[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <2add2962-34f5-4b4c-abfe-f780501c3a4e@oracle.com>
Date: Sat, 12 Apr 2025 08:58:59 -0700
From: Alan Coopersmith <alan.coopersmith@...cle.com>
To: oss-security@...ts.openwall.com
Subject: Security audit of PHP
https://blog.quarkslab.com/security-audit-of-php-src.html announces the
completion of a security audit of PHP by Quarkslab, thanks to funding
provided by Sovereign Tech Fund to The Open Source Technology Improvement Fund.
The blog provides details and a link to the audit report for more.
The summary it provides of the findings is:
> 2 security issues considered as high severity;
> 6 security issues considered as medium severity;
> 9 security issues considered as low severity;
> 10 issues considered informative.
>
> Most vulnerabilities have been shared via security advisories on the PHP-SRC
> GitHub repository. Other bugs and issues are provided only in this report.
>
> Four CVEs were issued, namely:
>
> CVE-2024-9026 for LOW-2;
> CVE-2024-8925 for LOW-4;
> CVE-2024-8928 for HIGH-1;
> CVE-2024-8929 for HIGH-2.
These correspond to the following security advisories from the PHP github repo:
CVE-2024-9026: [PHP-FPM] Logs from childrens may be altered
https://github.com/php/php-src/security/advisories/GHSA-865w-9rf3-2wh5
Published Sep 27, 2024
Fixed in 8.1.30, 8.2.24, & 8.3.12
CVE-2024-8925: Erroneous parsing of multipart form data
https://github.com/php/php-src/security/advisories/GHSA-9pqp-7h25-4f32
Published Sep 27, 2024
Fixed in 8.1.30, 8.2.24, & 8.3.12
CVE-2024-8929: [Mysqlnd] Leak partial content of the heap through heap buffer over-read
https://github.com/php/php-src/security/advisories/GHSA-h35g-vwh6-m678
Published Nov 21, 2024
Fixed in 8.1.31, 8.2.26, & 8.3.14
CVE-2024-8928 is still marked reserved & not yet published, the report lists it
as "Details to be shared after fixes are applied".
The Quarkslab blog also points to corresponding blogs from the PHP Foundation
and the Open Source Technology Improvement Fund at:
https://thephp.foundation/blog/2025/04/10/php-core-security-audit-results/
https://ostif.org/php-audit-complete/
--
-Alan Coopersmith- alan.coopersmith@...cle.com
Oracle Solaris Engineering - https://blogs.oracle.com/solaris
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
