Input validation error in PHP - #VU120274

Vulnerability identifier: #VU120274

CSH Severity: Low

CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:L/SA:N]

CVE-ID: N/A

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to tamper with application workflow.

The vulnerability exists due to insufficient validation of user-supplied input in dns_get_record() and other DNS functions. A remote attacker can pass specially crafted input with a NULL byte character to the application and tamper with application;s workflow, potentially performing SSRF attack. 

PHP
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
Web and Scripting Module
php8-pdo
php8-zlib-debuginfo
php8-shmop-debuginfo
php8-dba-debuginfo
php8-embed-debugsource
php8-bcmath-debuginfo
php8-gd-debuginfo
php8-fileinfo-debuginfo
php8-enchant
php8-shmop
php8-fastcgi-debuginfo
php8-embed
php8-exif
php8-zip-debuginfo
php8-iconv-debuginfo
php8-readline-debuginfo
php8-dom
php8-sysvsem-debuginfo
php8-phar-debuginfo
php8-exif-debuginfo
php8-intl
php8-readline
php8-ftp
php8-iconv
php8-ftp-debuginfo
php8-odbc
php8-fpm-debugsource
php8-fastcgi
php8-odbc-debuginfo
php8-enchant-debuginfo
php8-zlib
php8-sodium
php8-debugsource
php8-fastcgi-debugsource
php8-xmlreader
php8-phar
php8-debuginfo
php8-pgsql-debuginfo
php8-curl-debuginfo
php8-snmp
php8-gettext
php8-sockets
php8-ctype
php8-openssl
php8-tidy
php8-fpm-debuginfo
php8-ldap-debuginfo
php8-xmlreader-debuginfo
php8-bz2-debuginfo
php8-sqlite
php8-dom-debuginfo
php8-sodium-debuginfo
apache2-mod_php8
php8-xmlwriter
php8-calendar
php8-curl
php8
php8-pdo-debuginfo
php8-mbstring-debuginfo
php8-ctype-debuginfo
php8-sysvsem
php8-sysvshm-debuginfo
php8-dba
php8-snmp-debuginfo
php8-gmp
php8-gmp-debuginfo
php8-tidy-debuginfo
php8-opcache-debuginfo
php8-devel
php8-intl-debuginfo
php8-bcmath
php8-soap-debuginfo
php8-sysvmsg
php8-mbstring
php8-cli-debuginfo
apache2-mod_php8-debugsource
php8-tokenizer-debuginfo
php8-pcntl-debuginfo
php8-embed-debuginfo
php8-pcntl
php8-soap
php8-mysql-debuginfo
php8-tokenizer
php8-sysvshm
php8-fpm
php8-openssl-debuginfo
php8-posix
php8-pgsql
php8-fileinfo
php8-xsl
php8-xsl-debuginfo
php8-sysvmsg-debuginfo
php8-cli
php8-sockets-debuginfo
php8-opcache
php8-sqlite-debuginfo
php8-xmlwriter-debuginfo
php8-calendar-debuginfo
php8-ldap
php8-bz2
php8-gettext-debuginfo
php8-zip
php8-posix-debuginfo
php8-mysql
apache2-mod_php8-debuginfo
php8-test
php8-gd

Install updates from vendor's website.

PHP - addressed in versions 8.1.34, 8.2.30, 8.3.29, 8.4.16, 8.5.1
php8-pdo - update to 8.3.23-150700.3.6.1
php8-zlib-debuginfo - update to 8.3.23-150700.3.6.1
php8-shmop-debuginfo - update to 8.3.23-150700.3.6.1
php8-dba-debuginfo - update to 8.3.23-150700.3.6.1
php8-embed-debugsource - update to 8.3.23-150700.3.6.1
php8-bcmath-debuginfo - update to 8.3.23-150700.3.6.1
php8-gd-debuginfo - update to 8.3.23-150700.3.6.1
php8-fileinfo-debuginfo - update to 8.3.23-150700.3.6.1
php8-enchant - update to 8.3.23-150700.3.6.1
php8-shmop - update to 8.3.23-150700.3.6.1
php8-fastcgi-debuginfo - update to 8.3.23-150700.3.6.1
php8-embed - update to 8.3.23-150700.3.6.1
php8-exif - update to 8.3.23-150700.3.6.1
php8-zip-debuginfo - update to 8.3.23-150700.3.6.1
php8-iconv-debuginfo - update to 8.3.23-150700.3.6.1
php8-readline-debuginfo - update to 8.3.23-150700.3.6.1
php8-dom - update to 8.3.23-150700.3.6.1
php8-sysvsem-debuginfo - update to 8.3.23-150700.3.6.1
php8-phar-debuginfo - update to 8.3.23-150700.3.6.1
php8-exif-debuginfo - update to 8.3.23-150700.3.6.1
php8-intl - update to 8.3.23-150700.3.6.1
php8-readline - update to 8.3.23-150700.3.6.1
php8-ftp - update to 8.3.23-150700.3.6.1
php8-iconv - update to 8.3.23-150700.3.6.1
php8-ftp-debuginfo - update to 8.3.23-150700.3.6.1
php8-odbc - update to 8.3.23-150700.3.6.1
php8-fpm-debugsource - update to 8.3.23-150700.3.6.1
php8-fastcgi - update to 8.3.23-150700.3.6.1
php8-odbc-debuginfo - update to 8.3.23-150700.3.6.1
php8-enchant-debuginfo - update to 8.3.23-150700.3.6.1
php8-zlib - update to 8.3.23-150700.3.6.1
php8-sodium - update to 8.3.23-150700.3.6.1
php8-debugsource - update to 8.3.23-150700.3.6.1
php8-fastcgi-debugsource - update to 8.3.23-150700.3.6.1
php8-xmlreader - update to 8.3.23-150700.3.6.1
php8-phar - update to 8.3.23-150700.3.6.1
php8-debuginfo - update to 8.3.23-150700.3.6.1
php8-pgsql-debuginfo - update to 8.3.23-150700.3.6.1
php8-curl-debuginfo - update to 8.3.23-150700.3.6.1
php8-snmp - update to 8.3.23-150700.3.6.1
php8-gettext - update to 8.3.23-150700.3.6.1
php8-sockets - update to 8.3.23-150700.3.6.1
php8-ctype - update to 8.3.23-150700.3.6.1
php8-openssl - update to 8.3.23-150700.3.6.1
php8-tidy - update to 8.3.23-150700.3.6.1
php8-fpm-debuginfo - update to 8.3.23-150700.3.6.1
php8-ldap-debuginfo - update to 8.3.23-150700.3.6.1
php8-xmlreader-debuginfo - update to 8.3.23-150700.3.6.1
php8-bz2-debuginfo - update to 8.3.23-150700.3.6.1
php8-sqlite - update to 8.3.23-150700.3.6.1
php8-dom-debuginfo - update to 8.3.23-150700.3.6.1
php8-sodium-debuginfo - update to 8.3.23-150700.3.6.1
apache2-mod_php8 - update to 8.3.23-150700.3.6.1
php8-xmlwriter - update to 8.3.23-150700.3.6.1
php8-calendar - update to 8.3.23-150700.3.6.1
php8-curl - update to 8.3.23-150700.3.6.1
php8 - update to 8.3.23-150700.3.6.1
php8-pdo-debuginfo - update to 8.3.23-150700.3.6.1
php8-mbstring-debuginfo - update to 8.3.23-150700.3.6.1
php8-ctype-debuginfo - update to 8.3.23-150700.3.6.1
php8-sysvsem - update to 8.3.23-150700.3.6.1
php8-sysvshm-debuginfo - update to 8.3.23-150700.3.6.1
php8-dba - update to 8.3.23-150700.3.6.1
php8-snmp-debuginfo - update to 8.3.23-150700.3.6.1
php8-gmp - update to 8.3.23-150700.3.6.1
php8-gmp-debuginfo - update to 8.3.23-150700.3.6.1
php8-tidy-debuginfo - update to 8.3.23-150700.3.6.1
php8-opcache-debuginfo - update to 8.3.23-150700.3.6.1
php8-devel - update to 8.3.23-150700.3.6.1
php8-intl-debuginfo - update to 8.3.23-150700.3.6.1
php8-bcmath - update to 8.3.23-150700.3.6.1
php8-soap-debuginfo - update to 8.3.23-150700.3.6.1
php8-sysvmsg - update to 8.3.23-150700.3.6.1
php8-mbstring - update to 8.3.23-150700.3.6.1
php8-cli-debuginfo - update to 8.3.23-150700.3.6.1
apache2-mod_php8-debugsource - update to 8.3.23-150700.3.6.1
php8-tokenizer-debuginfo - update to 8.3.23-150700.3.6.1
php8-pcntl-debuginfo - update to 8.3.23-150700.3.6.1
php8-embed-debuginfo - update to 8.3.23-150700.3.6.1
php8-pcntl - update to 8.3.23-150700.3.6.1
php8-soap - update to 8.3.23-150700.3.6.1
php8-mysql-debuginfo - update to 8.3.23-150700.3.6.1
php8-tokenizer - update to 8.3.23-150700.3.6.1
php8-sysvshm - update to 8.3.23-150700.3.6.1
php8-fpm - update to 8.3.23-150700.3.6.1
php8-openssl-debuginfo - update to 8.3.23-150700.3.6.1
php8-posix - update to 8.3.23-150700.3.6.1
php8-pgsql - update to 8.3.23-150700.3.6.1
php8-fileinfo - update to 8.3.23-150700.3.6.1
php8-xsl - update to 8.3.23-150700.3.6.1
php8-xsl-debuginfo - update to 8.3.23-150700.3.6.1
php8-sysvmsg-debuginfo - update to 8.3.23-150700.3.6.1
php8-cli - update to 8.3.23-150700.3.6.1
php8-sockets-debuginfo - update to 8.3.23-150700.3.6.1
php8-opcache - update to 8.3.23-150700.3.6.1
php8-sqlite-debuginfo - update to 8.3.23-150700.3.6.1
php8-xmlwriter-debuginfo - update to 8.3.23-150700.3.6.1
php8-calendar-debuginfo - update to 8.3.23-150700.3.6.1
php8-ldap - update to 8.3.23-150700.3.6.1
php8-bz2 - update to 8.3.23-150700.3.6.1
php8-gettext-debuginfo - update to 8.3.23-150700.3.6.1
php8-zip - update to 8.3.23-150700.3.6.1
php8-posix-debuginfo - update to 8.3.23-150700.3.6.1
php8-mysql - update to 8.3.23-150700.3.6.1
apache2-mod_php8-debuginfo - update to 8.3.23-150700.3.6.1
php8-test - update to 8.3.23-150700.3.6.1
php8-gd - update to 8.3.23-150700.3.6.1

• https://www.php.net/ChangeLog-8.php#8.5.1
• https://www.php.net/ChangeLog-8.php#8.3.29
• https://www.php.net/ChangeLog-8.php#8.2.30
• https://www.php.net/ChangeLog-8.php#8.4.16
• https://www.php.net/ChangeLog-8.php#8.1.34
• https://github.com/php/php-src/security/advisories/GHSA-www2-q4fc-65wf

• Multiple vulnerabilities in PHP
• SUSE update for php8