In PHP versions 7.3.x below 7.3.33, 7.4.x below 7.4.26 and 8.0.x below 8.0.13, certain XML parsing functions, like simplexml_load_file(), URL-decode the filename passed to them. If that filename contains URL-encoded NUL character, this may cause the function to interpret this as the end of the filename, thus interpreting the filename differently from what the user intended, which may lead it to reading a different file than intended.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade php-pgsqlUpgrade libzip-develUpgrade php-soapUpgrade php-pecl-rrdUpgrade php-dbaUpgrade php-intlUpgrade php-snmpUpgrade apcu-panelUpgrade libzip-toolsUpgrade php-mbstringUpgrade php-mysqlndUpgrade php-gdUpgrade phpUpgrade php-opcacheUpgrade php-ffiUpgrade php-xmlrpcUpgrade php-processUpgrade php-xmlUpgrade php-commonUpgrade php-pecl-zipUpgrade php-gmpUpgrade php-pecl-apcu-develUpgrade php-embeddedUpgrade php-odbcUpgrade php-pdoUpgrade php-pecl-apcuUpgrade php-develUpgrade php-ldapUpgrade php-bcmathUpgrade php-pearUpgrade php-enchantUpgrade php-pecl-xdebugUpgrade libzipUpgrade php-dbgUpgrade php-fpmUpgrade php-cliUpgrade php-json | Nov 14, 2022 | Nov 29, 2021 |
| Alpine Linux | — | Upgrade php8Upgrade php81Upgrade php7 | Aug 22, 2024 | Nov 29, 2021 |
| Amazon Linux Ami 2 | — | Upgrade php-sodiumUpgrade php-pgsqlUpgrade php-soapUpgrade php-gdUpgrade php-debuginfoUpgrade phpUpgrade php-ldapUpgrade php-pspellUpgrade php-intlUpgrade php-commonUpgrade php-gmpUpgrade php-dbaUpgrade php-dbgUpgrade php-processUpgrade php-odbcUpgrade php-xmlUpgrade php-embeddedUpgrade php-mysqlndUpgrade php-enchantUpgrade php-opcacheUpgrade php-develUpgrade php-fpmUpgrade php-mbstringUpgrade php-snmpUpgrade php-pdoUpgrade php-cliUpgrade php-bcmath | Sep 14, 2023 | Nov 29, 2021 |
| Centos_linux | — | Upgrade php-pecl-xdebug-debugsourceUpgrade php-gd-debuginfoUpgrade php-mysqlndUpgrade php-bcmath-debuginfoUpgrade php-pgsql-debuginfoUpgrade php-dbgUpgrade php-ldap-debuginfoUpgrade php-mbstring-debuginfoUpgrade php-ldapUpgrade php-json-debuginfoUpgrade php-cliUpgrade php-debuginfoUpgrade libzip-debugsourceUpgrade php-fpm-debuginfoUpgrade libzip-toolsUpgrade libzip-debuginfoUpgrade libzipUpgrade php-odbcUpgrade php-cli-debuginfoUpgrade php-process-debuginfoUpgrade php-opcacheUpgrade php-gmp-debuginfoUpgrade libzip-develUpgrade php-ffi-debuginfoUpgrade php-pecl-apcu-debugsourceUpgrade phpUpgrade php-pecl-rrd-debugsourceUpgrade php-embedded-debuginfoUpgrade php-common-debuginfoUpgrade php-ffiUpgrade php-pdo-debuginfoUpgrade php-soapUpgrade php-dba-debuginfoUpgrade apcu-panelUpgrade php-soap-debuginfoUpgrade php-pgsqlUpgrade php-intlUpgrade php-embeddedUpgrade php-enchantUpgrade php-debugsourceUpgrade php-snmpUpgrade php-dbaUpgrade php-pecl-zip-debuginfoUpgrade php-xmlUpgrade php-pecl-xdebug-debuginfoUpgrade php-pecl-apcu-debuginfoUpgrade php-pecl-apcu-develUpgrade php-dbg-debuginfoUpgrade php-pecl-zip-debugsourceUpgrade php-jsonUpgrade php-mbstringUpgrade php-pdoUpgrade php-pecl-xdebugUpgrade php-opcache-debuginfoUpgrade php-bcmathUpgrade php-pecl-zipUpgrade php-gmpUpgrade php-mysqlnd-debuginfoUpgrade php-develUpgrade php-pecl-rrd-debuginfoUpgrade php-commonUpgrade php-odbc-debuginfoUpgrade libzip-tools-debuginfoUpgrade php-fpmUpgrade php-pecl-apcuUpgrade php-xmlrpc-debuginfoUpgrade php-pearUpgrade php-enchant-debuginfoUpgrade php-pecl-rrdUpgrade php-processUpgrade php-intl-debuginfoUpgrade php-xmlrpcUpgrade php-gdUpgrade php-xml-debuginfoUpgrade php-snmp-debuginfo | Nov 9, 2022 | Nov 29, 2021 |
| Debian | — | Upgrade php7.4 | Nov 4, 2022 | Nov 29, 2021 |
| Huawei Euleros 2_0_sp3 | — | Upgrade php-xmlUpgrade php-pdoUpgrade php-mysqlUpgrade php-gdUpgrade php-pgsqlUpgrade php-soapUpgrade php-xmlrpcUpgrade php-ldapUpgrade php-processUpgrade php-cliUpgrade php-recodeUpgrade phpUpgrade php-commonUpgrade php-odbc | May 25, 2022 | Nov 29, 2021 |
| Oracle Solaris | — | Upgrade web/php-74 to version 7.4.26-11.4.41.0.1.107.1 on Solaris 11.4Upgrade web/php-73 to version 7.3.33-11.4.41.0.1.107.1 on Solaris 11.4Upgrade web/php-80 to version 8.0.13-11.4.41.0.1.107.1 on Solaris 11.4 | Jan 19, 2022 | Nov 29, 2021 |
| Oracle_linux | — | Upgrade php-gmpUpgrade libzipUpgrade php-ldapUpgrade php-bcmathUpgrade php-enchantUpgrade php-pecl-rrdUpgrade php-processUpgrade php-soapUpgrade php-jsonUpgrade phpUpgrade php-pecl-zipUpgrade php-pdoUpgrade php-dbaUpgrade php-fpmUpgrade php-develUpgrade php-embeddedUpgrade php-xmlrpcUpgrade php-pecl-apcu-develUpgrade php-gdUpgrade php-ffiUpgrade apcu-panelUpgrade php-mbstringUpgrade php-commonUpgrade php-cliUpgrade php-pearUpgrade libzip-toolsUpgrade php-snmpUpgrade php-odbcUpgrade php-opcacheUpgrade libzip-develUpgrade php-xmlUpgrade php-pecl-apcuUpgrade php-mysqlndUpgrade php-dbgUpgrade php-pgsqlUpgrade php-pecl-xdebugUpgrade php-intl | Nov 16, 2022 | Nov 15, 2021 |
| Php | — | Upgrade to PHP version 8.0.12Upgrade to PHP version 7.4.25Upgrade to PHP version 7.3.32 | Feb 17, 2022 | Nov 29, 2021 |
| Redhat_linux | — | Upgrade php-enchantUpgrade php-xmlrpc-debuginfoUpgrade php-snmp-debuginfoUpgrade php-jsonUpgrade php-gdUpgrade php-pecl-zip-debugsourceUpgrade php-xmlrpcUpgrade php-processUpgrade php-opcacheUpgrade php-mysqlnd-debuginfoUpgrade php-debugsourceUpgrade libzip-develUpgrade php-mysqlndUpgrade php-gmpUpgrade php-pecl-rrd-debuginfoUpgrade php-dbg-debuginfoUpgrade php-embeddedUpgrade php-pecl-xdebug-debuginfoUpgrade php-fpmUpgrade php-snmpUpgrade php-pecl-rrd-debugsourceUpgrade php-opcache-debuginfoUpgrade php-mbstringUpgrade php-pecl-xdebugUpgrade php-pearUpgrade php-pecl-apcu-debuginfoUpgrade php-cliUpgrade php-pdoUpgrade php-intl-debuginfoUpgrade php-xmlUpgrade php-develUpgrade php-pecl-rrdUpgrade php-embedded-debuginfoUpgrade php-gmp-debuginfoUpgrade php-soap-debuginfoUpgrade php-pecl-apcuUpgrade php-pecl-zip-debuginfoUpgrade php-debuginfoUpgrade phpUpgrade php-pgsql-debuginfoUpgrade libzip-debugsourceUpgrade php-ldapUpgrade php-enchant-debuginfoUpgrade php-dbaUpgrade php-odbc-debuginfoUpgrade libzipUpgrade php-bcmathUpgrade php-json-debuginfoUpgrade php-gd-debuginfoUpgrade php-fpm-debuginfoUpgrade apcu-panelNo solution existsUpgrade libzip-tools-debuginfoUpgrade php-dba-debuginfoUpgrade php-pdo-debuginfoUpgrade php-pecl-apcu-debugsourceUpgrade php-ldap-debuginfoUpgrade php-xml-debuginfoUpgrade php-pecl-apcu-develUpgrade libzip-toolsUpgrade php-pgsqlUpgrade php-commonUpgrade libzip-debuginfoUpgrade php-soapUpgrade php-common-debuginfoUpgrade php-process-debuginfoUpgrade php-mbstring-debuginfoUpgrade php-cli-debuginfoUpgrade php-intlUpgrade php-bcmath-debuginfoUpgrade php-pecl-zipUpgrade php-dbgUpgrade php-odbcUpgrade php-pecl-xdebug-debugsourceUpgrade php-ffiUpgrade php-ffi-debuginfo | Nov 9, 2022 | Nov 29, 2021 |
| Rocky_linux | — | Upgrade php-xmlrpcUpgrade php-snmp-debuginfoUpgrade php-jsonUpgrade php-xmlUpgrade php-gdUpgrade php-opcache-debuginfoUpgrade php-pecl-apcu-develUpgrade php-processUpgrade php-xml-debuginfoUpgrade php-pecl-rrdUpgrade php-pecl-rrd-debuginfoUpgrade php-intl-debuginfoUpgrade php-debuginfoUpgrade php-fpmUpgrade php-pecl-xdebugUpgrade php-pecl-apcu-debuginfoUpgrade php-mbstringUpgrade php-ldap-debuginfoUpgrade php-commonUpgrade php-odbc-debuginfoUpgrade php-pecl-zip-debugsourceUpgrade php-dbg-debuginfoUpgrade php-mysqlnd-debuginfoUpgrade php-develUpgrade php-gmpUpgrade php-enchant-debuginfoUpgrade php-snmpUpgrade php-pecl-rrd-debugsourceUpgrade php-pgsql-debuginfoUpgrade php-debugsourceUpgrade php-cli-debuginfoUpgrade libzip-tools-debuginfoUpgrade php-bcmathUpgrade php-process-debuginfoUpgrade php-mbstring-debuginfoUpgrade php-gd-debuginfoUpgrade php-ffi-debuginfoUpgrade php-pdo-debuginfoUpgrade php-pgsqlUpgrade php-ldapUpgrade libzip-develUpgrade libzip-toolsUpgrade php-gmp-debuginfoUpgrade php-cliUpgrade php-fpm-debuginfoUpgrade libzip-debugsourceUpgrade php-soap-debuginfoUpgrade php-xmlrpc-debuginfoUpgrade php-enchantUpgrade php-dbaUpgrade php-mysqlndUpgrade php-pecl-apcuUpgrade php-dbgUpgrade php-json-debuginfoUpgrade libzip-debuginfoUpgrade php-pecl-apcu-debugsourceUpgrade php-embeddedUpgrade php-pecl-xdebug-debuginfoUpgrade php-pdoUpgrade php-pecl-zip-debuginfoUpgrade php-pecl-xdebug-debugsourceUpgrade php-opcacheUpgrade php-intlUpgrade php-odbcUpgrade php-ffiUpgrade php-common-debuginfoUpgrade libzipUpgrade php-soapUpgrade phpUpgrade php-bcmath-debuginfoUpgrade php-pecl-zipUpgrade php-embedded-debuginfoUpgrade php-dba-debuginfo | Mar 12, 2024 | Nov 29, 2021 |
| Suse | — | Upgrade php7-testUpgrade php72-dbaUpgrade php7-bz2Upgrade php74-pdoUpgrade php74-socketsUpgrade php8-sysvsemUpgrade php8-sysvshmUpgrade php72-pear-archive_tarUpgrade php7-zipUpgrade php7-sysvsemUpgrade php8-enchantUpgrade php7-pear-archive_tarUpgrade php72-exifUpgrade php7-posixUpgrade php72-iconvUpgrade php72-pcntlUpgrade php8-fastcgiUpgrade php72-snmpUpgrade php74-xmlreaderUpgrade php7-zlibUpgrade php72-sysvsemUpgrade php7-develUpgrade php7-mysqlUpgrade php72-calendarUpgrade php8-embedUpgrade php8Upgrade php74-mbstringUpgrade php7-soapUpgrade php8-readlineUpgrade php74-pcntlUpgrade php72-xmlreaderUpgrade php74-sqliteUpgrade php74-enchantUpgrade php74-dbaUpgrade php74-fastcgiUpgrade php72-ftpUpgrade php72-tidyUpgrade php7-pdoUpgrade php8-opcacheUpgrade php8-domUpgrade php8-gdUpgrade php8-pgsqlUpgrade php8-socketsUpgrade php72-pspellUpgrade php74-intlUpgrade php74-odbcUpgrade php7-socketsUpgrade php7-sqliteUpgrade php74-iconvUpgrade php7-tokenizerUpgrade php8-ldapUpgrade php8-zipUpgrade php7-shmopUpgrade php7-iconvUpgrade php7-calendarUpgrade php7-opcacheUpgrade php7-ldapUpgrade php8-shmopUpgrade php7-pearUpgrade php7-dbaUpgrade php8-calendarUpgrade php7-gettextUpgrade php8-sodiumUpgrade php72-gmpUpgrade php8-odbcUpgrade php8-gettextUpgrade php72-ctypeUpgrade php72-bcmathUpgrade apache2-mod_php8Upgrade php74-posixUpgrade php72-develUpgrade php7-readlineUpgrade php72-sodiumUpgrade php8-bz2Upgrade php8-fpmUpgrade php8-pdoUpgrade php8-intlUpgrade php7-pharUpgrade php7-odbcUpgrade php7-bcmathUpgrade php72-gettextUpgrade php72-jsonUpgrade php7-cliUpgrade php7-xmlrpcUpgrade php74-tidyUpgrade php74-sodiumUpgrade php72-enchantUpgrade php8-curlUpgrade apache2-mod_php72Upgrade php8-gmpUpgrade php74-gdUpgrade php74-tokenizerUpgrade php74-gettextUpgrade php74-opensslUpgrade php72-opcacheUpgrade php72-xmlrpcUpgrade php8-xmlwriterUpgrade php8-bcmathUpgrade php8-testUpgrade php74-xslUpgrade php8-sqliteUpgrade php7-pgsqlUpgrade php8-iconvUpgrade php72-shmopUpgrade php8-xmlreaderUpgrade php7-fpmUpgrade php72-opensslUpgrade php74-mysqlUpgrade php7-jsonUpgrade php74-fileinfoUpgrade php72-fileinfoUpgrade apache2-mod_php74Upgrade php74-domUpgrade php72-imapUpgrade php74-sysvshmUpgrade php74-jsonUpgrade php74-ctypeUpgrade php74-bz2Upgrade php72-xslUpgrade php72-wddxUpgrade php7-xmlwriterUpgrade php8-tokenizerUpgrade php8-xslUpgrade php8-posixUpgrade php8-pharUpgrade php8-mbstringUpgrade php74-sysvmsgUpgrade php8-mysqlUpgrade apache2-mod_php7Upgrade php74-soapUpgrade php7-sysvmsgUpgrade php7-ctypeUpgrade php74-zipUpgrade php8-exifUpgrade php7-xslUpgrade php72-pearUpgrade php74-readlineUpgrade php74-snmpUpgrade php74-zlibUpgrade php8-cliUpgrade php7-ftpUpgrade php8-snmpUpgrade php74-exifUpgrade php72-tokenizerUpgrade php8-ctypeUpgrade php74-gmpUpgrade php7-pcntlUpgrade php74Upgrade php7-sysvshmUpgrade php7-curlUpgrade php7-gdUpgrade php7-mbstringUpgrade php74-opcacheUpgrade php72-xmlwriterUpgrade php72-mbstringUpgrade php7Upgrade php72-pgsqlUpgrade php7-fileinfoUpgrade php72-ldapUpgrade php72-soapUpgrade php72-bz2Upgrade php7-tidyUpgrade php7-enchantUpgrade php72-fastcgiUpgrade php8-sysvmsgUpgrade php8-fileinfoUpgrade php74-shmopUpgrade php74-ldapUpgrade php74-pharUpgrade php72-intlUpgrade php7-wddxUpgrade php7-gmpUpgrade php8-soapUpgrade php74-develUpgrade php72-fpmUpgrade php74-sysvsemUpgrade php74-xmlrpcUpgrade php72-odbcUpgrade php74-calendarUpgrade php74-curlUpgrade php74-pgsqlUpgrade php72-sysvmsgUpgrade php8-ftpUpgrade php74-bcmathUpgrade php7-exifUpgrade php74-xmlwriterUpgrade php72-mysqlUpgrade php7-firebirdUpgrade php7-intlUpgrade php8-tidyUpgrade php74-fpmUpgrade php72-gdUpgrade php72Upgrade php74-ftpUpgrade php72-pdoUpgrade php7-embedUpgrade php72-posixUpgrade php72-domUpgrade php72-zlibUpgrade php72-curlUpgrade php8-develUpgrade php72-readlineUpgrade php8-pcntlUpgrade php72-sqliteUpgrade php7-domUpgrade php8-zlibUpgrade php7-fastcgiUpgrade php7-xmlreaderUpgrade php72-zipUpgrade php7-opensslUpgrade php7-snmpUpgrade php8-dbaUpgrade php72-socketsUpgrade php7-sodiumUpgrade php72-pharUpgrade php8-opensslUpgrade php72-sysvshm | Dec 7, 2021 | Nov 29, 2021 |
| Ubuntu | — | Upgrade php7.2-fpmUpgrade php7.4-fpmUpgrade php7.4-cgiUpgrade php7.2-cgiUpgrade php7.2-cliUpgrade php7.0-fpm (Ubuntu Pro)Upgrade php8.0-fpmUpgrade php8.0-cgiUpgrade php7.0-cgi (Ubuntu Pro)Upgrade php7.4-cliUpgrade php7.0-cli (Ubuntu Pro)Upgrade php8.0-cli | Feb 23, 2022 | Nov 29, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub