| Package | php7.0 |
|---|---|
| Version | 7.0.33-0+deb9u18 (stretch) |
| Related CVEs | CVE-2024-5458 |
PHP, a widely-used open source general purpose scripting language, is affected by a security problem when parsing certain types of URLs.
Due to a code logic error filtering functions such as filter_var when validating URLs (FILTER_VALIDATE_URL) will result in invalid user information (username + password part of URLs) being treated as valid user information. This may lead to the downstream code accepting invalid URLs as valid and parsing them incorrectly. The problem is related to CVE-2020-7071 but affects IPv6 host parts.
For Debian 9 stretch, these problems have been fixed in version 7.0.33-0+deb9u18.
We recommend that you upgrade your php7.0 packages.
Further information about Extended LTS security advisories can be found in the dedicated section of our website.