CVE Vulnerability Catalog

Vulnerability in PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12. The HTTP_REDIRECT_STATUS variable used to check if CGI is run by the HTTP server can be controlled by the request submitter via HTTP headers.

The IsLocal function on Windows incorrectly detects reserved device names in some cases. Reserved names followed by spaces (e.g., "COM1 ") and names "COM" and "LPT" with superscript 1, 2, or 3 are incorrectly reported as local. The fix ensures IsLocal now correctly identifies these.

In sshd in OpenSSH before version 10.0, the DisableForwarding directive does not adhere to documentation, failing to disable X11 and agent forwarding.

In libxml2 before 2.12.10 and 2.13.6, a NULL pointer dereference exists in xmlPatMatch in pattern.c.

In PHP from 8.1.* before 8.1.32, 8.2.* before 8.2.28, 8.3.* before 8.3.19, 8.4.* before 8.4.5, the HTTP request module incorrectly parses folded headers in HTTP responses, which may lead to misinterpreting the response and using incorrect MIME headers.

In PHP from 8.1.* before 8.1.32, 8.2.* before 8.2.28, 8.3.* before 8.3.19, 8.4.* before 8.4.5, when parsing HTTP redirect in the response to an HTTP request, there is a limit on the location value size to 1024 bytes, which may be insufficient per RFC.

In CPython, the email module does not properly quote newlines in email headers during serialization, allowing header injection when an email is serialized. This is a medium severity vulnerability.