Php (Php Group) - vulnerabilities (CVEs)

103 CVEs, 2 in the last 30 days, 11 known versions, newest CVE from 2026-10-21. Vendor: Php Group.

CVEs of Php

• CVE-2026-109619 - CVSS 9.2 (critical), 2026-10-21: PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated…
• CVE-2026-109618 - CVSS 9.8 (critical), 2026-10-21: PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for…
• CVE-2026-92842 - CVSS 5.9 (medium), 2026-09-25: The convert.base64-encode, convert.quoted-printable-encode and convert.quoted-printable-decode stream filters accept a line-break-chars option whose length is…
• CVE-2026-91768 - CVSS 6.5 (medium), 2026-09-25: The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so listen.allowed_clients matches on a /96…
• CVE-2026-91769 - CVSS 4.3 (medium), 2026-09-25: PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matches, falls back to the Common Name.…
• CVE-2026-91767 - CVSS 6.5 (medium), 2026-09-25: php_openssl_matches_wildcard_name() in ext/openssl/xp_ssl.c underflows the length argument passed to memchr() when a TLS server certificate presents a…
• CVE-2025-1218 - CVSS 5.9 (medium), 2026-09-25: The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them. A malicious or…
• CVE-2026-91766 - CVSS 5.9 (medium), 2026-09-25: When the http:// stream wrapper follows a redirect it forwards the user-supplied Authorization, Cookie and Proxy-Authorization headers unchanged, even when…
• CVE-2026-91765 - CVSS 7.5 (high), 2026-09-25: cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request…
• CVE-2025-14181 - CVSS 6.5 (medium), 2026-09-25: The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined behaviour and is not guaranteed…
• CVE-2026-17545 - CVSS 7.5 (high), 2026-09-25: On Windows, PHP's filesystem and stream APIs do not reject reserved device names such as CON, PRN, AUX, NUL, COM1 to COM9, LPT1 to LPT9, CONIN$ and CONOUT$…
• CVE-2026-6103 - CVSS 4.3 (medium), 2026-09-25: phar_tar_number() parses the octal size field of a TAR header into a uint32_t with no overflow check. The field is 11 octal digits wide and holds values up to…
• CVE-2026-93682 - CVSS 5.8 (medium), 2026-09-25: When the HTTP stream wrapper follows a redirect and the response carries a Location header with an empty value, the redirect code reads one byte past the end…
• CVE-2026-7260 - CVSS 5.5 (medium), 2026-07-30: Circular symbolic links in phar archives could lead to unbounded recursion, exhausting the C stack and crashing the PHP process, in PHP versions from 8.2.*…
• CVE-2026-17544 - CVSS 9.8 (critical), 2026-07-30: Attacker-provided inputs to bccomp() could lead to an out-of-bounds write with stack and heap corruption in PHP versions from 8.4.* before 8.4.24 and from…
• CVE-2026-17543 - CVSS 9.8 (critical), 2026-07-30: Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2.* before 8.2.33, from 8.3.*…
• CVE-2026-7263 - CVSS 7.5 (high), 2026-05-10: In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, DOMNode::C14N() method may process the XML data incorrectly, causing a circular linked list in the…
• CVE-2026-6104 - CVSS 9.1 (critical), 2026-05-10: In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, when an encoding name containing an embedded NUL byte is passed to mb_convert_encoding() or…
• CVE-2026-7262 - CVSS 7.5 (high), 2026-05-10: In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, when a SOAP server has a typemap configured, the…
• CVE-2026-6735 - CVSS 7.3 (high), 2026-05-10: In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, 8.5.* before 8.5.6, due to improper sanitation of user data, it allows an…
• CVE-2026-7261 - CVSS 9.8 (critical), 2026-05-10: In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, when SoapServer is configured with…
• CVE-2026-6722 - CVSS 9.8 (critical), 2026-05-10: In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism…
• CVE-2026-7259 - CVSS 6.5 (medium), 2026-05-10: In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, a mismatch between encoding lists in Oniguruma and mbfl…
• CVE-2026-7568 - CVSS 7.5 (high), 2026-05-10: In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the metaphone() function in ext/standard/metaphone.c…
• CVE-2026-7258 - CVSS 7.5 (high), 2026-05-10: In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, some functions, including urldecode(), pass signed char…
• CVE-2025-14179 - CVSS 9.8 (critical), 2026-05-10: In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes…
• CVE-2025-14180 - CVSS 8.2 (high), 2025-12-27: In PHP versions 8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1 when using the PDO PostgreSQL driver…
• CVE-2025-14178 - CVSS 8.2 (high), 2025-12-27: In PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1, a heap buffer overflow occurs in…
• CVE-2025-14177 - CVSS 7.5 (high), 2025-12-27: In PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1, the getimagesize() function may leak…
• CVE-2025-1735 - CVSS 7.5 (high), 2025-07-13: In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* pgsql and pdo_pgsql escaping functions do not check if the underlying…
• CVE-2025-1220 - CVSS 5.3 (medium), 2025-07-13: In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* before 8.4.10 some functions like fsockopen() lack validation that the…
• CVE-2025-6491 - CVSS 5.9 (medium), 2025-07-13: In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* before 8.4.10 when parsing XML data in SOAP extensions, overly large…
• CVE-2024-11235 - CVSS 9.2 (critical), 2025-04-04: In PHP versions 8.3.* before 8.3.19 and 8.4.* before 8.4.5, a code sequence involving __set handler or ??=  operator and exceptions can lead to a…
• CVE-2025-1734 - CVSS 6.3 (medium), 2025-03-30: In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when receiving headers from HTTP server, the…
• CVE-2025-1861 - CVSS 9.8 (critical), 2025-03-30: In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when parsing HTTP redirect in the response to an…
• CVE-2025-1736 - CVSS 7.3 (high), 2025-03-30: In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when user-supplied headers are sent, the…
• CVE-2025-1219 - CVSS 6.3 (medium), 2025-03-30: In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when requesting a HTTP resource using the DOM or…
• CVE-2025-1217 - CVSS 6.3 (medium), 2025-03-29: In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when http request module parses HTTP response…
• CVE-2022-31631 - CVSS 9.1 (critical), 2025-02-12: In PHP versions 8.0.* before 8.0.27, 8.1.* before 8.1.15, 8.2.* before 8.2.2 when using PDO::quote() function to quote user-supplied data for SQLite,…
• CVE-2024-11233 - CVSS 8.2 (high), 2024-11-24: In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, due to an error in convert.quoted-printable-decode filter certain data can lead…
• CVE-2024-11236 - CVSS 9.8 (critical), 2024-11-24: In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, uncontrolled long string inputs to ldap_escape() function on 32-bit systems can…
• CVE-2024-11234 - CVSS 7.2 (high), 2024-11-24: In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, when using streams with configured proxy and "request_fulluri" option, the URI…
• CVE-2024-8929 - CVSS 5.8 (medium), 2024-11-22: In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, a hostile MySQL server can cause the client to disclose the content of its heap…
• CVE-2024-8932 - CVSS 9.8 (critical), 2024-11-22: In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, uncontrolled long string inputs to ldap_escape() function on 32-bit systems can…
• CVE-2024-9026 - CVSS 3.3 (low), 2024-10-08: In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using PHP-FPM SAPI and it is configured to catch workers output through…
• CVE-2024-8927 - CVSS 7.5 (high), 2024-10-08: In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, HTTP_REDIRECT_STATUS variable is used to check whether or not CGI binary is…
• CVE-2024-8926 - CVSS 8.8 (high), 2024-10-08: In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using a certain non-standard configurations of Windows codepages, the…
• CVE-2024-8925 - CVSS 5.3 (medium), 2024-10-08: In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, erroneous parsing of multipart form data contained in an HTTP POST request…
• CVE-2024-4577 - CVSS 9.8 (critical), 2024-06-09: In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain…
• CVE-2024-2408 - CVSS 5.9 (medium), 2024-06-09: The openssl_private_decrypt function in PHP, when using PKCS1 padding (OPENSSL_PKCS1_PADDING, which is the default), is vulnerable to the Marvin Attack unless…
• CVE-2024-5458 - CVSS 5.3 (medium), 2024-06-09: In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, due to a code logic error, filtering functions such as filter_var when…
• CVE-2024-5585 - CVSS 8.8 (high), 2024-06-09: In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, the fix for CVE-2024-1874 does not work if the command name includes trailing…
• CVE-2024-3096 - CVSS 6.5 (medium), 2024-04-29: In PHP  version 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, if a password stored with password_hash() starts with a null byte (\x00),…
• CVE-2024-2757 - CVSS 7.5 (high), 2024-04-29: In PHP 8.3.* before 8.3.5, function mb_encode_mimeheader() runs endlessly for some inputs that contain long strings of non-space characters followed by a…
• CVE-2024-1874 - CVSS 9.4 (critical), 2024-04-29: In PHP versions 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, when using proc_open() command with array syntax, due to insufficient escaping,…
• CVE-2024-2756 - CVSS 6.5 (medium), 2024-04-29: Due to an incomplete fix to CVE-2022-31629 https://github.com/advisories/GHSA-c43m-486j-j32p , network and same-site attackers can set a standard insecure…
• CVE-2023-3824 - CVSS 9.8 (critical), 2023-08-11: In PHP version 8.0.* before 8.0.30,  8.1.* before 8.1.22, and 8.2.* before 8.2.8, when loading phar file, while reading PHAR directory entries, insufficient…
• CVE-2023-3823 - CVSS 8.6 (high), 2023-08-11: In PHP versions 8.0.* before 8.0.30, 8.1.* before 8.1.22, and 8.2.* before 8.2.8 various XML functions rely on libxml global state to track configuration…
• CVE-2023-3247 - CVSS 4.3 (medium), 2023-07-22: In PHP versions 8.0.* before 8.0.29, 8.1.* before 8.1.20, 8.2.* before 8.2.7 when using SOAP HTTP Digest Authentication, random value generator was not…
• CVE-2023-0567 - CVSS 8.1 (high), 2023-03-01: In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, password_verify() function may accept some invalid Blowfish hashes as valid. If such…
• CVE-2023-0568 - CVSS 8.1 (high), 2023-02-16: In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, core path resolution function allocate buffer one byte too small. When resolving paths…
• CVE-2023-0662 - CVSS 7.5 (high), 2023-02-16: In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, excessive number of parts in HTTP form upload can cause high resource consumption and…
• CVE-2022-31630 - CVSS 7.1 (high), 2022-11-14: In PHP versions prior to 7.4.33, 8.0.25 and 8.1.12, when using imageloadfont() function in gd extension, it is possible to supply a specially crafted font…
• CVE-2022-31629 - CVSS 6.5 (medium), 2022-09-28: In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the vulnerability enables network and same-site attackers to set a standard insecure cookie in the victim's…
• CVE-2022-31628 - CVSS 5.5 (medium), 2022-09-28: In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the phar uncompressor code would recursively uncompress "quines" gzip files, resulting in an infinite loop.
• CVE-2022-31627 - CVSS 9.8 (critical), 2022-07-28: In PHP versions 8.1.x below 8.1.8, when fileinfo functions, such as finfo_buffer, due to incorrect patch applied to the third party code from libmagic,…
• CVE-2022-31625 - CVSS 8.1 (high), 2022-06-16: In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when using Postgres database extension, supplying invalid parameters to the…
• CVE-2022-31626 - CVSS 8.8 (high), 2022-06-16: In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when pdo_mysql extension with mysqlnd driver, if the third party is allowed to…
• CVE-2021-21708 - CVSS 9.8 (critical), 2022-02-27: In PHP versions 7.4.x below 7.4.28, 8.0.x below 8.0.16, and 8.1.x below 8.1.3, when using filter functions with FILTER_VALIDATE_FLOAT filter and min/max…
• CVE-2021-21707 - CVSS 5.3 (medium), 2021-11-29: In PHP versions 7.3.x below 7.3.33, 7.4.x below 7.4.26 and 8.0.x below 8.0.13, certain XML parsing functions, like simplexml_load_file(), URL-decode the…
• CVE-2021-21703 - CVSS 7.8 (high), 2021-10-25: In PHP versions 7.3.x up to and including 7.3.31, 7.4.x below 7.4.25 and 8.0.x below 8.0.12, when running PHP FPM SAPI with main FPM daemon process running as…
• CVE-2021-21706 - CVSS 6.5 (medium), 2021-10-04: In PHP versions 7.3.x below 7.3.31, 7.4.x below 7.4.24 and 8.0.x below 8.0.11, in Microsoft Windows environment, ZipArchive::extractTo may be tricked into…
• CVE-2021-21705 - CVSS 5.3 (medium), 2021-10-04: In PHP versions 7.3.x below 7.3.29, 7.4.x below 7.4.21 and 8.0.x below 8.0.8, when using URL validation functionality via filter_var() function with…
• CVE-2021-21704 - CVSS 5.9 (medium), 2021-10-04: In PHP versions 7.3.x below 7.3.29, 7.4.x below 7.4.21 and 8.0.x below 8.0.8, when using Firebird PDO driver extension, a malicious database server could…
• CVE-2021-21702 - CVSS 7.5 (high), 2021-02-15: In PHP versions 7.3.x below 7.3.27, 7.4.x below 7.4.15 and 8.0.x below 8.0.2, when using SOAP extension to connect to a SOAP server, a malicious SOAP server…
• CVE-2020-7071 - CVSS 5.3 (medium), 2021-02-15: In PHP versions 7.3.x below 7.3.26, 7.4.x below 7.4.14 and 8.0.0, when validating URL with functions like filter_var($url, FILTER_VALIDATE_URL), PHP will…
• CVE-2020-7069 - CVSS 6.5 (medium), 2020-10-02: In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when AES-CCM mode is used with openssl_encrypt() function with 12 bytes IV,…
• CVE-2020-7070 - CVSS 5.3 (medium), 2020-10-02: In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when PHP is processing incoming HTTP cookie values, the cookie names are…
• CVE-2020-7068 - CVSS 4.8 (medium), 2020-09-09: In PHP versions 7.2.x below 7.2.33, 7.3.x below 7.3.21 and 7.4.x below 7.4.9, while processing PHAR files using phar extension, phar_parse_zipfile could be…
• CVE-2019-11048 - CVSS 5.3 (medium), 2020-05-20: In PHP versions 7.2.x below 7.2.31, 7.3.x below 7.3.18 and 7.4.x below 7.4.6, when HTTP file uploads are allowed, supplying overly long filenames or field…
• CVE-2020-7067 - CVSS 7.5 (high), 2020-04-27: In PHP versions 7.2.x below 7.2.30, 7.3.x below 7.3.17 and 7.4.x below 7.4.5, if PHP is compiled with EBCDIC support (uncommon), urldecode() function can be…
• CVE-2020-7066 - CVSS 5.3 (medium), 2020-04-01: In PHP versions 7.2.x below 7.2.29, 7.3.x below 7.3.16 and 7.4.x below 7.4.4, while using get_headers() with user-supplied URL, if the URL contains zero (\0)…
• CVE-2020-7064 - CVSS 6.5 (medium), 2020-04-01: In PHP versions 7.2.x below 7.2.9, 7.3.x below 7.3.16 and 7.4.x below 7.4.4, while parsing EXIF data with exif_read_data() function, it is possible for…
• CVE-2020-7065 - CVSS 8.8 (high), 2020-04-01: In PHP versions 7.3.x below 7.3.16 and 7.4.x below 7.4.4, while using mb_strtolower() function with UTF-32LE encoding, certain invalid strings could cause PHP…
• CVE-2020-7063 - CVSS 5.5 (medium), 2020-02-27: In PHP versions 7.2.x below 7.2.28, 7.3.x below 7.3.15 and 7.4.x below 7.4.3, when creating PHAR archive using PharData::buildFromIterator() function, the…
• CVE-2020-7062 - CVSS 7.5 (high), 2020-02-27: In PHP versions 7.2.x below 7.2.28, 7.3.x below 7.3.15 and 7.4.x below 7.4.3, when using file upload functionality, if upload progress tracking is enabled,…
• CVE-2020-7061 - CVSS 9.1 (critical), 2020-02-27: In PHP versions 7.3.x below 7.3.15 and 7.4.x below 7.4.3, while extracting PHAR files on Windows using phar extension, certain content inside PHAR file could…
• CVE-2020-7060 - CVSS 9.1 (critical), 2020-02-10: When using certain mbstring functions to convert multibyte encodings, in PHP versions 7.2.x below 7.2.27, 7.3.x below 7.3.14 and 7.4.x below 7.4.2 it is…
• CVE-2020-7059 - CVSS 9.1 (critical), 2020-02-10: When using fgetss() function to read data with stripping tags, in PHP versions 7.2.x below 7.2.27, 7.3.x below 7.3.14 and 7.4.x below 7.4.2 it is possible to…
• CVE-2019-11045 - CVSS 5.9 (medium), 2019-12-23: In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0, PHP DirectoryIterator class accepts filenames with embedded \0 byte and treats them as…
• CVE-2019-11049 - CVSS 9.8 (critical), 2019-12-23: In PHP versions 7.3.x below 7.3.13 and 7.4.0 on Windows, when supplying custom headers to mail() function, due to mistake introduced in commit…
• CVE-2019-11047 - CVSS 6.5 (medium), 2019-12-23: When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13…
• CVE-2019-11046 - CVSS 5.3 (medium), 2019-12-23: In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0, PHP bcmath extension functions on some systems, including Windows, can be tricked into…
• CVE-2019-11050 - CVSS 6.5 (medium), 2019-12-23: When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13…
• CVE-2019-11044 - CVSS 7.5 (high), 2019-12-23: In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0 on Windows, PHP link() function accepts filenames with embedded \0 byte and treats them as…
• CVE-2019-11041 - CVSS 7.1 (high), 2019-08-09: When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.1.x below 7.1.31, 7.2.x below 7.2.21…
• CVE-2019-11042 - CVSS 7.1 (high), 2019-08-09: When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.1.x below 7.1.31, 7.2.x below 7.2.21…
• CVE-2019-11038 - CVSS 5.3 (medium), 2019-06-19: When using the gdImageCreateFromXbm() function in the GD Graphics Library (aka LibGD) 2.2.5, as used in the PHP GD extension in PHP versions 7.1.x below…
• CVE-2019-11040 - CVSS 9.1 (critical), 2019-06-19: When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.1.x below 7.1.30, 7.2.x below 7.2.19…
• CVE-2019-11039 - CVSS 9.1 (critical), 2019-06-19: Function iconv_mime_decode_headers() in PHP versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and 7.3.x below 7.3.6 may perform out-of-buffer read due to…