Security update for php72 SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2022:3957-1 Final 1 1 2022-11-11T14:10:12Z current 2022-11-11T14:10:12Z 2022-11-11T14:10:12Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for php72 This update for php72 fixes the following issues: - CVE-2022-31628: Fixed an uncontrolled recursion in the phar uncompressor while decompressing 'quines' gzip files. (bsc#1203867) - CVE-2022-31629: Fixed a bug which could lead an attacker to set an insecure cookie that will treated as secure in the victim's browser. (bsc#1203870) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2022-3957,SUSE-SLE-Module-Web-Scripting-12-2022-3957,SUSE-SLE-SDK-12-SP5-2022-3957 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2022/suse-su-20223957-1/ Link for SUSE-SU-2022:3957-1 https://lists.suse.com/pipermail/sle-security-updates/2022-November/012902.html E-Mail link for SUSE-SU-2022:3957-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1203867 SUSE Bug 1203867 https://bugzilla.suse.com/1203870 SUSE Bug 1203870 https://www.suse.com/security/cve/CVE-2022-31628/ SUSE CVE CVE-2022-31628 page https://www.suse.com/security/cve/CVE-2022-31629/ SUSE CVE CVE-2022-31629 page SUSE Linux Enterprise Module for Web and Scripting 12 SUSE Linux Enterprise Software Development Kit 12 SP5 apache2-mod_php72-7.2.5-1.84.1 php72-7.2.5-1.84.1 php72-bcmath-7.2.5-1.84.1 php72-bz2-7.2.5-1.84.1 php72-calendar-7.2.5-1.84.1 php72-ctype-7.2.5-1.84.1 php72-curl-7.2.5-1.84.1 php72-dba-7.2.5-1.84.1 php72-devel-7.2.5-1.84.1 php72-dom-7.2.5-1.84.1 php72-embed-7.2.5-1.84.1 php72-enchant-7.2.5-1.84.1 php72-exif-7.2.5-1.84.1 php72-fastcgi-7.2.5-1.84.1 php72-fileinfo-7.2.5-1.84.1 php72-fpm-7.2.5-1.84.1 php72-ftp-7.2.5-1.84.1 php72-gd-7.2.5-1.84.1 php72-gettext-7.2.5-1.84.1 php72-gmp-7.2.5-1.84.1 php72-iconv-7.2.5-1.84.1 php72-imap-7.2.5-1.84.1 php72-intl-7.2.5-1.84.1 php72-json-7.2.5-1.84.1 php72-ldap-7.2.5-1.84.1 php72-mbstring-7.2.5-1.84.1 php72-mysql-7.2.5-1.84.1 php72-odbc-7.2.5-1.84.1 php72-opcache-7.2.5-1.84.1 php72-openssl-7.2.5-1.84.1 php72-pcntl-7.2.5-1.84.1 php72-pdo-7.2.5-1.84.1 php72-pear-7.2.5-1.84.1 php72-pear-Archive_Tar-7.2.5-1.84.1 php72-pgsql-7.2.5-1.84.1 php72-phar-7.2.5-1.84.1 php72-posix-7.2.5-1.84.1 php72-pspell-7.2.5-1.84.1 php72-readline-7.2.5-1.84.1 php72-shmop-7.2.5-1.84.1 php72-snmp-7.2.5-1.84.1 php72-soap-7.2.5-1.84.1 php72-sockets-7.2.5-1.84.1 php72-sodium-7.2.5-1.84.1 php72-sqlite-7.2.5-1.84.1 php72-sysvmsg-7.2.5-1.84.1 php72-sysvsem-7.2.5-1.84.1 php72-sysvshm-7.2.5-1.84.1 php72-tidy-7.2.5-1.84.1 php72-tokenizer-7.2.5-1.84.1 php72-wddx-7.2.5-1.84.1 php72-xmlreader-7.2.5-1.84.1 php72-xmlrpc-7.2.5-1.84.1 php72-xmlwriter-7.2.5-1.84.1 php72-xsl-7.2.5-1.84.1 php72-zip-7.2.5-1.84.1 php72-zlib-7.2.5-1.84.1 apache2-mod_php72-7.2.5-1.84.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-7.2.5-1.84.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-bcmath-7.2.5-1.84.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-bz2-7.2.5-1.84.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-calendar-7.2.5-1.84.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-ctype-7.2.5-1.84.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-curl-7.2.5-1.84.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-dba-7.2.5-1.84.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-dom-7.2.5-1.84.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-enchant-7.2.5-1.84.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-exif-7.2.5-1.84.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-fastcgi-7.2.5-1.84.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-fileinfo-7.2.5-1.84.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-fpm-7.2.5-1.84.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-ftp-7.2.5-1.84.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-gd-7.2.5-1.84.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-gettext-7.2.5-1.84.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-gmp-7.2.5-1.84.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-iconv-7.2.5-1.84.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-imap-7.2.5-1.84.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-intl-7.2.5-1.84.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-json-7.2.5-1.84.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-ldap-7.2.5-1.84.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-mbstring-7.2.5-1.84.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-mysql-7.2.5-1.84.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-odbc-7.2.5-1.84.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-opcache-7.2.5-1.84.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-openssl-7.2.5-1.84.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-pcntl-7.2.5-1.84.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-pdo-7.2.5-1.84.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-pear-7.2.5-1.84.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-pear-Archive_Tar-7.2.5-1.84.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-pgsql-7.2.5-1.84.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-phar-7.2.5-1.84.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-posix-7.2.5-1.84.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-pspell-7.2.5-1.84.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-readline-7.2.5-1.84.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-shmop-7.2.5-1.84.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-snmp-7.2.5-1.84.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-soap-7.2.5-1.84.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-sockets-7.2.5-1.84.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-sodium-7.2.5-1.84.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-sqlite-7.2.5-1.84.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-sysvmsg-7.2.5-1.84.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-sysvsem-7.2.5-1.84.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-sysvshm-7.2.5-1.84.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-tidy-7.2.5-1.84.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-tokenizer-7.2.5-1.84.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-wddx-7.2.5-1.84.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-xmlreader-7.2.5-1.84.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-xmlrpc-7.2.5-1.84.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-xmlwriter-7.2.5-1.84.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-xsl-7.2.5-1.84.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-zip-7.2.5-1.84.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-zlib-7.2.5-1.84.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-devel-7.2.5-1.84.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the phar uncompressor code would recursively uncompress "quines" gzip files, resulting in an infinite loop. CVE-2022-31628 SUSE Linux Enterprise Module for Web and Scripting 12:apache2-mod_php72-7.2.5-1.84.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-7.2.5-1.84.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-bcmath-7.2.5-1.84.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-bz2-7.2.5-1.84.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-calendar-7.2.5-1.84.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-ctype-7.2.5-1.84.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-curl-7.2.5-1.84.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-dba-7.2.5-1.84.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-dom-7.2.5-1.84.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-enchant-7.2.5-1.84.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-exif-7.2.5-1.84.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-fastcgi-7.2.5-1.84.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-fileinfo-7.2.5-1.84.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-fpm-7.2.5-1.84.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-ftp-7.2.5-1.84.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-gd-7.2.5-1.84.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-gettext-7.2.5-1.84.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-gmp-7.2.5-1.84.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-iconv-7.2.5-1.84.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-imap-7.2.5-1.84.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-intl-7.2.5-1.84.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-json-7.2.5-1.84.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-ldap-7.2.5-1.84.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-mbstring-7.2.5-1.84.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-mysql-7.2.5-1.84.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-odbc-7.2.5-1.84.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-opcache-7.2.5-1.84.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-openssl-7.2.5-1.84.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-pcntl-7.2.5-1.84.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-pdo-7.2.5-1.84.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-pear-7.2.5-1.84.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-pear-Archive_Tar-7.2.5-1.84.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-pgsql-7.2.5-1.84.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-phar-7.2.5-1.84.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-posix-7.2.5-1.84.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-pspell-7.2.5-1.84.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-readline-7.2.5-1.84.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-shmop-7.2.5-1.84.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-snmp-7.2.5-1.84.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-soap-7.2.5-1.84.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-sockets-7.2.5-1.84.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-sodium-7.2.5-1.84.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-sqlite-7.2.5-1.84.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-sysvmsg-7.2.5-1.84.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-sysvsem-7.2.5-1.84.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-sysvshm-7.2.5-1.84.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-tidy-7.2.5-1.84.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-tokenizer-7.2.5-1.84.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-wddx-7.2.5-1.84.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-xmlreader-7.2.5-1.84.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-xmlrpc-7.2.5-1.84.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-xmlwriter-7.2.5-1.84.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-xsl-7.2.5-1.84.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-zip-7.2.5-1.84.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-zlib-7.2.5-1.84.1 SUSE Linux Enterprise Software Development Kit 12 SP5:php72-devel-7.2.5-1.84.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20223957-1/ https://www.suse.com/security/cve/CVE-2022-31628.html CVE-2022-31628 https://bugzilla.suse.com/1203867 SUSE Bug 1203867 In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the vulnerability enables network and same-site attackers to set a standard insecure cookie in the victim's browser which is treated as a `__Host-` or `__Secure-` cookie by PHP applications. CVE-2022-31629 SUSE Linux Enterprise Module for Web and Scripting 12:apache2-mod_php72-7.2.5-1.84.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-7.2.5-1.84.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-bcmath-7.2.5-1.84.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-bz2-7.2.5-1.84.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-calendar-7.2.5-1.84.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-ctype-7.2.5-1.84.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-curl-7.2.5-1.84.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-dba-7.2.5-1.84.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-dom-7.2.5-1.84.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-enchant-7.2.5-1.84.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-exif-7.2.5-1.84.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-fastcgi-7.2.5-1.84.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-fileinfo-7.2.5-1.84.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-fpm-7.2.5-1.84.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-ftp-7.2.5-1.84.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-gd-7.2.5-1.84.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-gettext-7.2.5-1.84.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-gmp-7.2.5-1.84.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-iconv-7.2.5-1.84.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-imap-7.2.5-1.84.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-intl-7.2.5-1.84.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-json-7.2.5-1.84.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-ldap-7.2.5-1.84.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-mbstring-7.2.5-1.84.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-mysql-7.2.5-1.84.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-odbc-7.2.5-1.84.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-opcache-7.2.5-1.84.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-openssl-7.2.5-1.84.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-pcntl-7.2.5-1.84.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-pdo-7.2.5-1.84.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-pear-7.2.5-1.84.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-pear-Archive_Tar-7.2.5-1.84.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-pgsql-7.2.5-1.84.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-phar-7.2.5-1.84.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-posix-7.2.5-1.84.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-pspell-7.2.5-1.84.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-readline-7.2.5-1.84.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-shmop-7.2.5-1.84.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-snmp-7.2.5-1.84.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-soap-7.2.5-1.84.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-sockets-7.2.5-1.84.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-sodium-7.2.5-1.84.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-sqlite-7.2.5-1.84.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-sysvmsg-7.2.5-1.84.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-sysvsem-7.2.5-1.84.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-sysvshm-7.2.5-1.84.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-tidy-7.2.5-1.84.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-tokenizer-7.2.5-1.84.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-wddx-7.2.5-1.84.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-xmlreader-7.2.5-1.84.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-xmlrpc-7.2.5-1.84.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-xmlwriter-7.2.5-1.84.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-xsl-7.2.5-1.84.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-zip-7.2.5-1.84.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-zlib-7.2.5-1.84.1 SUSE Linux Enterprise Software Development Kit 12 SP5:php72-devel-7.2.5-1.84.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20223957-1/ https://www.suse.com/security/cve/CVE-2022-31629.html CVE-2022-31629 https://bugzilla.suse.com/1203870 SUSE Bug 1203870 https://bugzilla.suse.com/1222857 SUSE Bug 1222857