In PHP versions 7.3.x below 7.3.33, 7.4.x below 7.4.26 and 8.0.x below 8.0.13, certain XML parsing functions, like simplexml_load_file(), URL-decode the filename passed to them. If that filename contains URL-encoded NUL character, this may cause the function to interpret this as the end of the filename, thus interpreting the filename differently from what the user intended, which may lead it to reading a different file than intended.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade php-embeddedUpgrade php-pdoUpgrade php-gmpUpgrade php-jsonUpgrade php-ldapUpgrade php-fpmUpgrade php-pecl-xdebugUpgrade php-pecl-zipUpgrade php-dbgUpgrade php-commonUpgrade php-develUpgrade libzipUpgrade php-cliUpgrade php-pecl-apcuUpgrade php-xmlUpgrade php-odbcUpgrade php-enchantUpgrade php-pecl-apcu-develUpgrade php-pearUpgrade php-bcmathUpgrade php-gdUpgrade libzip-develUpgrade php-opcacheUpgrade php-dbaUpgrade php-ffiUpgrade php-xmlrpcUpgrade php-mbstringUpgrade phpUpgrade php-mysqlndUpgrade php-soapUpgrade php-pgsqlUpgrade apcu-panelUpgrade php-intlUpgrade php-processUpgrade libzip-toolsUpgrade php-snmpUpgrade php-pecl-rrd | Nov 14, 2022 | Nov 29, 2021 |
| Alpine Linux | — | Upgrade php8Upgrade php81Upgrade php7 | Aug 22, 2024 | Nov 29, 2021 |
| Amazon Linux Ami 2 | — | Upgrade php-dbaUpgrade php-dbgUpgrade php-ldapUpgrade php-gmpUpgrade php-gdUpgrade php-pgsqlUpgrade php-odbcUpgrade php-commonUpgrade php-sodiumUpgrade php-soapUpgrade php-intlUpgrade php-processUpgrade phpUpgrade php-debuginfoUpgrade php-pspellUpgrade php-xmlUpgrade php-enchantUpgrade php-embeddedUpgrade php-mysqlndUpgrade php-bcmathUpgrade php-mbstringUpgrade php-cliUpgrade php-pdoUpgrade php-snmpUpgrade php-develUpgrade php-opcacheUpgrade php-fpm | Sep 14, 2023 | Nov 29, 2021 |
| Centos_linux | — | Upgrade php-intlUpgrade php-pdo-debuginfoUpgrade php-ffiUpgrade php-embeddedUpgrade php-dba-debuginfoUpgrade php-soapUpgrade apcu-panelUpgrade php-common-debuginfoUpgrade php-soap-debuginfoUpgrade php-embedded-debuginfoUpgrade php-pgsqlUpgrade libzip-debugsourceUpgrade php-cli-debuginfoUpgrade php-mbstring-debuginfoUpgrade php-json-debuginfoUpgrade php-cliUpgrade php-ldapUpgrade php-pgsql-debuginfoUpgrade phpUpgrade php-debuginfoUpgrade php-snmpUpgrade php-process-debuginfoUpgrade php-opcacheUpgrade php-gmp-debuginfoUpgrade php-dbaUpgrade libzip-develUpgrade php-debugsourceUpgrade php-pecl-rrd-debugsourceUpgrade php-pecl-apcu-debugsourceUpgrade php-odbcUpgrade php-ffi-debuginfoUpgrade php-fpm-debuginfoUpgrade php-enchantUpgrade libzip-toolsUpgrade libzipUpgrade libzip-debuginfoUpgrade php-dbgUpgrade php-ldap-debuginfoUpgrade php-pecl-xdebug-debugsourceUpgrade php-mysqlndUpgrade php-gd-debuginfoUpgrade php-bcmath-debuginfoUpgrade php-pecl-zip-debuginfoUpgrade php-bcmathUpgrade php-pecl-zipUpgrade php-pecl-zip-debugsourceUpgrade php-xmlUpgrade php-opcache-debuginfoUpgrade php-pecl-apcu-debuginfoUpgrade php-pdoUpgrade php-jsonUpgrade php-snmp-debuginfoUpgrade php-enchant-debuginfoUpgrade libzip-tools-debuginfoUpgrade php-gdUpgrade php-xml-debuginfoUpgrade php-gmpUpgrade php-xmlrpcUpgrade php-pecl-rrd-debuginfoUpgrade php-mbstringUpgrade php-intl-debuginfoUpgrade php-pecl-apcu-develUpgrade php-pecl-rrdUpgrade php-pecl-xdebugUpgrade php-xmlrpc-debuginfoUpgrade php-commonUpgrade php-develUpgrade php-fpmUpgrade php-pearUpgrade php-pecl-apcuUpgrade php-odbc-debuginfoUpgrade php-processUpgrade php-mysqlnd-debuginfoUpgrade php-pecl-xdebug-debuginfoUpgrade php-dbg-debuginfo | Nov 9, 2022 | Nov 29, 2021 |
| Debian | — | Upgrade php7.4 | Nov 4, 2022 | Nov 29, 2021 |
| Huawei Euleros 2_0_sp3 | — | Upgrade php-recodeUpgrade php-cliUpgrade php-commonUpgrade phpUpgrade php-processUpgrade php-odbcUpgrade php-ldapUpgrade php-gdUpgrade php-pgsqlUpgrade php-pdoUpgrade php-soapUpgrade php-xmlUpgrade php-mysqlUpgrade php-xmlrpc | May 25, 2022 | Nov 29, 2021 |
| Oracle Solaris | — | Upgrade web/php-73 to version 7.3.33-11.4.41.0.1.107.1 on Solaris 11.4Upgrade web/php-74 to version 7.4.26-11.4.41.0.1.107.1 on Solaris 11.4Upgrade web/php-80 to version 8.0.13-11.4.41.0.1.107.1 on Solaris 11.4 | Jan 19, 2022 | Nov 29, 2021 |
| Oracle_linux | — | Upgrade php-soapUpgrade php-pdoUpgrade php-jsonUpgrade php-gmpUpgrade php-fpmUpgrade phpUpgrade php-gdUpgrade php-bcmathUpgrade php-dbaUpgrade php-pecl-rrdUpgrade php-pecl-apcu-develUpgrade libzipUpgrade php-ldapUpgrade php-develUpgrade php-embeddedUpgrade php-xmlrpcUpgrade php-enchantUpgrade php-processUpgrade php-pecl-zipUpgrade apcu-panelUpgrade libzip-toolsUpgrade php-xmlUpgrade php-pearUpgrade php-opcacheUpgrade php-ffiUpgrade php-pecl-xdebugUpgrade php-intlUpgrade php-pgsqlUpgrade libzip-develUpgrade php-snmpUpgrade php-mbstringUpgrade php-odbcUpgrade php-pecl-apcuUpgrade php-mysqlndUpgrade php-dbgUpgrade php-commonUpgrade php-cli | Nov 16, 2022 | Nov 15, 2021 |
| Php | — | Upgrade to PHP version 8.0.12Upgrade to PHP version 7.4.25Upgrade to PHP version 7.3.32 | Feb 17, 2022 | Nov 29, 2021 |
| Redhat_linux | — | Upgrade php-ffiUpgrade php-soapUpgrade php-bcmath-debuginfoUpgrade php-process-debuginfoUpgrade php-pecl-zipUpgrade php-mbstring-debuginfoUpgrade php-intlUpgrade php-cli-debuginfoUpgrade php-fpm-debuginfoUpgrade php-json-debuginfoUpgrade php-bcmathUpgrade libzipUpgrade php-gd-debuginfoUpgrade php-dbaUpgrade php-odbc-debuginfoUpgrade php-dbgUpgrade libzip-toolsUpgrade php-pgsqlUpgrade php-pecl-apcu-debugsourceUpgrade php-debuginfoUpgrade php-pecl-apcuUpgrade php-xml-debuginfoUpgrade php-pecl-xdebug-debugsourceUpgrade php-dba-debuginfoUpgrade php-enchant-debuginfoUpgrade php-pecl-zip-debuginfoUpgrade php-ldapUpgrade php-pdo-debuginfoUpgrade php-pecl-apcu-develUpgrade php-odbcNo solution existsUpgrade libzip-tools-debuginfoUpgrade apcu-panelUpgrade php-commonUpgrade php-common-debuginfoUpgrade php-soap-debuginfoUpgrade php-gmp-debuginfoUpgrade libzip-debuginfoUpgrade phpUpgrade php-pgsql-debuginfoUpgrade libzip-debugsourceUpgrade php-ffi-debuginfoUpgrade php-ldap-debuginfoUpgrade php-pecl-zip-debugsourceUpgrade php-pecl-xdebugUpgrade php-gdUpgrade php-pecl-rrdUpgrade php-jsonUpgrade php-xmlrpc-debuginfoUpgrade php-opcacheUpgrade php-pecl-apcu-debuginfoUpgrade php-pdoUpgrade php-opcache-debuginfoUpgrade php-mbstringUpgrade php-mysqlnd-debuginfoUpgrade php-cliUpgrade php-debugsourceUpgrade php-mysqlndUpgrade libzip-develUpgrade php-enchantUpgrade php-intl-debuginfoUpgrade php-processUpgrade php-xmlrpcUpgrade php-fpmUpgrade php-xmlUpgrade php-develUpgrade php-embedded-debuginfoUpgrade php-dbg-debuginfoUpgrade php-pecl-rrd-debuginfoUpgrade php-embeddedUpgrade php-pecl-rrd-debugsourceUpgrade php-pecl-xdebug-debuginfoUpgrade php-gmpUpgrade php-snmpUpgrade php-pearUpgrade php-snmp-debuginfo | Nov 9, 2022 | Nov 29, 2021 |
| Rocky_linux | — | Upgrade php-cli-debuginfoUpgrade php-pecl-rrd-debugsourceUpgrade php-debugsourceUpgrade libzip-tools-debuginfoUpgrade php-pecl-apcu-debugsourceUpgrade php-pecl-xdebug-debuginfoUpgrade php-embeddedUpgrade php-common-debuginfoUpgrade php-intlUpgrade php-odbcUpgrade php-pecl-xdebug-debugsourceUpgrade libzipUpgrade php-snmpUpgrade php-gmp-debuginfoUpgrade php-cliUpgrade php-enchantUpgrade php-fpm-debuginfoUpgrade php-pgsqlUpgrade libzip-debugsourceUpgrade php-soap-debuginfoUpgrade libzip-develUpgrade php-ldapUpgrade libzip-toolsUpgrade php-enchant-debuginfoUpgrade php-mysqlndUpgrade phpUpgrade libzip-debuginfoUpgrade php-xmlrpc-debuginfoUpgrade php-embedded-debuginfoUpgrade php-soapUpgrade php-pecl-apcuUpgrade php-dba-debuginfoUpgrade php-pecl-zipUpgrade php-bcmathUpgrade php-pdo-debuginfoUpgrade php-pdoUpgrade php-process-debuginfoUpgrade php-bcmath-debuginfoUpgrade php-dbgUpgrade php-pgsql-debuginfoUpgrade php-ffi-debuginfoUpgrade php-pecl-zip-debuginfoUpgrade php-dbaUpgrade php-opcacheUpgrade php-ffiUpgrade php-gd-debuginfoUpgrade php-mbstring-debuginfoUpgrade php-json-debuginfoUpgrade php-jsonUpgrade php-pecl-rrdUpgrade php-xml-debuginfoUpgrade php-xmlUpgrade php-pecl-rrd-debuginfoUpgrade php-opcache-debuginfoUpgrade php-xmlrpcUpgrade php-gdUpgrade php-fpmUpgrade php-debuginfoUpgrade php-pecl-xdebugUpgrade php-mbstringUpgrade php-gmpUpgrade php-commonUpgrade php-snmp-debuginfoUpgrade php-pecl-zip-debugsourceUpgrade php-ldap-debuginfoUpgrade php-dbg-debuginfoUpgrade php-develUpgrade php-pecl-apcu-debuginfoUpgrade php-odbc-debuginfoUpgrade php-mysqlnd-debuginfoUpgrade php-processUpgrade php-pecl-apcu-develUpgrade php-intl-debuginfo | Mar 12, 2024 | Nov 29, 2021 |
| Suse | — | Upgrade php7-xmlreaderUpgrade php8-develUpgrade php7-intlUpgrade php7-sysvmsgUpgrade php7-mbstringUpgrade php74-pharUpgrade php72-zlibUpgrade php74-zlibUpgrade php74-soapUpgrade php72-wddxUpgrade php8-cliUpgrade php74-readlineUpgrade apache2-mod_php74Upgrade php72-imapUpgrade php74-ctypeUpgrade php72-pearUpgrade php8-xslUpgrade php74-snmpUpgrade php8-fileinfoUpgrade php74-bz2Upgrade php8-mbstringUpgrade php7-xmlwriterUpgrade php7Upgrade php74-fileinfoUpgrade php8-dbaUpgrade php74-shmopUpgrade php8-zlibUpgrade php72-ldapUpgrade php72-socketsUpgrade php72-zipUpgrade php8-snmpUpgrade php7-tidyUpgrade php72-fastcgiUpgrade php7-fileinfoUpgrade php7-curlUpgrade php8-tokenizerUpgrade php74-fpmUpgrade php72-sqliteUpgrade php72-mbstringUpgrade php7-xslUpgrade php7-opensslUpgrade php8-opensslUpgrade php7-snmpUpgrade php7-domUpgrade php72-pharUpgrade php7-fastcgiUpgrade php7-sodiumUpgrade php7-embedUpgrade php74-bcmathUpgrade php72-opensslUpgrade php74-xmlwriterUpgrade php72-domUpgrade php8-tidyUpgrade php72-sysvmsgUpgrade php72-posixUpgrade php74-develUpgrade php7-firebirdUpgrade php72-gdUpgrade php7-enchantUpgrade php72-odbcUpgrade php8-iconvUpgrade php74-domUpgrade php74-sysvshmUpgrade php8-sysvmsgUpgrade php72-bz2Upgrade php74-ftpUpgrade php8-posixUpgrade php72-soapUpgrade php74-jsonUpgrade php74-ldapUpgrade php72-mysqlUpgrade php74-sysvmsgUpgrade php7-gdUpgrade php72-xslUpgrade php8-pharUpgrade php8-exifUpgrade php72-sysvshmUpgrade php72Upgrade php72-tokenizerUpgrade php72-curlUpgrade php72-fpmUpgrade php74-sysvsemUpgrade php74-xmlrpcUpgrade php8-soapUpgrade php72-intlUpgrade php7-exifUpgrade php7-wddxUpgrade php74-mysqlUpgrade php8-ctypeUpgrade php74-calendarUpgrade php7-sysvshmUpgrade php74-curlUpgrade php74-exifUpgrade php74-pgsqlUpgrade php72-pdoUpgrade php8-ftpUpgrade php74-zipUpgrade apache2-mod_php7Upgrade php8-mysqlUpgrade php8-pcntlUpgrade php72-xmlwriterUpgrade php74-opcacheUpgrade php72-readlineUpgrade php7-ftpUpgrade php74-gmpUpgrade php7-pcntlUpgrade php72-fileinfoUpgrade php7-fpmUpgrade php7-gmpUpgrade php7-ctypeUpgrade php72-pgsqlUpgrade php72-shmopUpgrade php7-pgsqlUpgrade php8-xmlreaderUpgrade php74Upgrade php7-jsonUpgrade php7-ldapUpgrade php7-iconvUpgrade php8-shmopUpgrade php74-dbaUpgrade php8-sysvshmUpgrade php7-socketsUpgrade php7-gettextUpgrade php8-readlineUpgrade php8-opcacheUpgrade php74-sqliteUpgrade php74-enchantUpgrade php72-enchantUpgrade php74-sodiumUpgrade php7-sysvsemUpgrade php7-xmlrpcUpgrade php72-develUpgrade php72-pear-archive_tarUpgrade apache2-mod_php72Upgrade php7-zipUpgrade php7-cliUpgrade php7-pear-archive_tarUpgrade php8-sqliteUpgrade php8-curlUpgrade php8-testUpgrade php8-gmpUpgrade php8-bcmathUpgrade php8-fastcgiUpgrade php74-iconvUpgrade php74-xslUpgrade php74-tidyUpgrade php72-iconvUpgrade php7-posixUpgrade php72-sodiumUpgrade php8-domUpgrade php74-socketsUpgrade php8-sysvsemUpgrade php72-dbaUpgrade php7-bz2Upgrade php72-snmpUpgrade php74-pdoUpgrade php7-testUpgrade php7-shmopUpgrade php74-xmlreaderUpgrade php7-soapUpgrade php8-pdoUpgrade php72-calendarUpgrade php74-fastcgiUpgrade php8-bz2Upgrade php72-opcacheUpgrade php8-pgsqlUpgrade php72-gettextUpgrade php8Upgrade php8-gdUpgrade php72-xmlrpcUpgrade php7-pdoUpgrade php8-calendarUpgrade php72-pcntlUpgrade php7-bcmathUpgrade php74-pcntlUpgrade php7-odbcUpgrade php7-pharUpgrade php74-mbstringUpgrade php72-xmlreaderUpgrade php8-zipUpgrade php72-jsonUpgrade php72-ftpUpgrade php7-mysqlUpgrade php74-odbcUpgrade php7-develUpgrade php8-embedUpgrade php72-tidyUpgrade php8-ldapUpgrade php74-gdUpgrade php74-posixUpgrade php8-enchantUpgrade php74-gettextUpgrade php74-opensslUpgrade php72-sysvsemUpgrade php74-intlUpgrade php7-zlibUpgrade php8-socketsUpgrade php8-intlUpgrade php72-exifUpgrade php7-sqliteUpgrade php8-gettextUpgrade php8-xmlwriterUpgrade php8-fpmUpgrade php7-pearUpgrade apache2-mod_php8Upgrade php7-calendarUpgrade php7-opcacheUpgrade php74-tokenizerUpgrade php7-dbaUpgrade php72-gmpUpgrade php8-odbcUpgrade php72-ctypeUpgrade php72-pspellUpgrade php7-readlineUpgrade php8-sodiumUpgrade php72-bcmathUpgrade php7-tokenizer | Dec 7, 2021 | Nov 29, 2021 |
| Ubuntu | — | Upgrade php7.4-fpmUpgrade php7.2-fpmUpgrade php7.2-cgiUpgrade php8.0-cgiUpgrade php7.4-cliUpgrade php7.0-fpm (Ubuntu Pro)Upgrade php7.4-cgiUpgrade php8.0-fpmUpgrade php7.0-cgi (Ubuntu Pro)Upgrade php7.0-cli (Ubuntu Pro)Upgrade php8.0-cliUpgrade php7.2-cli | Feb 23, 2022 | Nov 29, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub