debian/php7.4 vulnerabilities

Latest debian/php7.4 CVEs

Newest publication first · page 1 of 2

1. DLA-4447-1 php7.4 - security update

   Published 2026-01-24

   Unknown

2. DLA-4254-1 php7.4 - security update

   Published 2025-07-27

   Unknown

3. DLA-4088-1 php7.4 - security update

   Published 2025-03-20

   Unknown

4. DLA-3986-1 php7.4 - security update

   Published 2024-12-08

   Unknown

5. DLA-3920-1 php7.4 - security update

   Published 2024-10-14

   Unknown

6. DSA-5660-1 php7.4 - security update

   Published 2024-04-15

   Unknown

7. CVE-2022-4900 Potential buffer overflow in php_cli_server_startup_workers

   Published 2023-11-02

   Medium·CVSS 5.5

   A vulnerability was found in PHP where setting the environment variable PHP_CLI_SERVER_WORKERS to a large value leads to a heap buffer overflow.

8. DSA-5424-1 php7.4 - security update

   Published 2023-06-13

   Unknown

9. DSA-5363-1 php7.4 - security update

   Published 2023-02-24

   Unknown

10. CVE-2022-31630 OOB read due to insufficient input validation in imageloadfont()

    Published 2022-11-14

    High·CVSS 7.1

    In PHP versions prior to 7.4.33, 8.0.25 and 8.1.12, when using imageloadfont() function in gd extension, it is possible to supply a specially crafted font file, such as if the loaded font is used with imagechar() function, the read outside allocated buffer will be used. This can...

11. DSA-5277-1 php7.4 - security update

    Published 2022-11-13

    Unknown

12. CVE-2022-31629 $_COOKIE names string replacement (. -> _): cookie integrity vulnerabilities

    Published 2022-09-28

    Medium·CVSS 6.5

    In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the vulnerability enables network and same-site attackers to set a standard insecure cookie in the victim's browser which is treated as a __Host- or __Secure- cookie by PHP applications.

13. CVE-2022-31628 phar wrapper can occur dos when using quine gzip file

    Published 2022-09-28

    Medium·CVSS 5.5

    In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the phar uncompressor code would recursively uncompress "quines" gzip files, resulting in an infinite loop.

14. DSA-5179-1 php7.4 - security update

    Published 2022-07-08

    Unknown

15. CVE-2022-31626 mysqlnd/pdo password buffer overflow

    Published 2022-06-16

    High·CVSS 8.8

    In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when pdo_mysql extension with mysqlnd driver, if the third party is allowed to supply host to connect to and the password for the connection, password of excessive length can trigger a buffer overflow...

16. CVE-2022-31625 Freeing unallocated memory in php_pgsql_free_params()

    Published 2022-06-16

    High·CVSS 8.1

    In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when using Postgres database extension, supplying invalid parameters to the parametrized query may lead to PHP attempting to free memory using uninitialized data as pointers. This could lead to RCE vul...

17. CVE-2021-21708 UAF due to php_filter_float() failing

    Published 2022-02-27

    Critical·CVSS 9.8

    In PHP versions 7.4.x below 7.4.28, 8.0.x below 8.0.16, and 8.1.x below 8.1.3, when using filter functions with FILTER_VALIDATE_FLOAT filter and min/max limits, if the filter fails, there is a possibility to trigger use of allocated memory after free, which can result it crashes,...

18. DSA-5082-1 php7.4 - security update

    Published 2022-02-18

    Unknown

19. CVE-2021-21707 Special characters break path parsing in XML functions

    Published 2021-11-29

    Medium·CVSS 5.3

    In PHP versions 7.3.x below 7.3.33, 7.4.x below 7.4.26 and 8.0.x below 8.0.13, certain XML parsing functions, like simplexml_load_file(), URL-decode the filename passed to them. If that filename contains URL-encoded NUL character, this may cause the function to interpret this as...

20. CVE-2021-21703 PHP-FPM memory access in root process leading to privilege escalation

    Published 2021-10-25

    High·CVSS 7.0

    In PHP versions 7.3.x up to and including 7.3.31, 7.4.x below 7.4.25 and 8.0.x below 8.0.12, when running PHP FPM SAPI with main FPM daemon process running as root and child worker processes running as lower-privileged users, it is possible for the child processes to access memor...

21. DSA-4992-1 php7.4 - security update

    Published 2021-10-25

    Unknown

22. CVE-2021-21705 Incorrect URL validation in FILTER_VALIDATE_URL

    Published 2021-10-04

    Medium·CVSS 5.3

    In PHP versions 7.3.x below 7.3.29, 7.4.x below 7.4.21 and 8.0.x below 8.0.8, when using URL validation functionality via filter_var() function with FILTER_VALIDATE_URL parameter, an URL with invalid password field can be accepted as valid. This can lead to the code incorrectly p...

23. CVE-2021-21704 Multiple vulnerabilities in Firebird client extension

    Published 2021-10-04

    Medium·CVSS 5.9

    In PHP versions 7.3.x below 7.3.29, 7.4.x below 7.4.21 and 8.0.x below 8.0.8, when using Firebird PDO driver extension, a malicious database server could cause crashes in various database functions, such as getAttribute(), execute(), fetch() and others by returning invalid respon...

24. CVE-2021-21702 Null Dereference in SoapClient

    Published 2021-02-15

    High·CVSS 7.5

    In PHP versions 7.3.x below 7.3.27, 7.4.x below 7.4.15 and 8.0.x below 8.0.2, when using SOAP extension to connect to a SOAP server, a malicious SOAP server could return malformed XML data as a response that would cause PHP to access a null pointer and thus cause a crash.

25. CVE-2020-7071 FILTER_VALIDATE_URL accepts URLs with invalid userinfo

    Published 2021-02-15

    Medium·CVSS 5.3

    In PHP versions 7.3.x below 7.3.26, 7.4.x below 7.4.14 and 8.0.0, when validating URL with functions like filter_var($url, FILTER_VALIDATE_URL), PHP will accept an URL with invalid password as valid URL. This may lead to functions that rely on URL being valid to mis-parse the URL...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.