Search for packages
| purl | pkg:rpm/redhat/php@8.0.27-1?arch=el9_1 |
| Next non-vulnerable version | None. |
| Latest non-vulnerable version | None. |
| Risk | 4.5 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-11jg-tu1t-abh6
Aliases: CVE-2022-31629 |
Multiple vulnerabilities have been found in PHP, the worst of which could result in arbitrary code execution. | There are no reported fixed by versions. |
|
VCID-2dg4-b7g9-eubx
Aliases: CVE-2022-31630 |
Multiple vulnerabilities have been found in PHP, the worst of which could result in arbitrary code execution. | There are no reported fixed by versions. |
|
VCID-b3v5-hed2-wqeb
Aliases: CVE-2022-31628 |
Multiple vulnerabilities have been found in PHP, the worst of which could result in arbitrary code execution. | There are no reported fixed by versions. |
|
VCID-ewbq-2gm8-tyf5
Aliases: CVE-2022-37454 GHSA-6w4m-2xhg-2658 |
Buffer overflow in sponge queue functions ### Impact The Keccak sponge function interface accepts partial inputs to be absorbed and partial outputs to be squeezed. A buffer can overflow when partial data with some specific sizes are queued, where at least one of them has a length of 2^32 - 200 bytes or more. ### Patches Yes, see commit [fdc6fef0](https://github.com/XKCP/XKCP/commit/fdc6fef075f4e81d6b1bc38364248975e08e340a). ### Workarounds The problem can be avoided by limiting the size of the partial input data (or partial output digest) below 2^32 - 200 bytes. Multiple calls to the queue system can be chained at a higher level to retain the original functionality. Alternatively, one can process the entire input (or produce the entire output) at once, avoiding the queuing functions altogether. ### References See [issue #105](https://github.com/XKCP/XKCP/issues/105) for more details. | There are no reported fixed by versions. |
|
VCID-mtw1-k8na-2udv
Aliases: CVE-2022-31631 |
Multiple vulnerabilities have been discovered in PHP, the worst of which can lead to a denial of service. | There are no reported fixed by versions. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||
| Date | Actor | Action | Vulnerability | Source | VulnerableCode Version |
|---|---|---|---|---|---|
| 2026-04-01T13:57:00.767048+00:00 | RedHat Importer | Affected by | VCID-b3v5-hed2-wqeb | https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-31628.json | 38.0.0 |
| 2026-04-01T13:57:00.737105+00:00 | RedHat Importer | Affected by | VCID-11jg-tu1t-abh6 | https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-31629.json | 38.0.0 |
| 2026-04-01T13:56:33.597294+00:00 | RedHat Importer | Affected by | VCID-ewbq-2gm8-tyf5 | https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-37454.json | 38.0.0 |
| 2026-04-01T13:56:31.551282+00:00 | RedHat Importer | Affected by | VCID-2dg4-b7g9-eubx | https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-31630.json | 38.0.0 |
| 2026-04-01T13:55:54.504312+00:00 | RedHat Importer | Affected by | VCID-mtw1-k8na-2udv | https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-31631.json | 38.0.0 |