Threats Tagged 'cve-2026-7262'

Multiple security vulnerabilities affecting PHP 8.2 on Red Hat Enterprise Linux 8 have been addressed in a security update. These include a denial of service via improper handling of signed characters in ctype functions, a cross-site scripting vulnerability in PHP-FPM due to improper URL sanitation, a NULL pointer dereference in the SOAP apache:Map decoder, and a signed integer overflow in the metaphone() function. The update is rated as important by Red Hat Product Security. No CVSS scores are provided in the advisory. The vulnerabilities affect PHP 8.2 packages distributed with Red Hat Enterprise Linux 8.

Multiple security vulnerabilities have been identified and addressed in the php:8.2 module for Red Hat Enterprise Linux 9. These include a denial of service via improper handling of signed characters in ctype functions, a cross-site scripting vulnerability in PHP-FPM due to improper URL sanitation, a NULL pointer dereference in the SOAP apache:Map decoder, and a signed integer overflow in the metaphone() function. Red Hat has released an important security update to fix these issues.

This security update for PHP 8 addresses multiple vulnerabilities including SQL injection, out-of-bounds reads, use-after-free, cross-site scripting (XSS), denial of service, memory corruption, information disclosure, and infinite loops. The update also includes an upgrade to PHP version 8.4.21. These issues affect various components such as the PDO Firebird driver, mbstring encoding functions, SOAP handling, PHP-FPM status page, ctype functions, and XML processing.

In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, when a SOAP server has a typemap configured, the decoding process contains a mistake which checks the wrong variable in case of missing value element.  This leads to dereferences a NULL pointer, causing a segmentation fault. This allows a remote unauthenticated attacker to crash the PHP SOAP server process, resulting in denial of service.

In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, 8.5.* before 8.5.6, due to improper sanitation of user data, it allows an attacker to compose an URL, which will cause the target to execute arbitrary JavaScript code (XSS) on the target's machine when the target is viewing the PHP-FPM status page.

In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.

In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, when an encoding name containing an embedded NUL byte is passed to mb_convert_encoding() or related mbstring functions, the code incorrectly assumes that when strncasecmp() returns 0 it means the strings have the same length. This can lead to out-of-bounds read of global memory, potentially causing a crash or information disclosure or crash. Affected functions include mb_convert_encoding(), mb_detect_encoding(), mb_convert_variables(), and mb_detect_order(), as well as the mbstring.detect_order and mbstring.http_output INI settings.