In PHP versions 7.3.x below 7.3.33, 7.4.x below 7.4.26 and 8.0.x below 8.0.13, certain XML parsing functions, like simplexml_load_file(), URL-decode the filename passed to them. If that filename contains URL-encoded NUL character, this may cause the function to interpret this as the end of the filename, thus interpreting the filename differently from what the user intended, which may lead it to reading a different file than intended.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade php-pecl-apcu-develUpgrade php-gmpUpgrade php-pecl-zipUpgrade libzipUpgrade php-pecl-xdebugUpgrade php-odbcUpgrade php-cliUpgrade php-pecl-apcuUpgrade php-pearUpgrade php-xmlUpgrade php-embeddedUpgrade php-commonUpgrade php-bcmathUpgrade php-develUpgrade php-enchantUpgrade php-jsonUpgrade php-ldapUpgrade php-fpmUpgrade php-pdoUpgrade php-dbgUpgrade php-ffiUpgrade php-processUpgrade php-xmlrpcUpgrade php-soapUpgrade php-opcacheUpgrade libzip-toolsUpgrade php-mbstringUpgrade php-pecl-rrdUpgrade php-gdUpgrade php-mysqlndUpgrade php-dbaUpgrade apcu-panelUpgrade libzip-develUpgrade php-snmpUpgrade php-pgsqlUpgrade php-intlUpgrade php | Nov 14, 2022 | Nov 29, 2021 |
| Alpine Linux | — | Upgrade php81Upgrade php8Upgrade php7 | Aug 22, 2024 | Nov 29, 2021 |
| Amazon Linux Ami 2 | — | Upgrade php-xmlUpgrade php-snmpUpgrade php-bcmathUpgrade php-mbstringUpgrade php-opcacheUpgrade php-mysqlndUpgrade php-enchantUpgrade php-cliUpgrade php-develUpgrade php-pdoUpgrade php-fpmUpgrade php-embeddedUpgrade php-ldapUpgrade php-debuginfoUpgrade phpUpgrade php-soapUpgrade php-dbgUpgrade php-dbaUpgrade php-gmpUpgrade php-sodiumUpgrade php-intlUpgrade php-processUpgrade php-gdUpgrade php-odbcUpgrade php-commonUpgrade php-pgsqlUpgrade php-pspell | Sep 14, 2023 | Nov 29, 2021 |
| Centos_linux | — | Upgrade libzip-debuginfoUpgrade php-mysqlndUpgrade php-bcmath-debuginfoUpgrade php-pgsql-debuginfoUpgrade php-pecl-zip-debuginfoUpgrade php-pecl-xdebug-debugsourceUpgrade php-gd-debuginfoUpgrade php-ldap-debuginfoUpgrade php-dbgUpgrade php-opcacheUpgrade php-dbaUpgrade libzip-develUpgrade php-dba-debuginfoUpgrade apcu-panelUpgrade php-pdo-debuginfoUpgrade php-intlUpgrade php-ffiUpgrade php-process-debuginfoUpgrade php-snmpUpgrade php-gmp-debuginfoUpgrade php-ldapUpgrade php-cliUpgrade php-mbstring-debuginfoUpgrade php-json-debuginfoUpgrade libzip-debugsourceUpgrade php-cli-debuginfoUpgrade php-debugsourceUpgrade php-debuginfoUpgrade php-soap-debuginfoUpgrade php-pgsqlUpgrade php-common-debuginfoUpgrade phpUpgrade php-embedded-debuginfoUpgrade php-pecl-rrd-debugsourceUpgrade php-soapUpgrade php-embeddedUpgrade php-pecl-apcu-debugsourceUpgrade php-odbcUpgrade php-ffi-debuginfoUpgrade php-fpm-debuginfoUpgrade php-enchantUpgrade libzip-toolsUpgrade libzipUpgrade php-pecl-rrd-debuginfoUpgrade php-pecl-xdebugUpgrade php-pecl-zip-debugsourceUpgrade php-xmlUpgrade php-mbstringUpgrade php-gmpUpgrade php-pearUpgrade libzip-tools-debuginfoUpgrade php-enchant-debuginfoUpgrade php-snmp-debuginfoUpgrade php-gdUpgrade php-xml-debuginfoUpgrade php-commonUpgrade php-fpmUpgrade php-pecl-apcu-debuginfoUpgrade php-pecl-apcu-develUpgrade php-mysqlnd-debuginfoUpgrade php-odbc-debuginfoUpgrade php-pecl-apcuUpgrade php-xmlrpc-debuginfoUpgrade php-processUpgrade php-dbg-debuginfoUpgrade php-pecl-xdebug-debuginfoUpgrade php-xmlrpcUpgrade php-pecl-rrdUpgrade php-bcmathUpgrade php-pdoUpgrade php-intl-debuginfoUpgrade php-jsonUpgrade php-develUpgrade php-opcache-debuginfoUpgrade php-pecl-zip | Nov 9, 2022 | Nov 29, 2021 |
| Debian | — | Upgrade php7.4 | Nov 4, 2022 | Nov 29, 2021 |
| Huawei Euleros 2_0_sp3 | — | Upgrade php-recodeUpgrade php-cliUpgrade php-commonUpgrade php-processUpgrade phpUpgrade php-odbcUpgrade php-soapUpgrade php-gdUpgrade php-mysqlUpgrade php-pgsqlUpgrade php-xmlrpcUpgrade php-xmlUpgrade php-pdoUpgrade php-ldap | May 25, 2022 | Nov 29, 2021 |
| Oracle Solaris | — | Upgrade web/php-73 to version 7.3.33-11.4.41.0.1.107.1 on Solaris 11.4Upgrade web/php-80 to version 8.0.13-11.4.41.0.1.107.1 on Solaris 11.4Upgrade web/php-74 to version 7.4.26-11.4.41.0.1.107.1 on Solaris 11.4 | Jan 19, 2022 | Nov 29, 2021 |
| Oracle_linux | — | Upgrade php-soapUpgrade php-pecl-zipUpgrade php-jsonUpgrade php-bcmathUpgrade php-pdoUpgrade phpUpgrade php-gdUpgrade php-gmpUpgrade php-ldapUpgrade php-enchantUpgrade php-processUpgrade php-pecl-rrdUpgrade php-develUpgrade libzipUpgrade php-pecl-apcu-develUpgrade php-embeddedUpgrade php-fpmUpgrade php-xmlrpcUpgrade php-dbaUpgrade php-pgsqlUpgrade php-ffiUpgrade php-mysqlndUpgrade php-pecl-apcuUpgrade php-xmlUpgrade php-pecl-xdebugUpgrade php-odbcUpgrade php-mbstringUpgrade apcu-panelUpgrade php-opcacheUpgrade php-commonUpgrade php-pearUpgrade php-cliUpgrade libzip-toolsUpgrade php-snmpUpgrade libzip-develUpgrade php-dbgUpgrade php-intl | Nov 16, 2022 | Nov 15, 2021 |
| Php | — | Upgrade to PHP version 8.0.12Upgrade to PHP version 7.4.25Upgrade to PHP version 7.3.32 | Feb 17, 2022 | Nov 29, 2021 |
| Redhat_linux | — | Upgrade libzip-debugsourceUpgrade php-gmp-debuginfoUpgrade php-pecl-apcu-debugsourceUpgrade phpUpgrade php-soap-debuginfoUpgrade php-pgsql-debuginfoUpgrade php-bcmathUpgrade php-odbc-debuginfoUpgrade php-mbstring-debuginfoUpgrade php-cli-debuginfoUpgrade php-dba-debuginfoUpgrade php-process-debuginfoUpgrade php-ldap-debuginfoUpgrade php-ffi-debuginfoUpgrade php-pecl-apcuUpgrade php-ldapUpgrade apcu-panelUpgrade php-pecl-zipUpgrade php-intlUpgrade php-pdo-debuginfoUpgrade php-bcmath-debuginfoUpgrade php-fpm-debuginfoUpgrade libzip-tools-debuginfoUpgrade php-ffiUpgrade php-soapNo solution existsUpgrade php-gd-debuginfoUpgrade libzipUpgrade php-dbaUpgrade php-pgsqlUpgrade php-odbcUpgrade php-enchant-debuginfoUpgrade php-json-debuginfoUpgrade php-pecl-xdebug-debugsourceUpgrade php-pecl-zip-debuginfoUpgrade php-pecl-apcu-develUpgrade php-dbgUpgrade libzip-toolsUpgrade php-common-debuginfoUpgrade php-commonUpgrade php-debuginfoUpgrade libzip-debuginfoUpgrade php-xml-debuginfoUpgrade php-jsonUpgrade php-mysqlndUpgrade php-dbg-debuginfoUpgrade php-develUpgrade php-pecl-zip-debugsourceUpgrade php-opcacheUpgrade php-xmlUpgrade php-xmlrpc-debuginfoUpgrade php-snmpUpgrade php-gdUpgrade php-pecl-apcu-debuginfoUpgrade php-mbstringUpgrade php-pdoUpgrade php-embeddedUpgrade php-pecl-rrd-debuginfoUpgrade php-pecl-xdebugUpgrade php-mysqlnd-debuginfoUpgrade php-embedded-debuginfoUpgrade php-debugsourceUpgrade php-enchantUpgrade libzip-develUpgrade php-xmlrpcUpgrade php-processUpgrade php-cliUpgrade php-snmp-debuginfoUpgrade php-intl-debuginfoUpgrade php-pearUpgrade php-pecl-rrdUpgrade php-pecl-xdebug-debuginfoUpgrade php-pecl-rrd-debugsourceUpgrade php-gmpUpgrade php-fpmUpgrade php-opcache-debuginfo | Nov 9, 2022 | Nov 29, 2021 |
| Rocky_linux | — | Upgrade libzip-tools-debuginfoUpgrade php-enchant-debuginfoUpgrade php-cli-debuginfoUpgrade php-pdoUpgrade php-bcmathUpgrade php-debugsourceUpgrade php-snmpUpgrade php-ffi-debuginfoUpgrade php-process-debuginfoUpgrade php-embeddedUpgrade php-pecl-apcu-debugsourceUpgrade php-pecl-xdebug-debuginfoUpgrade php-gd-debuginfoUpgrade php-mbstring-debuginfoUpgrade php-pecl-zip-debuginfoUpgrade php-ffiUpgrade php-intlUpgrade libzipUpgrade php-odbcUpgrade php-opcacheUpgrade php-dbaUpgrade php-pecl-xdebug-debugsourceUpgrade php-pgsql-debuginfoUpgrade php-common-debuginfoUpgrade php-pecl-apcuUpgrade php-pdo-debuginfoUpgrade php-pecl-rrd-debugsourceUpgrade libzip-debuginfoUpgrade php-json-debuginfoUpgrade php-bcmath-debuginfoUpgrade php-dbgUpgrade php-mysqlndUpgrade phpUpgrade php-ldapUpgrade php-cliUpgrade php-embedded-debuginfoUpgrade php-pgsqlUpgrade php-pecl-zipUpgrade php-xmlrpc-debuginfoUpgrade php-soapUpgrade php-dba-debuginfoUpgrade libzip-debugsourceUpgrade php-soap-debuginfoUpgrade libzip-develUpgrade php-gmp-debuginfoUpgrade php-enchantUpgrade php-fpm-debuginfoUpgrade libzip-toolsUpgrade php-gdUpgrade php-mysqlnd-debuginfoUpgrade php-processUpgrade php-pecl-rrd-debuginfoUpgrade php-xmlUpgrade php-opcache-debuginfoUpgrade php-intl-debuginfoUpgrade php-commonUpgrade php-pecl-apcu-develUpgrade php-dbg-debuginfoUpgrade php-pecl-apcu-debuginfoUpgrade php-odbc-debuginfoUpgrade php-xmlrpcUpgrade php-debuginfoUpgrade php-pecl-xdebugUpgrade php-fpmUpgrade php-develUpgrade php-pecl-zip-debugsourceUpgrade php-ldap-debuginfoUpgrade php-jsonUpgrade php-pecl-rrdUpgrade php-snmp-debuginfoUpgrade php-mbstringUpgrade php-gmpUpgrade php-xml-debuginfo | Mar 12, 2024 | Nov 29, 2021 |
| Suse | — | Upgrade php7-xslUpgrade php72-sqliteUpgrade php7-xmlreaderUpgrade php72-zipUpgrade php7-jsonUpgrade php7-pgsqlUpgrade php8-opensslUpgrade php72-sysvshmUpgrade php8-iconvUpgrade php72-fpmUpgrade php8-xmlreaderUpgrade php74-exifUpgrade php72-shmopUpgrade php74-fileinfoUpgrade php74-sysvmsgUpgrade php8-ftpUpgrade php8-tokenizerUpgrade php74-jsonUpgrade php74-domUpgrade php72-imapUpgrade php72-fileinfoUpgrade php72-pdoUpgrade php72-xmlwriterUpgrade php8-posixUpgrade php8-pharUpgrade php8-mysqlUpgrade php74-gmpUpgrade php72-xslUpgrade php8-zlibUpgrade php72-pgsqlUpgrade php72-fastcgiUpgrade php72-soapUpgrade php8-xslUpgrade php74-ldapUpgrade php74-ftpUpgrade php74-pharUpgrade php7-ftpUpgrade php72-ldapUpgrade php7-tidyUpgrade php74-opcacheUpgrade php8-sysvmsgUpgrade php7-ctypeUpgrade php74-sysvshmUpgrade php74-shmopUpgrade php72-readlineUpgrade php74-ctypeUpgrade php74Upgrade apache2-mod_php74Upgrade php8-pcntlUpgrade php8-exifUpgrade php74-bz2Upgrade php7-sysvshmUpgrade php8-develUpgrade php72-gdUpgrade php72-mysqlUpgrade php7-xmlwriterUpgrade php72-tokenizerUpgrade php8-dbaUpgrade php7-domUpgrade php8-tidyUpgrade php74-mysqlUpgrade php72-wddxUpgrade php74-soapUpgrade php72-opensslUpgrade php7-gdUpgrade php8-soapUpgrade php74-xmlwriterUpgrade php7-fpmUpgrade php72-intlUpgrade php72-curlUpgrade php74-readlineUpgrade php7-exifUpgrade php7-gmpUpgrade php7-wddxUpgrade php74-zlibUpgrade php74-fpmUpgrade php74-pgsqlUpgrade php74-curlUpgrade php74-xmlrpcUpgrade php7-intlUpgrade php8-cliUpgrade php7-embedUpgrade php72-bz2Upgrade php7-pcntlUpgrade php7-mbstringUpgrade php74-zipUpgrade php7-fileinfoUpgrade php7Upgrade php72Upgrade apache2-mod_php7Upgrade php72-pearUpgrade php7-enchantUpgrade php8-mbstringUpgrade php7-sysvmsgUpgrade php72-pharUpgrade php8-ctypeUpgrade php8-fileinfoUpgrade php72-zlibUpgrade php7-opensslUpgrade php7-snmpUpgrade php7-fastcgiUpgrade php7-sodiumUpgrade php7-curlUpgrade php8-snmpUpgrade php72-mbstringUpgrade php74-calendarUpgrade php7-firebirdUpgrade php72-socketsUpgrade php74-bcmathUpgrade php74-snmpUpgrade php72-domUpgrade php72-posixUpgrade php72-odbcUpgrade php72-sysvmsgUpgrade php74-develUpgrade php74-sysvsemUpgrade php8Upgrade php7-opcacheUpgrade php7-ldapUpgrade php8-embedUpgrade php74-pcntlUpgrade php7-soapUpgrade php7-gettextUpgrade php8-opcacheUpgrade php72-ctypeUpgrade php72-iconvUpgrade php72-gmpUpgrade php7-pearUpgrade php7-posixUpgrade php8-fpmUpgrade php8-bz2Upgrade php8-gettextUpgrade php8-intlUpgrade php72-xmlreaderUpgrade php72-jsonUpgrade php74-gettextUpgrade php8-xmlwriterUpgrade php72-pcntlUpgrade php72-xmlrpcUpgrade php74-opensslUpgrade php74-odbcUpgrade php7-odbcUpgrade php74-intlUpgrade php8-pdoUpgrade php72-gettextUpgrade php7-pharUpgrade php8-ldapUpgrade php72-opcacheUpgrade php8-zipUpgrade php7-bcmathUpgrade php74-gdUpgrade php72-tidyUpgrade php8-enchantUpgrade php8-shmopUpgrade php8-gdUpgrade php72-exifUpgrade php74-xslUpgrade php8-bcmathUpgrade php74-posixUpgrade php8-socketsUpgrade php72-ftpUpgrade php74-dbaUpgrade php8-pgsqlUpgrade php74-fastcgiUpgrade php8-fastcgiUpgrade php8-sqliteUpgrade php8-gmpUpgrade php7-mysqlUpgrade php8-curlUpgrade php7-develUpgrade php72-sysvsemUpgrade php7-zlibUpgrade php74-mbstringUpgrade php72-calendarUpgrade php8-calendarUpgrade php8-testUpgrade php72-pear-archive_tarUpgrade php74-sodiumUpgrade php7-zipUpgrade php7-cliUpgrade php7-pear-archive_tarUpgrade php74-iconvUpgrade php7-xmlrpcUpgrade php74-tidyUpgrade php7-sysvsemUpgrade php72-develUpgrade php8-sysvsemUpgrade php7-shmopUpgrade php72-dbaUpgrade php74-pdoUpgrade php72-sodiumUpgrade php74-socketsUpgrade php72-snmpUpgrade php8-sysvshmUpgrade php7-bz2Upgrade php74-xmlreaderUpgrade php7-testUpgrade php8-domUpgrade php7-pdoUpgrade php7-calendarUpgrade php72-pspellUpgrade php8-sodiumUpgrade php72-bcmathUpgrade php8-odbcUpgrade php72-enchantUpgrade php74-tokenizerUpgrade apache2-mod_php8Upgrade php7-readlineUpgrade php7-iconvUpgrade php7-dbaUpgrade php7-tokenizerUpgrade php8-readlineUpgrade php7-sqliteUpgrade php74-enchantUpgrade php74-sqliteUpgrade apache2-mod_php72Upgrade php7-sockets | Dec 7, 2021 | Nov 29, 2021 |
| Ubuntu | — | Upgrade php7.4-fpmUpgrade php7.2-fpmUpgrade php8.0-cgiUpgrade php7.2-cgiUpgrade php7.0-cli (Ubuntu Pro)Upgrade php8.0-fpmUpgrade php7.0-fpm (Ubuntu Pro)Upgrade php7.4-cliUpgrade php7.4-cgiUpgrade php8.0-cliUpgrade php7.0-cgi (Ubuntu Pro)Upgrade php7.2-cli | Feb 23, 2022 | Nov 29, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub