Ilia Alshanetsky

**Name of the Vulnerable Software and Affected Versions** PHP versions 8.2.0 through 8.2.30 PHP versions 8.3.0 through 8.3.30 PHP versions 8.4.0 through 8.4.20 PHP versions 8.5.0 through 8.5.5 **Description** When SoapServer is configured with `SOAP PERSISTENCE SESSION`, the handler object is persisted across requests using session storage. If a SOAP request results in an error, the persistence is handled incorrectly, causing the object to be freed while a pointer to it remains. This leads to a use-after-free condition, which is a situation where a program continues to use a pointer after it has been freed, potentially resulting in memory corruption, information disclosure, or process crashes. **Recommendations** Update PHP version 8.2.x to 8.2.31 Update PHP version 8.3.x to 8.3.31 Update PHP version 8.4.x to 8.4.21 Update PHP version 8.5.x to 8.5.6

**Name of the Vulnerable Software and Affected Versions** PHP versions 8.2.0 through 8.2.30 PHP versions 8.3.0 through 8.3.30 PHP versions 8.4.0 through 8.4.20 PHP versions 8.5.0 through 8.5.5 **Description** A mistake in the decoding process of a SOAP server with a configured typemap causes the system to check the wrong variable when a value element is missing. This results in a NULL pointer dereference, leading to a segmentation fault. A remote unauthenticated attacker can exploit this to crash the PHP SOAP server process, causing a denial of service. **Recommendations** Update PHP version 8.2.x to 8.2.31 Update PHP version 8.3.x to 8.3.31 Update PHP version 8.4.x to 8.4.21 Update PHP version 8.5.x to 8.5.6

**Name of the Vulnerable Software and Affected Versions** PHP versions prior to 5.2.2 **Description** The issue is related to a buffer overflow in the `user filter factory create` function, which allows attackers to gain unauthorized access via local attack vectors. The exact impact of this issue is not fully detailed, but it is known to be exploitable through local means. **Recommendations** For PHP versions prior to 5.2.2, update to version 5.2.2 or later to resolve the issue. As a temporary workaround, consider restricting local access to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** libmcrypt versions prior to 2.5.5 libmcrypt-devel versions prior to 2.5.5 **Description** The issue concerns multiple vulnerabilities in the libmcrypt package of the openSUSE operating system, which can be exploited remotely. These vulnerabilities may lead to a violation of confidentiality, integrity, and availability of protected information. The vulnerabilities can cause a denial of service, resulting in a system crash. **Recommendations** For libmcrypt versions prior to 2.5.5, update to version 2.5.5 or later to resolve the issue. For libmcrypt-devel versions prior to 2.5.5, update to version 2.5.5 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** libmcrypt versions prior to 2.5.5 **Description** The issue affects the libmcrypt package, potentially leading to breaches of confidentiality, integrity, and availability of protected information. Exploitation can occur remotely. A memory leak in libmcrypt allows attackers to cause a denial of service via a large number of requests, causing libmcrypt to dynamically load algorithms. **Recommendations** For versions prior to 2.5.5, update to version 2.5.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the application to minimize the risk of exploitation. Avoid using the vulnerable libmcrypt package until the issue is resolved.