Linux · Security advisory · September 9, 2020

ELSA-2020-3662: Security update for 37 packages

ELSA-2020-3662, released September 9, 2020, fixes 22 CVEs across 37 products. None of them is reported as exploited. Patch Radar priority: High.

High
CVEs closed
22
None rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.0889
95th percentile

Priority of the 22 CVEs

Patch now 0 Urgent 0 High 13 Routine 9

Fixed package versions

ProductReleaseFixed in
apcu-panelol 80:5.1.17-1.module+el8.2.0+5569+98c8b30d
libzipol 80:1.5.2-1.module+el8.2.0+5569+98c8b30d
libzip-develol 80:1.5.2-1.module+el8.2.0+5569+98c8b30d
libzip-toolsol 80:1.5.2-1.module+el8.2.0+5569+98c8b30d
phpol 80:7.3.20-1.module+el8.2.0+7784+4033621d
php-bcmathol 80:7.3.20-1.module+el8.2.0+7784+4033621d
php-cliol 80:7.3.20-1.module+el8.2.0+7784+4033621d
php-commonol 80:7.3.20-1.module+el8.2.0+7784+4033621d
php-dbaol 80:7.3.20-1.module+el8.2.0+7784+4033621d
php-dbgol 80:7.3.20-1.module+el8.2.0+7784+4033621d
php-develol 80:7.3.20-1.module+el8.2.0+7784+4033621d
php-embeddedol 80:7.3.20-1.module+el8.2.0+7784+4033621d
php-enchantol 80:7.3.20-1.module+el8.2.0+7784+4033621d
php-fpmol 80:7.3.20-1.module+el8.2.0+7784+4033621d
php-gdol 80:7.3.20-1.module+el8.2.0+7784+4033621d
php-gmpol 80:7.3.20-1.module+el8.2.0+7784+4033621d
php-intlol 80:7.3.20-1.module+el8.2.0+7784+4033621d
php-jsonol 80:7.3.20-1.module+el8.2.0+7784+4033621d
php-ldapol 80:7.3.20-1.module+el8.2.0+7784+4033621d
php-mbstringol 80:7.3.20-1.module+el8.2.0+7784+4033621d
php-mysqlndol 80:7.3.20-1.module+el8.2.0+7784+4033621d
php-odbcol 80:7.3.20-1.module+el8.2.0+7784+4033621d
php-opcacheol 80:7.3.20-1.module+el8.2.0+7784+4033621d
php-pdool 80:7.3.20-1.module+el8.2.0+7784+4033621d
php-pearol 81:1.10.9-1.module+el8.2.0+5569+98c8b30d
php-pecl-apcuol 80:5.1.17-1.module+el8.2.0+5569+98c8b30d
php-pecl-apcu-develol 80:5.1.17-1.module+el8.2.0+5569+98c8b30d
php-pecl-rrdol 80:2.0.1-1.module+el8.2.0+5569+98c8b30d
php-pecl-xdebugol 80:2.8.0-1.module+el8.2.0+5569+98c8b30d
php-pecl-zipol 80:1.15.4-1.module+el8.2.0+5569+98c8b30d
php-pgsqlol 80:7.3.20-1.module+el8.2.0+7784+4033621d
php-processol 80:7.3.20-1.module+el8.2.0+7784+4033621d
php-recodeol 80:7.3.20-1.module+el8.2.0+7784+4033621d
php-snmpol 80:7.3.20-1.module+el8.2.0+7784+4033621d
php-soapol 80:7.3.20-1.module+el8.2.0+7784+4033621d
php-xmlol 80:7.3.20-1.module+el8.2.0+7784+4033621d
php-xmlrpcol 80:7.3.20-1.module+el8.2.0+7784+4033621d

CVEs this fix closes

PriorityCVETitleImpactCVSSEPSSExploitation
High CVE-2020-7060 apcu-panel: PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. The following packages have be... 9.1 0.0889 None reported
High CVE-2020-7059 apcu-panel: PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. The following packages have be... 9.1 0.0740 None reported
High CVE-2019-19204 apcu-panel: PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. The following packages have be... 7.5 0.0689 None reported
High CVE-2019-11048 apcu-panel: PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. The following packages have be... 7.5 0.0626 None reported
High CVE-2020-7065 apcu-panel: PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. The following packages have be... 8.8 0.0488 None reported
High CVE-2019-11041 apcu-panel: PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. The following packages have be... 7.1 0.0442 None reported
High CVE-2019-11042 apcu-panel: PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. The following packages have be... 7.1 0.0442 None reported
High CVE-2019-11040 apcu-panel: PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. The following packages have be... 9.1 0.0407 None reported
High CVE-2019-19203 apcu-panel: PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. The following packages have be... 7.5 0.0405 None reported
High CVE-2020-7062 apcu-panel: PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. The following packages have be... 7.5 0.0358 None reported
High CVE-2019-11039 apcu-panel: PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. The following packages have be... 9.1 0.0313 None reported
High CVE-2019-19246 apcu-panel: PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. The following packages have be... 7.5 0.0297 None reported
High CVE-2019-20454 php-cli: PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. The following packages have be... 7.5 0.0156 None reported
Routine CVE-2019-11045 apcu-panel: PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. The following packages have be... 5.9 0.0882 None reported
Routine CVE-2019-11050 apcu-panel: PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. The following packages have be... 6.5 0.0762 None reported
Routine CVE-2019-11047 apcu-panel: PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. The following packages have be... 6.5 0.0747 None reported
Routine CVE-2020-7064 php: PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. The following packages have be... 5.4 0.0430 None reported
Routine CVE-2019-13224 libonig5: A use-after-free in onig_new_deluxe() in regext.c in Oniguruma 6.9.2 allowsattackers to potentially cause information... 6.8 0.0405 None reported
Routine CVE-2020-7066 apcu-panel: PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. The following packages have be... 4.3 0.0277 None reported
Routine CVE-2019-16163 apcu-panel: PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. The following packages have be... 6.5 0.0275 None reported
Routine CVE-2019-13225 oniguruma: This update for oniguruma fixes the following issues: - CVE-2019-13225: Fixed null-pointer dereference in match_at()... 6.5 0.0213 None reported
Routine CVE-2020-7063 apcu-panel: PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. The following packages have be... 5.5 0.0159 None reported
Showing 1 to 22 of 22 1