Corregido en
Comprueba tu versión
php -r 'echo PHP_VERSION;'CVE que afectan a 7.3
| CVE | Título | CVSS | Explotada | EPSS | Publicación |
|---|---|---|---|---|---|
| CVE-2026-109619 | RCE via stale global state | 9.2 | KEV | 100.0% | 2026-10-21 |
| CVE-2026-109618 | RCE via OOM corruption | 9.2 | KEV | 100.0% | 2026-10-21 |
| CVE-2019-11043 | Underflow in PHP-FPM can lead to RCE | 8.7 | KEV | 99.8% | 2019-10-28 |
| CVE-2022-37454 | The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer ove... | 9.8 | — | 2022-10-21 | |
| CVE-2024-3566 | Command injection vulnerability in programing languages on Microsoft Windows operating system. | 9.8 | — | 2024-04-10 | |
| CVE-2019-9020 | An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1.... | 9.8 | — | 2019-02-23 | |
| CVE-2019-9021 | An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1.... | 9.8 | — | 2019-02-23 | |
| CVE-2019-9023 | An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1.... | 9.8 | — | 2019-02-23 | |
| CVE-2019-9025 | An issue was discovered in PHP 7.3.x before 7.3.1. An invalid multibyte string supplied as an argument to the... | 9.8 | — | 2019-02-23 | |
| CVE-2017-8923 | The zend_string_extend function in Zend/zend_string.h in PHP through 7.1.5 does not prevent changes to string... | 9.8 | — | 2017-05-13 | |
| CVE-2019-9641 | An issue was discovered in the EXIF component in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.... | 9.8 | — | 2019-03-09 | |
| CVE-2019-13224 | A use-after-free in onig_new_deluxe() in regext.c in Oniguruma 6.9.2 allows attackers to potentially cause inf... | 9.8 | — | 2019-07-10 | |
| CVE-2019-6977 | gdImageColorMatch in gd_color_match.c in the GD Graphics Library (aka LibGD) 2.2.5, as used in the imagecolorm... | 8.8 | — | 2019-01-27 | |
| CVE-2019-9675 | An issue was discovered in PHP 7.x before 7.1.27 and 7.3.x before 7.3.3. phar_tar_writeheaders_int in ext/phar... | 8.1 | — | 2019-03-11 | |
| CVE-2021-21703 | PHP-FPM memory access in root process leading to privilege escalation | 7.8 | — | 2021-10-25 | |
| CVE-2019-9022 | An issue was discovered in PHP 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.2. dns_get_record... | 7.5 | — | 2019-02-23 | |
| CVE-2019-9024 | An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1.... | 7.5 | — | 2019-02-23 | |
| CVE-2019-9637 | An issue was discovered in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. Due to the way rena... | 7.5 | — | 2019-03-09 | |
| CVE-2019-9638 | An issue was discovered in the EXIF component in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.... | 7.5 | — | 2019-03-09 | |
| CVE-2019-9639 | An issue was discovered in the EXIF component in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.... | 7.5 | — | 2019-03-09 | |
| CVE-2019-9640 | An issue was discovered in the EXIF component in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.... | 7.5 | — | 2019-03-09 | |
| CVE-2019-19246 | Oniguruma through 6.9.3, as used in PHP 7.3.x and other products, has a heap-based buffer over-read in str_low... | 7.5 | — | 2019-11-26 | |
| CVE-2020-7062 | Null Pointer Dereference in PHP Session Upload Progress | 7.5 | — | 2020-02-28 | |
| CVE-2020-7067 | OOB Read in urldecode() | 7.5 | — | 2020-04-28 | |
| CVE-2020-7065 | mb_strtolower (UTF-32LE): stack-buffer-overflow at php_unicode_tolower_full | 7.4 | — | 2020-04-01 | |
| CVE-2022-31629 | $_COOKIE names string replacement (. -> _): cookie integrity vulnerabilities | 6.5 | — | 2022-09-29 | |
| CVE-2015-9253 | An issue was discovered in PHP 7.3.x before 7.3.0alpha3, 7.2.x before 7.2.8, and before 7.1.20. The php-fpm ma... | 6.5 | — | 2018-02-20 | |
| CVE-2019-11049 | mail() may release string with refcount==1 twice | 6.5 | — | 2019-12-23 | |
| CVE-2020-7059 | OOB read in php_strip_tags_ex | 6.5 | — | 2020-02-10 | |
| CVE-2020-7060 | global buffer-overflow in mbfl_filt_conv_big5_wchar | 6.5 | — | 2020-02-10 | |
| CVE-2020-7061 | heap-buffer-overflow in phar_extract_file | 6.5 | — | 2020-02-28 | |
| CVE-2020-7064 | Use-of-uninitialized-value in exif | 6.5 | — | 2020-04-01 | |
| CVE-2022-4900 | Potential buffer overflow in php_cli_server_startup_workers | 6.2 | — | 2023-11-03 | |
| CVE-2020-7063 | Files added to tar with Phar::buildFromIterator have all-access permissions | 5.5 | — | 2020-02-28 | |
| CVE-2020-7069 | Wrong ciphertext/tag in AES-CCM encryption for a 12 bytes IV | 5.4 | — | 2020-10-02 | |
| CVE-2024-5458 | Filter bypass in filter_var (FILTER_VALIDATE_URL) | 5.3 | — | 2024-06-10 | |
| CVE-2020-7066 | get_headers() silently truncates after a null byte | 5.3 | — | 2020-04-01 | |
| CVE-2019-11048 | Temporary files are not cleaned after OOM when parsing HTTP request data | 5.3 | — | 2020-05-20 | |
| CVE-2020-7071 | FILTER_VALIDATE_URL accepts URLs with invalid userinfo | 5.3 | — | 2021-02-15 | |
| CVE-2021-21702 | Null Dereference in SoapClient | 5.3 | — | 2021-02-15 | |
| CVE-2021-21706 | ZipArchive::extractTo may extract outside of destination dir | 5.3 | — | 2021-10-04 | |
| CVE-2021-21707 | Special characters break path parsing in XML functions | 5.3 | — | 2021-11-29 | |
| CVE-2021-21704 | Multiple vulnerabilities in Firebird client extension | 5.0 | — | 2021-10-04 | |
| CVE-2019-11034 | Heap over-read in PHP EXIF extension | 4.8 | — | 2019-04-19 | |
| CVE-2019-11035 | Heap over-read in PHP EXIF extension | 4.8 | — | 2019-04-19 | |
| CVE-2019-11036 | Heap over-read in PHP EXIF extension | 4.8 | — | 2019-05-04 | |
| CVE-2019-11040 | Heap buffer overflow in EXIF extension | 4.8 | — | 2019-06-19 | |
| CVE-2019-11041 | heap-buffer-overflow on exif_scan_thumbnail in EXIF extension | 4.8 | — | 2019-08-10 | |
| CVE-2019-11042 | heap-buffer-overflow on exif_process_user_comment in EXIF extension | 4.8 | — | 2019-08-10 | |
| CVE-2019-11047 | Heap-buffer-overflow READ in exif | 4.8 | — | 2019-12-23 | |
| CVE-2019-11050 | Use-after-free in exif parsing under memory sanitizer | 4.8 | — | 2019-12-23 | |
| CVE-2020-7068 | Use of freed hash key in the phar_parse_zipfile function | 4.8 | — | 2020-09-10 | |
| CVE-2020-7070 | PHP parses encoded cookie names so malicious `__Host-` cookies can be sent | 4.3 | — | 2020-10-02 | |
| CVE-2021-21705 | Incorrect URL validation in FILTER_VALIDATE_URL | 4.3 | — | 2021-10-04 | |
| CVE-2019-11039 | Out-of-bounds read in iconv.c | 4.2 | — | 2019-06-19 | |
| CVE-2019-11044 | link() silently truncates after a null byte on Windows | 3.7 | — | 2019-12-23 | |
| CVE-2019-11045 | DirectoryIterator class silently truncates after a null byte | 3.7 | — | 2019-12-23 | |
| CVE-2019-11046 | Buffer underflow in bc_shift_addsub | 3.7 | — | 2019-12-23 | |
| CVE-2019-11038 | Uninitialized read in gdImageCreateFromXbm | 3.1 | — | 2019-06-19 | |
| CVE-2022-31628 | phar wrapper can occur dos when using quine gzip file | 2.3 | — | 2022-09-29 |
Controla estas versiones en tus propios servidores
InfraGuard recopila las versiones de software instaladas en cada servidor y señala las que tienen vulnerabilidades conocidas. Autoalojado: nada sale de tu red.
Datos: CVE List (CVE® Program), NVD, CISA KEV, FIRST EPSS (consulta EPSS en https://www.first.org/epss), endoflife.date. Lista de software: awesome-selfhosted (CC BY-SA 3.0).