Security update for php7 SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2021:0494-1 Final 1 1 2021-02-17T12:06:04Z current 2021-02-17T12:06:04Z 2021-02-17T12:06:04Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for php7 This update for php7 fixes the following issues: - CVE-2021-21702 [bsc#1182049]: NULL pointer dereference in SoapClient The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2021-494,SUSE-SLE-Module-Packagehub-Subpackages-15-SP2-2021-494,SUSE-SLE-Module-Web-Scripting-15-SP2-2021-494 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2021/suse-su-20210494-1/ Link for SUSE-SU-2021:0494-1 https://lists.suse.com/pipermail/sle-security-updates/2021-February/008338.html E-Mail link for SUSE-SU-2021:0494-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1182049 SUSE Bug 1182049 https://www.suse.com/security/cve/CVE-2021-21702/ SUSE CVE CVE-2021-21702 page SUSE Linux Enterprise Module for Package Hub 15 SP2 SUSE Linux Enterprise Module for Web and Scripting 15 SP2 apache2-mod_php7-7.4.6-3.17.1 php7-7.4.6-3.17.1 php7-bcmath-7.4.6-3.17.1 php7-bz2-7.4.6-3.17.1 php7-calendar-7.4.6-3.17.1 php7-ctype-7.4.6-3.17.1 php7-curl-7.4.6-3.17.1 php7-dba-7.4.6-3.17.1 php7-devel-7.4.6-3.17.1 php7-dom-7.4.6-3.17.1 php7-embed-7.4.6-3.17.1 php7-enchant-7.4.6-3.17.1 php7-exif-7.4.6-3.17.1 php7-fastcgi-7.4.6-3.17.1 php7-fileinfo-7.4.6-3.17.1 php7-firebird-7.4.6-3.17.1 php7-fpm-7.4.6-3.17.1 php7-ftp-7.4.6-3.17.1 php7-gd-7.4.6-3.17.1 php7-gettext-7.4.6-3.17.1 php7-gmp-7.4.6-3.17.1 php7-iconv-7.4.6-3.17.1 php7-intl-7.4.6-3.17.1 php7-json-7.4.6-3.17.1 php7-ldap-7.4.6-3.17.1 php7-mbstring-7.4.6-3.17.1 php7-mysql-7.4.6-3.17.1 php7-odbc-7.4.6-3.17.1 php7-opcache-7.4.6-3.17.1 php7-openssl-7.4.6-3.17.1 php7-pcntl-7.4.6-3.17.1 php7-pdo-7.4.6-3.17.1 php7-pgsql-7.4.6-3.17.1 php7-phar-7.4.6-3.17.1 php7-posix-7.4.6-3.17.1 php7-readline-7.4.6-3.17.1 php7-shmop-7.4.6-3.17.1 php7-snmp-7.4.6-3.17.1 php7-soap-7.4.6-3.17.1 php7-sockets-7.4.6-3.17.1 php7-sodium-7.4.6-3.17.1 php7-sqlite-7.4.6-3.17.1 php7-sysvmsg-7.4.6-3.17.1 php7-sysvsem-7.4.6-3.17.1 php7-sysvshm-7.4.6-3.17.1 php7-test-7.4.6-3.17.1 php7-tidy-7.4.6-3.17.1 php7-tokenizer-7.4.6-3.17.1 php7-xmlreader-7.4.6-3.17.1 php7-xmlrpc-7.4.6-3.17.1 php7-xmlwriter-7.4.6-3.17.1 php7-xsl-7.4.6-3.17.1 php7-zip-7.4.6-3.17.1 php7-zlib-7.4.6-3.17.1 php7-embed-7.4.6-3.17.1 as a component of SUSE Linux Enterprise Module for Package Hub 15 SP2 apache2-mod_php7-7.4.6-3.17.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 15 SP2 php7-7.4.6-3.17.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 15 SP2 php7-bcmath-7.4.6-3.17.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 15 SP2 php7-bz2-7.4.6-3.17.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 15 SP2 php7-calendar-7.4.6-3.17.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 15 SP2 php7-ctype-7.4.6-3.17.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 15 SP2 php7-curl-7.4.6-3.17.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 15 SP2 php7-dba-7.4.6-3.17.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 15 SP2 php7-devel-7.4.6-3.17.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 15 SP2 php7-dom-7.4.6-3.17.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 15 SP2 php7-enchant-7.4.6-3.17.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 15 SP2 php7-exif-7.4.6-3.17.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 15 SP2 php7-fastcgi-7.4.6-3.17.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 15 SP2 php7-fileinfo-7.4.6-3.17.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 15 SP2 php7-fpm-7.4.6-3.17.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 15 SP2 php7-ftp-7.4.6-3.17.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 15 SP2 php7-gd-7.4.6-3.17.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 15 SP2 php7-gettext-7.4.6-3.17.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 15 SP2 php7-gmp-7.4.6-3.17.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 15 SP2 php7-iconv-7.4.6-3.17.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 15 SP2 php7-intl-7.4.6-3.17.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 15 SP2 php7-json-7.4.6-3.17.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 15 SP2 php7-ldap-7.4.6-3.17.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 15 SP2 php7-mbstring-7.4.6-3.17.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 15 SP2 php7-mysql-7.4.6-3.17.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 15 SP2 php7-odbc-7.4.6-3.17.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 15 SP2 php7-opcache-7.4.6-3.17.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 15 SP2 php7-openssl-7.4.6-3.17.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 15 SP2 php7-pcntl-7.4.6-3.17.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 15 SP2 php7-pdo-7.4.6-3.17.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 15 SP2 php7-pgsql-7.4.6-3.17.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 15 SP2 php7-phar-7.4.6-3.17.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 15 SP2 php7-posix-7.4.6-3.17.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 15 SP2 php7-readline-7.4.6-3.17.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 15 SP2 php7-shmop-7.4.6-3.17.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 15 SP2 php7-snmp-7.4.6-3.17.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 15 SP2 php7-soap-7.4.6-3.17.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 15 SP2 php7-sockets-7.4.6-3.17.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 15 SP2 php7-sodium-7.4.6-3.17.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 15 SP2 php7-sqlite-7.4.6-3.17.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 15 SP2 php7-sysvmsg-7.4.6-3.17.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 15 SP2 php7-sysvsem-7.4.6-3.17.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 15 SP2 php7-sysvshm-7.4.6-3.17.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 15 SP2 php7-tidy-7.4.6-3.17.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 15 SP2 php7-tokenizer-7.4.6-3.17.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 15 SP2 php7-xmlreader-7.4.6-3.17.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 15 SP2 php7-xmlrpc-7.4.6-3.17.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 15 SP2 php7-xmlwriter-7.4.6-3.17.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 15 SP2 php7-xsl-7.4.6-3.17.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 15 SP2 php7-zip-7.4.6-3.17.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 15 SP2 php7-zlib-7.4.6-3.17.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 15 SP2 In PHP versions 7.3.x below 7.3.27, 7.4.x below 7.4.15 and 8.0.x below 8.0.2, when using SOAP extension to connect to a SOAP server, a malicious SOAP server could return malformed XML data as a response that would cause PHP to access a null pointer and thus cause a crash. CVE-2021-21702 SUSE Linux Enterprise Module for Package Hub 15 SP2:php7-embed-7.4.6-3.17.1 SUSE Linux Enterprise Module for Web and Scripting 15 SP2:apache2-mod_php7-7.4.6-3.17.1 SUSE Linux Enterprise Module for Web and Scripting 15 SP2:php7-7.4.6-3.17.1 SUSE Linux Enterprise Module for Web and Scripting 15 SP2:php7-bcmath-7.4.6-3.17.1 SUSE Linux Enterprise Module for Web and Scripting 15 SP2:php7-bz2-7.4.6-3.17.1 SUSE Linux Enterprise Module for Web and Scripting 15 SP2:php7-calendar-7.4.6-3.17.1 SUSE Linux Enterprise Module for Web and Scripting 15 SP2:php7-ctype-7.4.6-3.17.1 SUSE Linux Enterprise Module for Web and Scripting 15 SP2:php7-curl-7.4.6-3.17.1 SUSE Linux Enterprise Module for Web and Scripting 15 SP2:php7-dba-7.4.6-3.17.1 SUSE Linux Enterprise Module for Web and Scripting 15 SP2:php7-devel-7.4.6-3.17.1 SUSE Linux Enterprise Module for Web and Scripting 15 SP2:php7-dom-7.4.6-3.17.1 SUSE Linux Enterprise Module for Web and Scripting 15 SP2:php7-enchant-7.4.6-3.17.1 SUSE Linux Enterprise Module for Web and Scripting 15 SP2:php7-exif-7.4.6-3.17.1 SUSE Linux Enterprise Module for Web and Scripting 15 SP2:php7-fastcgi-7.4.6-3.17.1 SUSE Linux Enterprise Module for Web and Scripting 15 SP2:php7-fileinfo-7.4.6-3.17.1 SUSE Linux Enterprise Module for Web and Scripting 15 SP2:php7-fpm-7.4.6-3.17.1 SUSE Linux Enterprise Module for Web and Scripting 15 SP2:php7-ftp-7.4.6-3.17.1 SUSE Linux Enterprise Module for Web and Scripting 15 SP2:php7-gd-7.4.6-3.17.1 SUSE Linux Enterprise Module for Web and Scripting 15 SP2:php7-gettext-7.4.6-3.17.1 SUSE Linux Enterprise Module for Web and Scripting 15 SP2:php7-gmp-7.4.6-3.17.1 SUSE Linux Enterprise Module for Web and Scripting 15 SP2:php7-iconv-7.4.6-3.17.1 SUSE Linux Enterprise Module for Web and Scripting 15 SP2:php7-intl-7.4.6-3.17.1 SUSE Linux Enterprise Module for Web and Scripting 15 SP2:php7-json-7.4.6-3.17.1 SUSE Linux Enterprise Module for Web and Scripting 15 SP2:php7-ldap-7.4.6-3.17.1 SUSE Linux Enterprise Module for Web and Scripting 15 SP2:php7-mbstring-7.4.6-3.17.1 SUSE Linux Enterprise Module for Web and Scripting 15 SP2:php7-mysql-7.4.6-3.17.1 SUSE Linux Enterprise Module for Web and Scripting 15 SP2:php7-odbc-7.4.6-3.17.1 SUSE Linux Enterprise Module for Web and Scripting 15 SP2:php7-opcache-7.4.6-3.17.1 SUSE Linux Enterprise Module for Web and Scripting 15 SP2:php7-openssl-7.4.6-3.17.1 SUSE Linux Enterprise Module for Web and Scripting 15 SP2:php7-pcntl-7.4.6-3.17.1 SUSE Linux Enterprise Module for Web and Scripting 15 SP2:php7-pdo-7.4.6-3.17.1 SUSE Linux Enterprise Module for Web and Scripting 15 SP2:php7-pgsql-7.4.6-3.17.1 SUSE Linux Enterprise Module for Web and Scripting 15 SP2:php7-phar-7.4.6-3.17.1 SUSE Linux Enterprise Module for Web and Scripting 15 SP2:php7-posix-7.4.6-3.17.1 SUSE Linux Enterprise Module for Web and Scripting 15 SP2:php7-readline-7.4.6-3.17.1 SUSE Linux Enterprise Module for Web and Scripting 15 SP2:php7-shmop-7.4.6-3.17.1 SUSE Linux Enterprise Module for Web and Scripting 15 SP2:php7-snmp-7.4.6-3.17.1 SUSE Linux Enterprise Module for Web and Scripting 15 SP2:php7-soap-7.4.6-3.17.1 SUSE Linux Enterprise Module for Web and Scripting 15 SP2:php7-sockets-7.4.6-3.17.1 SUSE Linux Enterprise Module for Web and Scripting 15 SP2:php7-sodium-7.4.6-3.17.1 SUSE Linux Enterprise Module for Web and Scripting 15 SP2:php7-sqlite-7.4.6-3.17.1 SUSE Linux Enterprise Module for Web and Scripting 15 SP2:php7-sysvmsg-7.4.6-3.17.1 SUSE Linux Enterprise Module for Web and Scripting 15 SP2:php7-sysvsem-7.4.6-3.17.1 SUSE Linux Enterprise Module for Web and Scripting 15 SP2:php7-sysvshm-7.4.6-3.17.1 SUSE Linux Enterprise Module for Web and Scripting 15 SP2:php7-tidy-7.4.6-3.17.1 SUSE Linux Enterprise Module for Web and Scripting 15 SP2:php7-tokenizer-7.4.6-3.17.1 SUSE Linux Enterprise Module for Web and Scripting 15 SP2:php7-xmlreader-7.4.6-3.17.1 SUSE Linux Enterprise Module for Web and Scripting 15 SP2:php7-xmlrpc-7.4.6-3.17.1 SUSE Linux Enterprise Module for Web and Scripting 15 SP2:php7-xmlwriter-7.4.6-3.17.1 SUSE Linux Enterprise Module for Web and Scripting 15 SP2:php7-xsl-7.4.6-3.17.1 SUSE Linux Enterprise Module for Web and Scripting 15 SP2:php7-zip-7.4.6-3.17.1 SUSE Linux Enterprise Module for Web and Scripting 15 SP2:php7-zlib-7.4.6-3.17.1 important 5 AV:N/AC:L/Au:N/C:N/I:N/A:P 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2021/suse-su-20210494-1/ https://www.suse.com/security/cve/CVE-2021-21702.html CVE-2021-21702 https://bugzilla.suse.com/1182049 SUSE Bug 1182049