CLSA-2022-1646085834
See a problem?- Import Source
- https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2022-1646085834.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CLSA-2022-1646085834
- Upstream
- Published
- 2022-02-28T22:03:54Z
- Modified
- 2026-06-04T10:04:43.414745094Z
- Summary
- Fix CVE(s): CVE-2017-9118, CVE-2017-9119, CVE-2017-9120, CVE-2021-21707, CVE-2017-8923, CVE-2015-9253
- Details
-
- SECURITY UPDATE: Denial of service
- debian/patches/CVE-2015-9253-pre1.patch: include .inc files used in fpm tests in sapi/fpm/tests/ alogin with other .phpt test scripts.
- debian/patches/CVE-2015-9253-pre2.patch: close the listening socket on sapi/fpm/fpm/fpm_signals.c and added tests in sapi/fpm/tests/bug77934-reload-process-control.phpt.
- debian/patches/CVE-2015-9253.patch: directly listen on socket, instead of dumping it to STDIN in sapi/fpm/fpm/fpmchildren.c, sapi/fpm/fpmstdio.c, and added tests in sapi/fpm/tests/bug73342-nonblocking-stdio.phpt.
- CVE-2015-9253
- SECURITY UPDATE: Integer overflow
- debian/patches/CVE-2017-8923-pre.patch: added ZSTRMAXLEN macro in Zend/zendstring.h and make use of it in Zend/zendoperators.c instead of using SIZE_MAX.
- debian/patches/CVE-2017-8923.patch: added a length check before calling zendstringrealloc method in Zend/zendvmdef.h and Zend/zendvmexecute.h.
- CVE-2017-8923
- SECURITY UPDATE: Integer overflow
- debian/patches/CVE-2017-9118.patch: added ZSTRMAXOVERHEAD macro in Zend/zendstring.h that has the the maximal overhead of a zendstring and uses it in ext/pcre/phppcre.c to assign a zendstring length value.
- CVE-2017-9118
- SECURITY UPDATE: Use after free
- debian/patches/CVE-2017-9119.patch: changed the decrement of refcount to be made once the string allocation has succeeded in Zend/zend_string.h.
- CVE-2017-9119
- SECURITY UPDATE: Integer overflow
- debian/patches/CVE-2017-9120.patch: changed the string allocation from zendstringalloc to zendstringsafealloc in ext/mysqli/mysqliapi.c.
- CVE-2017-9120
- SECURITY UDPATE: Improper handling of special characters
- debian/patches/CVE-2021-21707.patch: added a string validation to check for improper characters in ext/dom/domimplementation.c and in ext/libxml/libxml.c and added tests in ext/simplexml/tests/bug799711.phpt and ext/dom/tests/bug799712.phpt.
- CVE-2021-21707
- SECURITY UPDATE: Denial of service
- References