# PHP.

Every CVE that names PHP among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first (an older page)

- [Missing error check and insufficient random bytes in HTTP Digest authentication for SOAP](https://agentprime.io/advisories/CVE-2023-3247.md)
  `CVE-2023-3247` · CVE record: PHP Group PHP · CVSS 2.6 Low · Not analysed yet · Published 22 Jul 2023 · Tags: Weak cryptography or TLS, CWE-252
- [Array overrun in common path resolve code](https://agentprime.io/advisories/CVE-2023-0568.md)
  `CVE-2023-0568` · CVE record: PHP Group PHP · CVSS 7.5 High · Not analysed yet · Published 16 Feb 2023 · Tags: Memory corruption
- [DoS vulnerability when parsing multipart request body](https://agentprime.io/advisories/CVE-2023-0662.md)
  `CVE-2023-0662` · CVE record: PHP Group PHP · CVSS 7.5 High · Not analysed yet · Published 16 Feb 2023 · Tags: Denial of service
- [password_verify() always returns true for some invalid hashes](https://agentprime.io/advisories/CVE-2023-0567.md)
  `CVE-2023-0567` · CVE record: PHP Group PHP · CVSS 7.7 High · Not analysed yet · Published 16 Feb 2023 · Tags: Weak cryptography or TLS
- [OOB read due to insufficient input validation in imageloadfont()](https://agentprime.io/advisories/CVE-2022-31630.md)
  `CVE-2022-31630` · CVE record: PHP Group PHP · CVSS 6.5 Medium · Not analysed yet · Published 14 Nov 2022 · Tags: Memory corruption
- [$\_COOKIE names string replacement (. -> \_): cookie integrity vulnerabilities](https://agentprime.io/advisories/CVE-2022-31629.md)
  `CVE-2022-31629` · CVE record: PHP Group PHP · CVSS 6.5 Medium · EPSS 0.50 · Not analysed yet · Published 28 Sept 2022 · Tags: CWE-20, CWE-1284
- [phar wrapper can occur dos when using quine gzip file](https://agentprime.io/advisories/CVE-2022-31628.md)
  `CVE-2022-31628` · CVE record: PHP Group PHP · CVSS 2.3 Low · Not analysed yet · Published 28 Sept 2022 · Tags: Denial of service
- [Heap buffer overflow in finfo_buffer](https://agentprime.io/advisories/CVE-2022-31627.md)
  `CVE-2022-31627` · CVE record: PHP Group PHP · CVSS 7.7 High · Not analysed yet · Published 28 Jul 2022 · Tags: CWE-590
- [mysqlnd/pdo password buffer overflow](https://agentprime.io/advisories/CVE-2022-31626.md)
  `CVE-2022-31626` · CVE record: PHP Group PHP · CVSS 7.5 High · Critical (CVSS 7+ and EPSS) · EPSS 0.58 · Not analysed yet · Published 16 Jun 2022 · Tags: Memory corruption
- [Freeing unallocated memory in php_pgsql_free_params()](https://agentprime.io/advisories/CVE-2022-31625.md)
  `CVE-2022-31625` · CVE record: PHP Group PHP · CVSS 8.1 High · Not analysed yet · Published 16 Jun 2022 · Tags: Memory corruption, CWE-590
- [UAF due to php_filter_float() failing](https://agentprime.io/advisories/CVE-2021-21708.md)
  `CVE-2021-21708` · CVE record: PHP Group PHP · CVSS 8.2 High · Not analysed yet · Published 27 Feb 2022 · Tags: Memory corruption
- [Special characters break path parsing in XML functions](https://agentprime.io/advisories/CVE-2021-21707.md)
  `CVE-2021-21707` · CVE record: PHP Group PHP · CVSS 5.3 Medium · EPSS 0.25 · Not analysed yet · Published 29 Nov 2021 · Tags: CWE-159
- [PHP-FPM memory access in root process leading to privilege escalation](https://agentprime.io/advisories/CVE-2021-21703.md)
  `CVE-2021-21703` · CVE record: PHP Group PHP · CVSS 7.8 High · Not analysed yet · Published 25 Oct 2021 · Tags: Broken access control, Memory corruption
- [ZipArchive::extractTo may extract outside of destination dir](https://agentprime.io/advisories/CVE-2021-21706.md)
  `CVE-2021-21706` · CVE record: PHP Group PHP · CVSS 5.3 Medium · Not analysed yet · Published 4 Oct 2021 · Tags: Path traversal
- [Incorrect URL validation in FILTER_VALIDATE_URL](https://agentprime.io/advisories/CVE-2021-21705.md)
  `CVE-2021-21705` · CVE record: PHP Group PHP · CVSS 4.3 Medium · Not analysed yet · Published 4 Oct 2021 · Tags: CWE-20
- [Multiple vulnerabilities in Firebird client extension](https://agentprime.io/advisories/CVE-2021-21704.md)
  `CVE-2021-21704` · CVE record: PHP Group PHP · CVSS 5.0 Medium · Not analysed yet · Published 4 Oct 2021 · Tags: Memory corruption
- [Null Dereference in SoapClient](https://agentprime.io/advisories/CVE-2021-21702.md)
  `CVE-2021-21702` · CVE record: PHP Group PHP · CVSS 5.3 Medium · Not analysed yet · Published 15 Feb 2021 · Tags: Memory corruption
- [FILTER_VALIDATE_URL accepts URLs with invalid userinfo](https://agentprime.io/advisories/CVE-2020-7071.md)
  `CVE-2020-7071` · CVE record: PHP Group PHP · CVSS 5.3 Medium · Not analysed yet · Published 15 Feb 2021 · Tags: CWE-20
- [PHP parses encoded cookie names so malicious \`\_\_Host-\` cookies can be sent](https://agentprime.io/advisories/CVE-2020-7070.md)
  `CVE-2020-7070` · CVE record: PHP Group PHP · CVSS 4.3 Medium · Not analysed yet · Published 2 Oct 2020 · Tags: CWE-20
- [Wrong ciphertext/tag in AES-CCM encryption for a 12 bytes IV](https://agentprime.io/advisories/CVE-2020-7069.md)
  `CVE-2020-7069` · CVE record: PHP Group PHP · CVSS 5.4 Medium · Not analysed yet · Published 2 Oct 2020 · Tags: CWE-20
- [Use of freed hash key in the phar_parse_zipfile function](https://agentprime.io/advisories/CVE-2020-7068.md)
  `CVE-2020-7068` · CVE record: PHP Group PHP · CVSS 4.8 Medium · Not analysed yet · Published 9 Sept 2020 · Tags: Memory corruption
- [Temporary files are not cleaned after OOM when parsing HTTP request data](https://agentprime.io/advisories/CVE-2019-11048.md)
  `CVE-2019-11048` · CVE record: PHP Group PHP · CVSS 5.3 Medium · Not analysed yet · Published 20 May 2020 · Tags: Memory corruption, Denial of service
- [OOB Read in urldecode()](https://agentprime.io/advisories/CVE-2020-7067.md)
  `CVE-2020-7067` · CVE record: PHP Group PHP · CVSS 7.5 High · Not analysed yet · Published 27 Apr 2020 · Tags: Memory corruption, CWE-196
- [get_headers() silently truncates after a null byte](https://agentprime.io/advisories/CVE-2020-7066.md)
  `CVE-2020-7066` · CVE record: PHP Group PHP · CVSS 5.3 Medium · Not analysed yet · Published 1 Apr 2020 · Tags: CWE-170
- [mb_strtolower (UTF-32LE): stack-buffer-overflow at php_unicode_tolower_full](https://agentprime.io/advisories/CVE-2020-7065.md)
  `CVE-2020-7065` · CVE record: PHP Group PHP · CVSS 7.4 High · Not analysed yet · Published 1 Apr 2020 · Tags: Memory corruption
- [Use-of-uninitialized-value in exif](https://agentprime.io/advisories/CVE-2020-7064.md)
  `CVE-2020-7064` · CVE record: PHP Group PHP · CVSS 6.5 Medium · Not analysed yet · Published 1 Apr 2020 · Tags: Memory corruption
- [Files added to tar with Phar::buildFromIterator have all-access permissions](https://agentprime.io/advisories/CVE-2020-7063.md)
  `CVE-2020-7063` · CVE record: PHP Group PHP · CVSS 5.5 Medium · Not analysed yet · Published 27 Feb 2020 · Tags: CWE-281
- [Null Pointer Dereference in PHP Session Upload Progress](https://agentprime.io/advisories/CVE-2020-7062.md)
  `CVE-2020-7062` · CVE record: PHP Group PHP · CVSS 7.5 High · Not analysed yet · Published 27 Feb 2020 · Tags: Memory corruption
- [heap-buffer-overflow in phar_extract_file](https://agentprime.io/advisories/CVE-2020-7061.md)
  `CVE-2020-7061` · CVE record: PHP Group PHP · CVSS 6.5 Medium · Not analysed yet · Published 27 Feb 2020 · Tags: Memory corruption
- [PHP: Use-after-free vulnerability in the add_post_var function in the Posthandler component in…](https://agentprime.io/advisories/CVE-2014-3622.md)
  `CVE-2014-3622` · CVE record: PHP PHP · No CVSS score · Not analysed yet · Published 19 Feb 2020
- [global buffer-overflow in mbfl_filt_conv_big5_wchar](https://agentprime.io/advisories/CVE-2020-7060.md)
  `CVE-2020-7060` · CVE record: PHP Group PHP · CVSS 6.5 Medium · Not analysed yet · Published 10 Feb 2020 · Tags: Memory corruption
- [OOB read in php_strip_tags_ex](https://agentprime.io/advisories/CVE-2020-7059.md)
  `CVE-2020-7059` · CVE record: PHP Group PHP · CVSS 6.5 Medium · Not analysed yet · Published 10 Feb 2020 · Tags: Memory corruption
- [Use-after-free in exif parsing under memory sanitizer](https://agentprime.io/advisories/CVE-2019-11050.md)
  `CVE-2019-11050` · CVE record: PHP Group PHP · CVSS 4.8 Medium · Not analysed yet · Published 23 Dec 2019 · Tags: Memory corruption
- [mail() may release string with refcount==1 twice](https://agentprime.io/advisories/CVE-2019-11049.md)
  `CVE-2019-11049` · CVE record: PHP Group PHP · CVSS 6.5 Medium · Not analysed yet · Published 23 Dec 2019 · Tags: Memory corruption
- [Heap-buffer-overflow READ in exif](https://agentprime.io/advisories/CVE-2019-11047.md)
  `CVE-2019-11047` · CVE record: PHP Group PHP · CVSS 4.8 Medium · Not analysed yet · Published 23 Dec 2019 · Tags: Memory corruption
- [Buffer underflow in bc_shift_addsub](https://agentprime.io/advisories/CVE-2019-11046.md)
  `CVE-2019-11046` · CVE record: PHP Group PHP · CVSS 3.7 Low · Not analysed yet · Published 23 Dec 2019 · Tags: Memory corruption
- [DirectoryIterator class silently truncates after a null byte](https://agentprime.io/advisories/CVE-2019-11045.md)
  `CVE-2019-11045` · CVE record: PHP Group PHP · CVSS 3.7 Low · Not analysed yet · Published 23 Dec 2019 · Tags: CWE-170
- [link() silently truncates after a null byte on Windows](https://agentprime.io/advisories/CVE-2019-11044.md)
  `CVE-2019-11044` · CVE record: PHP Group PHP · CVSS 3.7 Low · Not analysed yet · Published 23 Dec 2019 · Tags: CWE-170
- [SQL injection vulnerability in Zend Framework 1.10.x before 1.10.9 and 1.11.x before 1.11.6 when using non-ASCII-compatible encodings in conjunction PDO_MySql in PHP before 5.3.6.](https://agentprime.io/advisories/CVE-2011-1939.md)
  `CVE-2011-1939` · CVE record: zendframework;PHP zendframework and 1 more · No CVSS score · Not analysed yet · Published 26 Nov 2019
- [Underflow in PHP-FPM can lead to RCE](https://agentprime.io/advisories/CVE-2019-11043.md)
  `CVE-2019-11043` · CVE record: PHP PHP · CVSS 8.7 High · Critical (KEV, CVSS 7+ and EPSS) · In CISA KEV, ransomware · EPSS 1.00 · Not analysed yet · Published 28 Oct 2019 · Tags: Memory corruption
- [heap-buffer-overflow on exif_process_user_comment in EXIF extension](https://agentprime.io/advisories/CVE-2019-11042.md)
  `CVE-2019-11042` · CVE record: PHP Group PHP · CVSS 4.8 Medium · Not analysed yet · Published 9 Aug 2019 · Tags: Memory corruption
- [heap-buffer-overflow on exif_scan_thumbnail in EXIF extension](https://agentprime.io/advisories/CVE-2019-11041.md)
  `CVE-2019-11041` · CVE record: PHP Group PHP · CVSS 4.8 Medium · Not analysed yet · Published 9 Aug 2019 · Tags: Memory corruption
- [Heap buffer overflow in EXIF extension](https://agentprime.io/advisories/CVE-2019-11040.md)
  `CVE-2019-11040` · CVE record: PHP Group PHP · CVSS 4.8 Medium · Not analysed yet · Published 18 Jun 2019 · Tags: Memory corruption
- [Out-of-bounds read in iconv.c](https://agentprime.io/advisories/CVE-2019-11039.md)
  `CVE-2019-11039` · CVE record: PHP Group PHP · CVSS 4.2 Medium · Not analysed yet · Published 18 Jun 2019 · Tags: Memory corruption
- [Uninitialized read in gdImageCreateFromXbm](https://agentprime.io/advisories/CVE-2019-11038.md)
  `CVE-2019-11038` · CVE record: PHP Group PHP · CVSS 3.1 Low · Not analysed yet · Published 18 Jun 2019 · Tags: Memory corruption
- [Heap over-read in PHP EXIF extension](https://agentprime.io/advisories/CVE-2019-11036.md)
  `CVE-2019-11036` · CVE record: PHP Group PHP · CVSS 4.8 Medium · Not analysed yet · Published 3 May 2019 · Tags: CWE-126
- [Heap over-read in PHP EXIF extension](https://agentprime.io/advisories/CVE-2019-11035.md)
  `CVE-2019-11035` · CVE record: PHP Group PHP · CVSS 4.8 Medium · Not analysed yet · Published 18 Apr 2019 · Tags: Memory corruption
- [Heap over-read in PHP EXIF extension](https://agentprime.io/advisories/CVE-2019-11034.md)
  `CVE-2019-11034` · CVE record: PHP Group PHP · CVSS 4.8 Medium · Not analysed yet · Published 18 Apr 2019 · Tags: Memory corruption

Newest: <https://agentprime.io/advisories/technology/php.md>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=php&cursor=WyIyMDIzLTA4LTExVDA1OjQyOjI1Ljc3MTAwMFoiLCJDVkUtMjAyMy0zODIzIl0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/php/?cursor=WyIyMDIzLTA4LTExVDA1OjQyOjI1Ljc3MTAwMFoiLCJDVkUtMjAyMy0zODIzIl0>. Everything for agents: <https://agentprime.io/llms.txt>.