Security update for php7 SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2021:2795-1 Final 1 1 2021-08-20T08:28:47Z current 2021-08-20T08:28:47Z 2021-08-20T08:28:47Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for php7 This update for php7 fixes the following issues: - CVE-2021-21704: Fixed security issues in pdo_firebase module (bsc#1188035). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-SLE-15.3-2021-2795 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/7OI533FKAZPJKSHOKRDDHYZBMHCKP25U/ E-Mail link for openSUSE-SU-2021:2795-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1188035 SUSE Bug 1188035 https://www.suse.com/security/cve/CVE-2021-21704/ SUSE CVE CVE-2021-21704 page openSUSE Leap 15.3 php7-wddx-7.2.5-4.79.1 php7-wddx-7.2.5-4.79.1 as a component of openSUSE Leap 15.3 In PHP versions 7.3.x below 7.3.29, 7.4.x below 7.4.21 and 8.0.x below 8.0.8, when using Firebird PDO driver extension, a malicious database server could cause crashes in various database functions, such as getAttribute(), execute(), fetch() and others by returning invalid response data that is not parsed correctly by the driver. This can result in crashes, denial of service or potentially memory corruption. CVE-2021-21704 openSUSE Leap 15.3:php7-wddx-7.2.5-4.79.1 important 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/7OI533FKAZPJKSHOKRDDHYZBMHCKP25U/ https://www.suse.com/security/cve/CVE-2021-21704.html CVE-2021-21704 https://bugzilla.suse.com/1188035 SUSE Bug 1188035