SUSE update for php72

Published: 2022-11-11 | Updated: 2023-10-27

Risk	Medium
Patch available	YES
Number of vulnerabilities	2
CVE-ID	CVE-2022-31628 CVE-2022-31629
CWE-ID	CWE-835 CWE-254
Exploitation vector	Network
Public exploit	Public exploit code for vulnerability #2 is available.
Vulnerable software Subscribe	SUSE Linux Enterprise Server for SAP Applications Operating systems & Components / Operating system SUSE Linux Enterprise High Performance Computing Operating systems & Components / Operating system SUSE Linux Enterprise Server Operating systems & Components / Operating system SUSE Linux Enterprise Module for Web Scripting Operating systems & Components / Operating system SUSE Linux Enterprise Software Development Kit Operating systems & Components / Operating system php72-pear-Archive_Tar Operating systems & Components / Operating system package or component php72-pear Operating systems & Components / Operating system package or component php72-zlib-debuginfo Operating systems & Components / Operating system package or component php72-zlib Operating systems & Components / Operating system package or component php72-zip-debuginfo Operating systems & Components / Operating system package or component php72-zip Operating systems & Components / Operating system package or component php72-xsl-debuginfo Operating systems & Components / Operating system package or component php72-xsl Operating systems & Components / Operating system package or component php72-xmlwriter-debuginfo Operating systems & Components / Operating system package or component php72-xmlwriter Operating systems & Components / Operating system package or component php72-xmlrpc-debuginfo Operating systems & Components / Operating system package or component php72-xmlrpc Operating systems & Components / Operating system package or component php72-xmlreader-debuginfo Operating systems & Components / Operating system package or component php72-xmlreader Operating systems & Components / Operating system package or component php72-wddx-debuginfo Operating systems & Components / Operating system package or component php72-wddx Operating systems & Components / Operating system package or component php72-tokenizer-debuginfo Operating systems & Components / Operating system package or component php72-tokenizer Operating systems & Components / Operating system package or component php72-tidy-debuginfo Operating systems & Components / Operating system package or component php72-tidy Operating systems & Components / Operating system package or component php72-sysvshm-debuginfo Operating systems & Components / Operating system package or component php72-sysvshm Operating systems & Components / Operating system package or component php72-sysvsem-debuginfo Operating systems & Components / Operating system package or component php72-sysvsem Operating systems & Components / Operating system package or component php72-sysvmsg-debuginfo Operating systems & Components / Operating system package or component php72-sysvmsg Operating systems & Components / Operating system package or component php72-sqlite-debuginfo Operating systems & Components / Operating system package or component php72-sqlite Operating systems & Components / Operating system package or component php72-sodium-debuginfo Operating systems & Components / Operating system package or component php72-sodium Operating systems & Components / Operating system package or component php72-sockets-debuginfo Operating systems & Components / Operating system package or component php72-sockets Operating systems & Components / Operating system package or component php72-soap-debuginfo Operating systems & Components / Operating system package or component php72-soap Operating systems & Components / Operating system package or component php72-snmp-debuginfo Operating systems & Components / Operating system package or component php72-snmp Operating systems & Components / Operating system package or component php72-shmop-debuginfo Operating systems & Components / Operating system package or component php72-shmop Operating systems & Components / Operating system package or component php72-readline-debuginfo Operating systems & Components / Operating system package or component php72-readline Operating systems & Components / Operating system package or component php72-pspell-debuginfo Operating systems & Components / Operating system package or component php72-pspell Operating systems & Components / Operating system package or component php72-posix-debuginfo Operating systems & Components / Operating system package or component php72-posix Operating systems & Components / Operating system package or component php72-phar-debuginfo Operating systems & Components / Operating system package or component php72-phar Operating systems & Components / Operating system package or component php72-pgsql-debuginfo Operating systems & Components / Operating system package or component php72-pgsql Operating systems & Components / Operating system package or component php72-pdo-debuginfo Operating systems & Components / Operating system package or component php72-pdo Operating systems & Components / Operating system package or component php72-pcntl-debuginfo Operating systems & Components / Operating system package or component php72-pcntl Operating systems & Components / Operating system package or component php72-openssl-debuginfo Operating systems & Components / Operating system package or component php72-openssl Operating systems & Components / Operating system package or component php72-opcache-debuginfo Operating systems & Components / Operating system package or component php72-opcache Operating systems & Components / Operating system package or component php72-odbc-debuginfo Operating systems & Components / Operating system package or component php72-odbc Operating systems & Components / Operating system package or component php72-mysql-debuginfo Operating systems & Components / Operating system package or component php72-mysql Operating systems & Components / Operating system package or component php72-mbstring-debuginfo Operating systems & Components / Operating system package or component php72-mbstring Operating systems & Components / Operating system package or component php72-ldap-debuginfo Operating systems & Components / Operating system package or component php72-ldap Operating systems & Components / Operating system package or component php72-json-debuginfo Operating systems & Components / Operating system package or component php72-json Operating systems & Components / Operating system package or component php72-intl-debuginfo Operating systems & Components / Operating system package or component php72-intl Operating systems & Components / Operating system package or component php72-imap-debuginfo Operating systems & Components / Operating system package or component php72-imap Operating systems & Components / Operating system package or component php72-iconv-debuginfo Operating systems & Components / Operating system package or component php72-iconv Operating systems & Components / Operating system package or component php72-gmp-debuginfo Operating systems & Components / Operating system package or component php72-gmp Operating systems & Components / Operating system package or component php72-gettext-debuginfo Operating systems & Components / Operating system package or component php72-gettext Operating systems & Components / Operating system package or component php72-gd-debuginfo Operating systems & Components / Operating system package or component php72-gd Operating systems & Components / Operating system package or component php72-ftp-debuginfo Operating systems & Components / Operating system package or component php72-ftp Operating systems & Components / Operating system package or component php72-fpm-debuginfo Operating systems & Components / Operating system package or component php72-fpm Operating systems & Components / Operating system package or component php72-fileinfo-debuginfo Operating systems & Components / Operating system package or component php72-fileinfo Operating systems & Components / Operating system package or component php72-fastcgi-debuginfo Operating systems & Components / Operating system package or component php72-fastcgi Operating systems & Components / Operating system package or component php72-exif-debuginfo Operating systems & Components / Operating system package or component php72-exif Operating systems & Components / Operating system package or component php72-enchant-debuginfo Operating systems & Components / Operating system package or component php72-enchant Operating systems & Components / Operating system package or component php72-dom-debuginfo Operating systems & Components / Operating system package or component php72-dom Operating systems & Components / Operating system package or component php72-dba-debuginfo Operating systems & Components / Operating system package or component php72-dba Operating systems & Components / Operating system package or component php72-curl-debuginfo Operating systems & Components / Operating system package or component php72-curl Operating systems & Components / Operating system package or component php72-ctype-debuginfo Operating systems & Components / Operating system package or component php72-ctype Operating systems & Components / Operating system package or component php72-calendar-debuginfo Operating systems & Components / Operating system package or component php72-calendar Operating systems & Components / Operating system package or component php72-bz2-debuginfo Operating systems & Components / Operating system package or component php72-bz2 Operating systems & Components / Operating system package or component php72-bcmath-debuginfo Operating systems & Components / Operating system package or component php72-bcmath Operating systems & Components / Operating system package or component php72 Operating systems & Components / Operating system package or component apache2-mod_php72-debuginfo Operating systems & Components / Operating system package or component apache2-mod_php72 Operating systems & Components / Operating system package or component php72-devel Operating systems & Components / Operating system package or component php72-debugsource Operating systems & Components / Operating system package or component php72-debuginfo Operating systems & Components / Operating system package or component
Vendor	SUSE

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Infinite loop

EUVDB-ID: #VU67755

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-31628

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop within the phar uncompressor code when processing "quines" gzip files. A remote attacker can pass a specially crafted archive to the application, consume all available system resources and cause denial of service conditions.

Mitigation

Update the affected package php72 to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Server for SAP Applications: 12-SP3 - 12-SP5

SUSE Linux Enterprise High Performance Computing: 12

SUSE Linux Enterprise Server: 12-SP2-LTSS-ERICSSON - 12-SP5

SUSE Linux Enterprise Module for Web Scripting: 12

SUSE Linux Enterprise Software Development Kit: 12-SP5

php72-pear-Archive_Tar: before 7.2.5-1.84.1

php72-pear: before 7.2.5-1.84.1

php72-zlib-debuginfo: before 7.2.5-1.84.1

php72-zlib: before 7.2.5-1.84.1

php72-zip-debuginfo: before 7.2.5-1.84.1

php72-zip: before 7.2.5-1.84.1

php72-xsl-debuginfo: before 7.2.5-1.84.1

php72-xsl: before 7.2.5-1.84.1

php72-xmlwriter-debuginfo: before 7.2.5-1.84.1

php72-xmlwriter: before 7.2.5-1.84.1

php72-xmlrpc-debuginfo: before 7.2.5-1.84.1

php72-xmlrpc: before 7.2.5-1.84.1

php72-xmlreader-debuginfo: before 7.2.5-1.84.1

php72-xmlreader: before 7.2.5-1.84.1

php72-wddx-debuginfo: before 7.2.5-1.84.1

php72-wddx: before 7.2.5-1.84.1

php72-tokenizer-debuginfo: before 7.2.5-1.84.1

php72-tokenizer: before 7.2.5-1.84.1

php72-tidy-debuginfo: before 7.2.5-1.84.1

php72-tidy: before 7.2.5-1.84.1

php72-sysvshm-debuginfo: before 7.2.5-1.84.1

php72-sysvshm: before 7.2.5-1.84.1

php72-sysvsem-debuginfo: before 7.2.5-1.84.1

php72-sysvsem: before 7.2.5-1.84.1

php72-sysvmsg-debuginfo: before 7.2.5-1.84.1

php72-sysvmsg: before 7.2.5-1.84.1

php72-sqlite-debuginfo: before 7.2.5-1.84.1

php72-sqlite: before 7.2.5-1.84.1

php72-sodium-debuginfo: before 7.2.5-1.84.1

php72-sodium: before 7.2.5-1.84.1

php72-sockets-debuginfo: before 7.2.5-1.84.1

php72-sockets: before 7.2.5-1.84.1

php72-soap-debuginfo: before 7.2.5-1.84.1

php72-soap: before 7.2.5-1.84.1

php72-snmp-debuginfo: before 7.2.5-1.84.1

php72-snmp: before 7.2.5-1.84.1

php72-shmop-debuginfo: before 7.2.5-1.84.1

php72-shmop: before 7.2.5-1.84.1

php72-readline-debuginfo: before 7.2.5-1.84.1

php72-readline: before 7.2.5-1.84.1

php72-pspell-debuginfo: before 7.2.5-1.84.1

php72-pspell: before 7.2.5-1.84.1

php72-posix-debuginfo: before 7.2.5-1.84.1

php72-posix: before 7.2.5-1.84.1

php72-phar-debuginfo: before 7.2.5-1.84.1

php72-phar: before 7.2.5-1.84.1

php72-pgsql-debuginfo: before 7.2.5-1.84.1

php72-pgsql: before 7.2.5-1.84.1

php72-pdo-debuginfo: before 7.2.5-1.84.1

php72-pdo: before 7.2.5-1.84.1

php72-pcntl-debuginfo: before 7.2.5-1.84.1

php72-pcntl: before 7.2.5-1.84.1

php72-openssl-debuginfo: before 7.2.5-1.84.1

php72-openssl: before 7.2.5-1.84.1

php72-opcache-debuginfo: before 7.2.5-1.84.1

php72-opcache: before 7.2.5-1.84.1

php72-odbc-debuginfo: before 7.2.5-1.84.1

php72-odbc: before 7.2.5-1.84.1

php72-mysql-debuginfo: before 7.2.5-1.84.1

php72-mysql: before 7.2.5-1.84.1

php72-mbstring-debuginfo: before 7.2.5-1.84.1

php72-mbstring: before 7.2.5-1.84.1

php72-ldap-debuginfo: before 7.2.5-1.84.1

php72-ldap: before 7.2.5-1.84.1

php72-json-debuginfo: before 7.2.5-1.84.1

php72-json: before 7.2.5-1.84.1

php72-intl-debuginfo: before 7.2.5-1.84.1

php72-intl: before 7.2.5-1.84.1

php72-imap-debuginfo: before 7.2.5-1.84.1

php72-imap: before 7.2.5-1.84.1

php72-iconv-debuginfo: before 7.2.5-1.84.1

php72-iconv: before 7.2.5-1.84.1

php72-gmp-debuginfo: before 7.2.5-1.84.1

php72-gmp: before 7.2.5-1.84.1

php72-gettext-debuginfo: before 7.2.5-1.84.1

php72-gettext: before 7.2.5-1.84.1

php72-gd-debuginfo: before 7.2.5-1.84.1

php72-gd: before 7.2.5-1.84.1

php72-ftp-debuginfo: before 7.2.5-1.84.1

php72-ftp: before 7.2.5-1.84.1

php72-fpm-debuginfo: before 7.2.5-1.84.1

php72-fpm: before 7.2.5-1.84.1

php72-fileinfo-debuginfo: before 7.2.5-1.84.1

php72-fileinfo: before 7.2.5-1.84.1

php72-fastcgi-debuginfo: before 7.2.5-1.84.1

php72-fastcgi: before 7.2.5-1.84.1

php72-exif-debuginfo: before 7.2.5-1.84.1

php72-exif: before 7.2.5-1.84.1

php72-enchant-debuginfo: before 7.2.5-1.84.1

php72-enchant: before 7.2.5-1.84.1

php72-dom-debuginfo: before 7.2.5-1.84.1

php72-dom: before 7.2.5-1.84.1

php72-dba-debuginfo: before 7.2.5-1.84.1

php72-dba: before 7.2.5-1.84.1

php72-curl-debuginfo: before 7.2.5-1.84.1

php72-curl: before 7.2.5-1.84.1

php72-ctype-debuginfo: before 7.2.5-1.84.1

php72-ctype: before 7.2.5-1.84.1

php72-calendar-debuginfo: before 7.2.5-1.84.1

php72-calendar: before 7.2.5-1.84.1

php72-bz2-debuginfo: before 7.2.5-1.84.1

php72-bz2: before 7.2.5-1.84.1

php72-bcmath-debuginfo: before 7.2.5-1.84.1

php72-bcmath: before 7.2.5-1.84.1

php72: before 7.2.5-1.84.1

apache2-mod_php72-debuginfo: before 7.2.5-1.84.1

apache2-mod_php72: before 7.2.5-1.84.1

php72-devel: before 7.2.5-1.84.1

php72-debugsource: before 7.2.5-1.84.1

php72-debuginfo: before 7.2.5-1.84.1

External links

http://www.suse.com/support/update/announcement/2022/suse-su-20223957-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Security features bypass

EUVDB-ID: #VU67756

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C]

CVE-ID: CVE-2022-31629

CWE-ID: CWE-254 - Security Features