe2003sp4.x86_64.rpm php-enchant-8.0.30-6.oe2003sp4.x86_64.rpm php-ffi-8.0.30-6.oe2003sp4.x86_64.rpm php-fpm-8.0.30-6.oe2003sp4.x86_64.rpm php-gd-8.0.30-6.oe2003sp4.x86_64.rpm php-gmp-8.0.30-6.oe2003sp4.x86_64.rpm php-help-8.0.30-6.oe2003sp4.x86_64.rpm php-intl-8.0.30-6.oe2003sp4.x86_64.rpm php-ldap-8.0.30-6.oe2003sp4.x86_64.rpm php-mbstring-8.0.30-6.oe2003sp4.x86_64.rpm php-mysqlnd-8.0.30-6.oe2003sp4.x86_64.rpm php-odbc-8.0.30-6.oe2003sp4.x86_64.rpm php-opcache-8.0.30-6.oe2003sp4.x86_64.rpm php-pdo-8.0.30-6.oe2003sp4.x86_64.rpm php-pgsql-8.0.30-6.oe2003sp4.x86_64.rpm php-process-8.0.30-6.oe2003sp4.x86_64.rpm php-snmp-8.0.30-6.oe2003sp4.x86_64.rpm php-soap-8.0.30-6.oe2003sp4.x86_64.rpm php-sodium-8.0.30-6.oe2003sp4.x86_64.rpm php-tidy-8.0.30-6.oe2003sp4.x86_64.rpm php-xml-8.0.30-6.oe2003sp4.x86_64.rpm php-8.0.30-6.oe2203sp1.x86_64.rpm php-bcmath-8.0.30-6.oe2203sp1.x86_64.rpm php-cli-8.0.30-6.oe2203sp1.x86_64.rpm php-common-8.0.30-6.oe2203sp1.x86_64.rpm php-dba-8.0.30-6.oe2203sp1.x86_64.rpm php-dbg-8.0.30-6.oe2203sp1.x86_64.rpm php-debuginfo-8.0.30-6.oe2203sp1.x86_64.rpm php-debugsource-8.0.30-6.oe2203sp1.x86_64.rpm php-devel-8.0.30-6.oe2203sp1.x86_64.rpm php-embedded-8.0.30-6.oe2203sp1.x86_64.rpm php-enchant-8.0.30-6.oe2203sp1.x86_64.rpm php-ffi-8.0.30-6.oe2203sp1.x86_64.rpm php-fpm-8.0.30-6.oe2203sp1.x86_64.rpm php-gd-8.0.30-6.oe2203sp1.x86_64.rpm php-gmp-8.0.30-6.oe2203sp1.x86_64.rpm php-help-8.0.30-6.oe2203sp1.x86_64.rpm php-intl-8.0.30-6.oe2203sp1.x86_64.rpm php-ldap-8.0.30-6.oe2203sp1.x86_64.rpm php-mbstring-8.0.30-6.oe2203sp1.x86_64.rpm php-mysqlnd-8.0.30-6.oe2203sp1.x86_64.rpm php-odbc-8.0.30-6.oe2203sp1.x86_64.rpm php-opcache-8.0.30-6.oe2203sp1.x86_64.rpm php-pdo-8.0.30-6.oe2203sp1.x86_64.rpm php-pgsql-8.0.30-6.oe2203sp1.x86_64.rpm php-process-8.0.30-6.oe2203sp1.x86_64.rpm php-snmp-8.0.30-6.oe2203sp1.x86_64.rpm php-soap-8.0.30-6.oe2203sp1.x86_64.rpm php-sodium-8.0.30-6.oe2203sp1.x86_64.rpm php-tidy-8.0.30-6.oe2203sp1.x86_64.rpm php-xml-8.0.30-6.oe2203sp1.x86_64.rpm php-8.3.12-1.oe2403.x86_64.rpm php-bcmath-8.3.12-1.oe2403.x86_64.rpm php-cli-8.3.12-1.oe2403.x86_64.rpm php-common-8.3.12-1.oe2403.x86_64.rpm php-dba-8.3.12-1.oe2403.x86_64.rpm php-dbg-8.3.12-1.oe2403.x86_64.rpm php-debuginfo-8.3.12-1.oe2403.x86_64.rpm php-debugsource-8.3.12-1.oe2403.x86_64.rpm php-devel-8.3.12-1.oe2403.x86_64.rpm php-embedded-8.3.12-1.oe2403.x86_64.rpm php-enchant-8.3.12-1.oe2403.x86_64.rpm php-ffi-8.3.12-1.oe2403.x86_64.rpm php-fpm-8.3.12-1.oe2403.x86_64.rpm php-gd-8.3.12-1.oe2403.x86_64.rpm php-gmp-8.3.12-1.oe2403.x86_64.rpm php-help-8.3.12-1.oe2403.x86_64.rpm php-intl-8.3.12-1.oe2403.x86_64.rpm php-ldap-8.3.12-1.oe2403.x86_64.rpm php-mbstring-8.3.12-1.oe2403.x86_64.rpm php-mysqlnd-8.3.12-1.oe2403.x86_64.rpm php-odbc-8.3.12-1.oe2403.x86_64.rpm php-opcache-8.3.12-1.oe2403.x86_64.rpm php-pdo-8.3.12-1.oe2403.x86_64.rpm php-pgsql-8.3.12-1.oe2403.x86_64.rpm php-process-8.3.12-1.oe2403.x86_64.rpm php-snmp-8.3.12-1.oe2403.x86_64.rpm php-soap-8.3.12-1.oe2403.x86_64.rpm php-sodium-8.3.12-1.oe2403.x86_64.rpm php-tidy-8.3.12-1.oe2403.x86_64.rpm php-xml-8.3.12-1.oe2403.x86_64.rpm php-8.0.30-6.oe2203sp4.x86_64.rpm php-bcmath-8.0.30-6.oe2203sp4.x86_64.rpm php-cli-8.0.30-6.oe2203sp4.x86_64.rpm php-common-8.0.30-6.oe2203sp4.x86_64.rpm php-dba-8.0.30-6.oe2203sp4.x86_64.rpm php-dbg-8.0.30-6.oe2203sp4.x86_64.rpm php-debuginfo-8.0.30-6.oe2203sp4.x86_64.rpm php-debugsource-8.0.30-6.oe2203sp4.x86_64.rpm php-devel-8.0.30-6.oe2203sp4.x86_64.rpm php-embedded-8.0.30-6.oe2203sp4.x86_64.rpm php-enchant-8.0.30-6.oe2203sp4.x86_64.rpm php-ffi-8.0.30-6.oe2203sp4.x86_64.rpm php-fpm-8.0.30-6.oe2203sp4.x86_64.rpm php-gd-8.0.30-6.oe2203sp4.x86_64.rpm php-gmp-8.0.30-6.oe2203sp4.x86_64.rpm php-help-8.0.30-6.oe2203sp4.x86_64.rpm php-intl-8.0.30-6.oe2203sp4.x86_64.rpm php-ldap-8.0.30-6.oe2203sp4.x86_64.rpm php-mbstring-8.0.30-6.oe2203sp4.x86_64.rpm php-mysqlnd-8.0.30-6.oe2203sp4.x86_64.rpm php-odbc-8.0.30-6.oe2203sp4.x86_64.rpm php-opcache-8.0.30-6.oe2203sp4.x86_64.rpm php-pdo-8.0.30-6.oe2203sp4.x86_64.rpm php-pgsql-8.0.30-6.oe2203sp4.x86_64.rpm php-process-8.0.30-6.oe2203sp4.x86_64.rpm php-snmp-8.0.30-6.oe2203sp4.x86_64.rpm php-soap-8.0.30-6.oe2203sp4.x86_64.rpm php-sodium-8.0.30-6.oe2203sp4.x86_64.rpm php-tidy-8.0.30-6.oe2203sp4.x86_64.rpm php-xml-8.0.30-6.oe2203sp4.x86_64.rpm php-8.0.30-6.oe2203sp3.x86_64.rpm php-bcmath-8.0.30-6.oe2203sp3.x86_64.rpm php-cli-8.0.30-6.oe2203sp3.x86_64.rpm php-common-8.0.30-6.oe2203sp3.x86_64.rpm php-dba-8.0.30-6.oe2203sp3.x86_64.rpm php-dbg-8.0.30-6.oe2203sp3.x86_64.rpm php-debuginfo-8.0.30-6.oe2203sp3.x86_64.rpm php-debugsource-8.0.30-6.oe2203sp3.x86_64.rpm php-devel-8.0.30-6.oe2203sp3.x86_64.rpm php-embedded-8.0.30-6.oe2203sp3.x86_64.rpm php-enchant-8.0.30-6.oe2203sp3.x86_64.rpm php-ffi-8.0.30-6.oe2203sp3.x86_64.rpm php-fpm-8.0.30-6.oe2203sp3.x86_64.rpm php-gd-8.0.30-6.oe2203sp3.x86_64.rpm php-gmp-8.0.30-6.oe2203sp3.x86_64.rpm php-help-8.0.30-6.oe2203sp3.x86_64.rpm php-intl-8.0.30-6.oe2203sp3.x86_64.rpm php-ldap-8.0.30-6.oe2203sp3.x86_64.rpm php-mbstring-8.0.30-6.oe2203sp3.x86_64.rpm php-mysqlnd-8.0.30-6.oe2203sp3.x86_64.rpm php-odbc-8.0.30-6.oe2203sp3.x86_64.rpm php-opcache-8.0.30-6.oe2203sp3.x86_64.rpm php-pdo-8.0.30-6.oe2203sp3.x86_64.rpm php-pgsql-8.0.30-6.oe2203sp3.x86_64.rpm php-process-8.0.30-6.oe2203sp3.x86_64.rpm php-snmp-8.0.30-6.oe2203sp3.x86_64.rpm php-soap-8.0.30-6.oe2203sp3.x86_64.rpm php-sodium-8.0.30-6.oe2203sp3.x86_64.rpm php-tidy-8.0.30-6.oe2203sp3.x86_64.rpm php-xml-8.0.30-6.oe2203sp3.x86_64.rpm In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, erroneous parsing of multipart form data contained in an HTTP POST request could lead to legitimate data not being processed. This could lead to malicious attacker able to control part of the submitted data being able to exclude portion of other data, potentially leading to erroneous application behavior. 2024-10-12 CVE-2024-8925 openEuler-20.03-LTS-SP4 openEuler-22.03-LTS-SP1 openEuler-24.03-LTS openEuler-22.03-LTS-SP4 openEuler-22.03-LTS-SP3 Low 3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N php security update 2024-10-12 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2248 In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using a certain non-standard configurations of Windows codepages, the fixes for  CVE-2024-4577 https://github.com/advisories/GHSA-vxpp-6299-mxw3  may still be bypassed and the same command injection related to Windows "Best Fit" codepage behavior can be achieved. This may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc. 2024-10-12 CVE-2024-8926 openEuler-20.03-LTS-SP4 openEuler-22.03-LTS-SP1 openEuler-24.03-LTS openEuler-22.03-LTS-SP4 openEuler-22.03-LTS-SP3 High 8.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H php security update 2024-10-12 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2248 In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, HTTP_REDIRECT_STATUS variable is used to check whether or not CGI binary is being run by the HTTP server. However, in certain scenarios, the content of this variable can be controlled by the request submitter via HTTP headers, which can lead to cgi.force_redirect option not being correctly applied. In certain configurations this may lead to arbitrary file inclusion in PHP. 2024-10-12 CVE-2024-8927 openEuler-20.03-LTS-SP4 openEuler-22.03-LTS-SP1 openEuler-24.03-LTS openEuler-22.03-LTS-SP4 openEuler-22.03-LTS-SP3 Medium 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N php security update 2024-10-12 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2248 In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using PHP-FPM SAPI and it is configured to catch workers output through catch_workers_output = yes, it may be possible to pollute the final log or remove up to 4 characters from the log messages by manipulating log message content. Additionally, if PHP-FPM is configured to use syslog output, it may be possible to further remove log data using the same vulnerability. 2024-10-12 CVE-2024-9026 openEuler-20.03-LTS-SP4 openEuler-22.03-LTS-SP1 openEuler-24.03-LTS openEuler-22.03-LTS-SP4 openEuler-22.03-LTS-SP3 Low 3.3 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N php security update 2024-10-12 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2248