CLSA-2024-1706700142

    Dashboard / Vulnerabilities / CLSA-2024-1706700142

    CLSA-2024-1706700142

    Published: 31 Jan 2024Last Modified: 1 Jun 2026

    Summary: php: Fix of 8 CVEs

    Details: - CVE-2021-21702: Fix null pointer crash because of malformed SOAP server response - CVE-2021-21703: Fix error in php fpm shared memory organization leading to privilage escalation - CVE-2022-31625: Fix freeing of uninitialized memory leading to RCE - CVE-2022-31626: Fix buffer overflow in mysqlnd driver leading to RCE - CVE-2023-0568: Fix array overrun when appending slash to paths in DOM and XML cases - CVE-2023-0662: Fix DOS vulnerabality by limiting number of parsed multipart body parts and printing upload limit exceed error message only once - CVE-2023-3823: Fix external entity loading in XML without enabling it, by sanitizing libxml2 globals before parsing - CVE-2023-3824: Fix buffer mismanagement in phar_dir_read()

    References: https://errata.tuxcare.com/centos7-els/CLSA-2024-1706700142.html

    Affected packages

    Package

    Name: php

    Purl: pkg:rpm/tuxcare/php?distro=centos-7

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -5.4.16-48.el7.tuxcare.els1

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CLSA-2024-1706700142 | CVE-DB