php7-7.4.24-2.1 on GA media SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2024:11569 Final 1 1 2024-06-17T21:45:33Z current 2024-06-17T21:45:33Z 2024-06-17T21:45:33Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z php7-7.4.24-2.1 on GA media These are all security issues fixed in the php7-7.4.24-2.1 package on the GA media of openSUSE Tumbleweed. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-Tumbleweed-2024-11569 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) E-Mail link for openSUSE-SU-2024:11569 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://www.suse.com/security/cve/CVE-2020-7068/ SUSE CVE CVE-2020-7068 page https://www.suse.com/security/cve/CVE-2021-21702/ SUSE CVE CVE-2021-21702 page openSUSE Tumbleweed php7-7.4.24-2.1 php7-bcmath-7.4.24-2.1 php7-bz2-7.4.24-2.1 php7-calendar-7.4.24-2.1 php7-cli-7.4.24-2.1 php7-ctype-7.4.24-2.1 php7-curl-7.4.24-2.1 php7-dba-7.4.24-2.1 php7-devel-7.4.24-2.1 php7-dom-7.4.24-2.1 php7-enchant-7.4.24-2.1 php7-exif-7.4.24-2.1 php7-fileinfo-7.4.24-2.1 php7-ftp-7.4.24-2.1 php7-gd-7.4.24-2.1 php7-gettext-7.4.24-2.1 php7-gmp-7.4.24-2.1 php7-iconv-7.4.24-2.1 php7-intl-7.4.24-2.1 php7-json-7.4.24-2.1 php7-ldap-7.4.24-2.1 php7-mbstring-7.4.24-2.1 php7-mysql-7.4.24-2.1 php7-odbc-7.4.24-2.1 php7-opcache-7.4.24-2.1 php7-openssl-7.4.24-2.1 php7-pcntl-7.4.24-2.1 php7-pdo-7.4.24-2.1 php7-pgsql-7.4.24-2.1 php7-phar-7.4.24-2.1 php7-posix-7.4.24-2.1 php7-readline-7.4.24-2.1 php7-shmop-7.4.24-2.1 php7-snmp-7.4.24-2.1 php7-soap-7.4.24-2.1 php7-sockets-7.4.24-2.1 php7-sodium-7.4.24-2.1 php7-sqlite-7.4.24-2.1 php7-sysvmsg-7.4.24-2.1 php7-sysvsem-7.4.24-2.1 php7-sysvshm-7.4.24-2.1 php7-tidy-7.4.24-2.1 php7-tokenizer-7.4.24-2.1 php7-xmlreader-7.4.24-2.1 php7-xmlrpc-7.4.24-2.1 php7-xmlwriter-7.4.24-2.1 php7-xsl-7.4.24-2.1 php7-zip-7.4.24-2.1 php7-zlib-7.4.24-2.1 php7-7.4.24-2.1 as a component of openSUSE Tumbleweed php7-bcmath-7.4.24-2.1 as a component of openSUSE Tumbleweed php7-bz2-7.4.24-2.1 as a component of openSUSE Tumbleweed php7-calendar-7.4.24-2.1 as a component of openSUSE Tumbleweed php7-cli-7.4.24-2.1 as a component of openSUSE Tumbleweed php7-ctype-7.4.24-2.1 as a component of openSUSE Tumbleweed php7-curl-7.4.24-2.1 as a component of openSUSE Tumbleweed php7-dba-7.4.24-2.1 as a component of openSUSE Tumbleweed php7-devel-7.4.24-2.1 as a component of openSUSE Tumbleweed php7-dom-7.4.24-2.1 as a component of openSUSE Tumbleweed php7-enchant-7.4.24-2.1 as a component of openSUSE Tumbleweed php7-exif-7.4.24-2.1 as a component of openSUSE Tumbleweed php7-fileinfo-7.4.24-2.1 as a component of openSUSE Tumbleweed php7-ftp-7.4.24-2.1 as a component of openSUSE Tumbleweed php7-gd-7.4.24-2.1 as a component of openSUSE Tumbleweed php7-gettext-7.4.24-2.1 as a component of openSUSE Tumbleweed php7-gmp-7.4.24-2.1 as a component of openSUSE Tumbleweed php7-iconv-7.4.24-2.1 as a component of openSUSE Tumbleweed php7-intl-7.4.24-2.1 as a component of openSUSE Tumbleweed php7-json-7.4.24-2.1 as a component of openSUSE Tumbleweed php7-ldap-7.4.24-2.1 as a component of openSUSE Tumbleweed php7-mbstring-7.4.24-2.1 as a component of openSUSE Tumbleweed php7-mysql-7.4.24-2.1 as a component of openSUSE Tumbleweed php7-odbc-7.4.24-2.1 as a component of openSUSE Tumbleweed php7-opcache-7.4.24-2.1 as a component of openSUSE Tumbleweed php7-openssl-7.4.24-2.1 as a component of openSUSE Tumbleweed php7-pcntl-7.4.24-2.1 as a component of openSUSE Tumbleweed php7-pdo-7.4.24-2.1 as a component of openSUSE Tumbleweed php7-pgsql-7.4.24-2.1 as a component of openSUSE Tumbleweed php7-phar-7.4.24-2.1 as a component of openSUSE Tumbleweed php7-posix-7.4.24-2.1 as a component of openSUSE Tumbleweed php7-readline-7.4.24-2.1 as a component of openSUSE Tumbleweed php7-shmop-7.4.24-2.1 as a component of openSUSE Tumbleweed php7-snmp-7.4.24-2.1 as a component of openSUSE Tumbleweed php7-soap-7.4.24-2.1 as a component of openSUSE Tumbleweed php7-sockets-7.4.24-2.1 as a component of openSUSE Tumbleweed php7-sodium-7.4.24-2.1 as a component of openSUSE Tumbleweed php7-sqlite-7.4.24-2.1 as a component of openSUSE Tumbleweed php7-sysvmsg-7.4.24-2.1 as a component of openSUSE Tumbleweed php7-sysvsem-7.4.24-2.1 as a component of openSUSE Tumbleweed php7-sysvshm-7.4.24-2.1 as a component of openSUSE Tumbleweed php7-tidy-7.4.24-2.1 as a component of openSUSE Tumbleweed php7-tokenizer-7.4.24-2.1 as a component of openSUSE Tumbleweed php7-xmlreader-7.4.24-2.1 as a component of openSUSE Tumbleweed php7-xmlrpc-7.4.24-2.1 as a component of openSUSE Tumbleweed php7-xmlwriter-7.4.24-2.1 as a component of openSUSE Tumbleweed php7-xsl-7.4.24-2.1 as a component of openSUSE Tumbleweed php7-zip-7.4.24-2.1 as a component of openSUSE Tumbleweed php7-zlib-7.4.24-2.1 as a component of openSUSE Tumbleweed In PHP versions 7.2.x below 7.2.33, 7.3.x below 7.3.21 and 7.4.x below 7.4.9, while processing PHAR files using phar extension, phar_parse_zipfile could be tricked into accessing freed memory, which could lead to a crash or information disclosure. CVE-2020-7068 openSUSE Tumbleweed:php7-7.4.24-2.1 openSUSE Tumbleweed:php7-bcmath-7.4.24-2.1 openSUSE Tumbleweed:php7-bz2-7.4.24-2.1 openSUSE Tumbleweed:php7-calendar-7.4.24-2.1 openSUSE Tumbleweed:php7-cli-7.4.24-2.1 openSUSE Tumbleweed:php7-ctype-7.4.24-2.1 openSUSE Tumbleweed:php7-curl-7.4.24-2.1 openSUSE Tumbleweed:php7-dba-7.4.24-2.1 openSUSE Tumbleweed:php7-devel-7.4.24-2.1 openSUSE Tumbleweed:php7-dom-7.4.24-2.1 openSUSE Tumbleweed:php7-enchant-7.4.24-2.1 openSUSE Tumbleweed:php7-exif-7.4.24-2.1 openSUSE Tumbleweed:php7-fileinfo-7.4.24-2.1 openSUSE Tumbleweed:php7-ftp-7.4.24-2.1 openSUSE Tumbleweed:php7-gd-7.4.24-2.1 openSUSE Tumbleweed:php7-gettext-7.4.24-2.1 openSUSE Tumbleweed:php7-gmp-7.4.24-2.1 openSUSE Tumbleweed:php7-iconv-7.4.24-2.1 openSUSE Tumbleweed:php7-intl-7.4.24-2.1 openSUSE Tumbleweed:php7-json-7.4.24-2.1 openSUSE Tumbleweed:php7-ldap-7.4.24-2.1 openSUSE Tumbleweed:php7-mbstring-7.4.24-2.1 openSUSE Tumbleweed:php7-mysql-7.4.24-2.1 openSUSE Tumbleweed:php7-odbc-7.4.24-2.1 openSUSE Tumbleweed:php7-opcache-7.4.24-2.1 openSUSE Tumbleweed:php7-openssl-7.4.24-2.1 openSUSE Tumbleweed:php7-pcntl-7.4.24-2.1 openSUSE Tumbleweed:php7-pdo-7.4.24-2.1 openSUSE Tumbleweed:php7-pgsql-7.4.24-2.1 openSUSE Tumbleweed:php7-phar-7.4.24-2.1 openSUSE Tumbleweed:php7-posix-7.4.24-2.1 openSUSE Tumbleweed:php7-readline-7.4.24-2.1 openSUSE Tumbleweed:php7-shmop-7.4.24-2.1 openSUSE Tumbleweed:php7-snmp-7.4.24-2.1 openSUSE Tumbleweed:php7-soap-7.4.24-2.1 openSUSE Tumbleweed:php7-sockets-7.4.24-2.1 openSUSE Tumbleweed:php7-sodium-7.4.24-2.1 openSUSE Tumbleweed:php7-sqlite-7.4.24-2.1 openSUSE Tumbleweed:php7-sysvmsg-7.4.24-2.1 openSUSE Tumbleweed:php7-sysvsem-7.4.24-2.1 openSUSE Tumbleweed:php7-sysvshm-7.4.24-2.1 openSUSE Tumbleweed:php7-tidy-7.4.24-2.1 openSUSE Tumbleweed:php7-tokenizer-7.4.24-2.1 openSUSE Tumbleweed:php7-xmlreader-7.4.24-2.1 openSUSE Tumbleweed:php7-xmlrpc-7.4.24-2.1 openSUSE Tumbleweed:php7-xmlwriter-7.4.24-2.1 openSUSE Tumbleweed:php7-xsl-7.4.24-2.1 openSUSE Tumbleweed:php7-zip-7.4.24-2.1 openSUSE Tumbleweed:php7-zlib-7.4.24-2.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2020-7068.html CVE-2020-7068 https://bugzilla.suse.com/1175203 SUSE Bug 1175203 https://bugzilla.suse.com/1175223 SUSE Bug 1175223 In PHP versions 7.3.x below 7.3.27, 7.4.x below 7.4.15 and 8.0.x below 8.0.2, when using SOAP extension to connect to a SOAP server, a malicious SOAP server could return malformed XML data as a response that would cause PHP to access a null pointer and thus cause a crash. CVE-2021-21702 openSUSE Tumbleweed:php7-7.4.24-2.1 openSUSE Tumbleweed:php7-bcmath-7.4.24-2.1 openSUSE Tumbleweed:php7-bz2-7.4.24-2.1 openSUSE Tumbleweed:php7-calendar-7.4.24-2.1 openSUSE Tumbleweed:php7-cli-7.4.24-2.1 openSUSE Tumbleweed:php7-ctype-7.4.24-2.1 openSUSE Tumbleweed:php7-curl-7.4.24-2.1 openSUSE Tumbleweed:php7-dba-7.4.24-2.1 openSUSE Tumbleweed:php7-devel-7.4.24-2.1 openSUSE Tumbleweed:php7-dom-7.4.24-2.1 openSUSE Tumbleweed:php7-enchant-7.4.24-2.1 openSUSE Tumbleweed:php7-exif-7.4.24-2.1 openSUSE Tumbleweed:php7-fileinfo-7.4.24-2.1 openSUSE Tumbleweed:php7-ftp-7.4.24-2.1 openSUSE Tumbleweed:php7-gd-7.4.24-2.1 openSUSE Tumbleweed:php7-gettext-7.4.24-2.1 openSUSE Tumbleweed:php7-gmp-7.4.24-2.1 openSUSE Tumbleweed:php7-iconv-7.4.24-2.1 openSUSE Tumbleweed:php7-intl-7.4.24-2.1 openSUSE Tumbleweed:php7-json-7.4.24-2.1 openSUSE Tumbleweed:php7-ldap-7.4.24-2.1 openSUSE Tumbleweed:php7-mbstring-7.4.24-2.1 openSUSE Tumbleweed:php7-mysql-7.4.24-2.1 openSUSE Tumbleweed:php7-odbc-7.4.24-2.1 openSUSE Tumbleweed:php7-opcache-7.4.24-2.1 openSUSE Tumbleweed:php7-openssl-7.4.24-2.1 openSUSE Tumbleweed:php7-pcntl-7.4.24-2.1 openSUSE Tumbleweed:php7-pdo-7.4.24-2.1 openSUSE Tumbleweed:php7-pgsql-7.4.24-2.1 openSUSE Tumbleweed:php7-phar-7.4.24-2.1 openSUSE Tumbleweed:php7-posix-7.4.24-2.1 openSUSE Tumbleweed:php7-readline-7.4.24-2.1 openSUSE Tumbleweed:php7-shmop-7.4.24-2.1 openSUSE Tumbleweed:php7-snmp-7.4.24-2.1 openSUSE Tumbleweed:php7-soap-7.4.24-2.1 openSUSE Tumbleweed:php7-sockets-7.4.24-2.1 openSUSE Tumbleweed:php7-sodium-7.4.24-2.1 openSUSE Tumbleweed:php7-sqlite-7.4.24-2.1 openSUSE Tumbleweed:php7-sysvmsg-7.4.24-2.1 openSUSE Tumbleweed:php7-sysvsem-7.4.24-2.1 openSUSE Tumbleweed:php7-sysvshm-7.4.24-2.1 openSUSE Tumbleweed:php7-tidy-7.4.24-2.1 openSUSE Tumbleweed:php7-tokenizer-7.4.24-2.1 openSUSE Tumbleweed:php7-xmlreader-7.4.24-2.1 openSUSE Tumbleweed:php7-xmlrpc-7.4.24-2.1 openSUSE Tumbleweed:php7-xmlwriter-7.4.24-2.1 openSUSE Tumbleweed:php7-xsl-7.4.24-2.1 openSUSE Tumbleweed:php7-zip-7.4.24-2.1 openSUSE Tumbleweed:php7-zlib-7.4.24-2.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2021-21702.html CVE-2021-21702 https://bugzilla.suse.com/1182049 SUSE Bug 1182049