6.5
Moyenne
CVE-2024-2756 Due to an incomplete fix to CVE-2022-31629 https://github.com/advisories/GHSA-c43m-486j-j32p , network and same-site…
Description
Due to an incomplete fix to CVE-2022-31629 https://github.com/advisories/GHSA-c43m-486j-j32p , network and same-site attackers can set a standard insecure cookie in the victim's browser which is treated as a __Host- or __Secure- cookie by PHP applications.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| PHP 8.3 | premières → < 8.3.5 | 8.3.5 |
| PHP 8.2 | premières → < 8.2.18 | 8.2.18 |
| PHP 8.1 | premières → < 8.1.28 | 8.1.28 |
| archive_tar | Versions non publiées |
Références
- github.com github.com
- www.openwall.com www.openwall.com
- lists.debian.org lists.debian.org
- security.netapp.com security.netapp.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de PHP
Les 103 CVE de PHP →
CVE-2026-109619
RCE via stale global state
9.2
Critique
CVE-2026-109618
RCE via OOM corruption
9.2
Critique
CVE-2026-92842
The convert.base64-encode, convert.quoted-printable-encode and convert.quoted-printable-decode stream filters accept a…
5.9
Moyenne
CVE-2026-91768
The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so…
6.5
Moyenne