CVE catalog

CVE-2022-31630

Security update for php8

[CVE catalog]

Severity
Medium · CVSS 6.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Published
Updated
Source
[NVD] · [CVE record]
EPSS
1.32% · Oct 25, 2026

In PHP versions prior to 7.4.33, 8.0.25 and 8.1.12, when using imageloadfont() function in gd extension, it is possible to supply a specially crafted font file, such as if the loaded font is used with imagechar() function, the read outside allocated buffer will be used. This can lead to crashes or disclosure of confidential information.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianphp7.4117.4.21-1+deb11u1vulnerable
Debianphp7.4117.4.25-1+deb11u1vulnerable
Debianphp7.4117.4.26-1vulnerable
Debianphp7.4117.4.28-1+deb11u1vulnerable
Debianphp7.4117.4.30-1+deb11u1vulnerable
Debianphp7.4117.4.33-1+deb11u1fixed
Ubuntuphp7.420.047.4.3-4build1vulnerable
Ubuntuphp7.420.047.4.3-4build2vulnerable
Ubuntuphp7.420.047.4.3-4ubuntu1vulnerable
Ubuntuphp7.420.047.4.3-4ubuntu1.1vulnerable
Ubuntuphp7.420.047.4.3-4ubuntu2.2vulnerable
Ubuntuphp7.420.047.4.3-4ubuntu2.4vulnerable
Ubuntuphp7.420.047.4.3-4ubuntu2.5vulnerable
Ubuntuphp7.420.047.4.3-4ubuntu2.6vulnerable
Ubuntuphp7.420.047.4.3-4ubuntu2.7vulnerable
Ubuntuphp7.420.047.4.3-4ubuntu2.8vulnerable
Ubuntuphp7.420.047.4.3-4ubuntu2.9vulnerable
Ubuntuphp7.420.047.4.3-4ubuntu2.10vulnerable
Ubuntuphp7.420.047.4.3-4ubuntu2.11vulnerable
Ubuntuphp7.420.047.4.3-4ubuntu2.12vulnerable
Ubuntuphp7.420.047.4.3-4ubuntu2.13vulnerable
Ubuntuphp7.420.047.4.3-4ubuntu2.15fixed
Ubuntuphp8.122.048.1.0~rc4-1ubuntu2vulnerable
Ubuntuphp8.122.048.1.0-1vulnerable
Ubuntuphp8.122.048.1.2-1ubuntu1vulnerable
Ubuntuphp8.122.048.1.2-1ubuntu2vulnerable
Ubuntuphp8.122.048.1.2-1ubuntu2.1vulnerable
Ubuntuphp8.122.048.1.2-1ubuntu2.2vulnerable
Ubuntuphp8.122.048.1.2-1ubuntu2.3vulnerable
Ubuntuphp8.122.048.1.2-1ubuntu2.4vulnerable
Ubuntuphp8.122.048.1.2-1ubuntu2.5vulnerable
Ubuntuphp8.122.048.1.2-1ubuntu2.6vulnerable
Ubuntuphp8.122.048.1.2-1ubuntu2.8fixed
Opensusephp8tumbleweed8.1.12-1.1fixed
Suseapache2-mod_php8linux enterprise module for web and scripting 15 sp48.0.25-150400.4.17.1fixed
Susephp8linux enterprise module for web and scripting 15 sp48.0.25-150400.4.17.1fixed
Susephp8-embedlinux enterprise module for web and scripting 15 sp48.0.25-150400.4.17.1fixed
Susephp8-fastcgilinux enterprise module for web and scripting 15 sp48.0.25-150400.4.17.1fixed
Susephp8-fpmlinux enterprise module for web and scripting 15 sp48.0.25-150400.4.17.1fixed
Susephp8-testlinux enterprise module for web and scripting 15 sp48.0.25-150400.4.17.1fixed
Opensuseapache2-mod_php8leap 15.48.0.25-150400.4.17.1fixed
Opensusephp8leap 15.48.0.25-150400.4.17.1fixed
Opensusephp8-embedleap 15.48.0.25-150400.4.17.1fixed
Opensusephp8-fastcgileap 15.48.0.25-150400.4.17.1fixed
Opensusephp8-fpmleap 15.48.0.25-150400.4.17.1fixed
Opensusephp8-testleap 15.48.0.25-150400.4.17.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianphp7.4deb117.4.33-1+deb11u1Not reportedDEBIAN-CVE-2022-31630Not reported
Ubuntuphp7.4deb20.047.4.3-4ubuntu2.15Not reportedUBUNTU-CVE-2022-31630Not reported
Ubuntuphp8.1deb22.048.1.2-1ubuntu2.8Not reportedUBUNTU-CVE-2022-31630Not reported
Opensusephp8rpmtumbleweed8.1.12-1.1Not reportedOPENSUSE-SU-2024:12467-1Not reported
Suseapache2-mod_php8rpmlinux enterprise module for web and scripting 15 sp48.0.25-150400.4.17.1Not reportedSUSE-SU-2022:4005-1Not reported
Susephp8rpmlinux enterprise module for web and scripting 15 sp48.0.25-150400.4.17.1Not reportedSUSE-SU-2022:4005-1Not reported
Susephp8-embedrpmlinux enterprise module for web and scripting 15 sp48.0.25-150400.4.17.1Not reportedSUSE-SU-2022:4005-1Not reported
Susephp8-fastcgirpmlinux enterprise module for web and scripting 15 sp48.0.25-150400.4.17.1Not reportedSUSE-SU-2022:4005-1Not reported
Susephp8-fpmrpmlinux enterprise module for web and scripting 15 sp48.0.25-150400.4.17.1Not reportedSUSE-SU-2022:4005-1Not reported
Susephp8-testrpmlinux enterprise module for web and scripting 15 sp48.0.25-150400.4.17.1Not reportedSUSE-SU-2022:4005-1Not reported
Opensuseapache2-mod_php8rpmleap 15.48.0.25-150400.4.17.1Not reportedSUSE-SU-2022:4005-1Not reported
Opensusephp8rpmleap 15.48.0.25-150400.4.17.1Not reportedSUSE-SU-2022:4005-1Not reported
Opensusephp8-embedrpmleap 15.48.0.25-150400.4.17.1Not reportedSUSE-SU-2022:4005-1Not reported
Opensusephp8-fastcgirpmleap 15.48.0.25-150400.4.17.1Not reportedSUSE-SU-2022:4005-1Not reported
Opensusephp8-fpmrpmleap 15.48.0.25-150400.4.17.1Not reportedSUSE-SU-2022:4005-1Not reported
Opensusephp8-testrpmleap 15.48.0.25-150400.4.17.1Not reportedSUSE-SU-2022:4005-1Not reported

OpenFactory catalog packages

[openSUSE Tumbleweed]

  • [php8-bcmath]Unknown

    Source package: [php8]

    Details (1)

    • 8.5.9-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 8.1.12-1.1

      Version impact unknown

      pypi · php8 · opensuse · tumbleweed

  • [php8-bz2]Unknown

    Source package: [php8]

    Details (1)

    • 8.5.9-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 8.1.12-1.1

      Version impact unknown

      pypi · php8 · opensuse · tumbleweed

  • [php8-calendar]Unknown

    Source package: [php8]

    Details (1)

    • 8.5.9-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 8.1.12-1.1

      Version impact unknown

      pypi · php8 · opensuse · tumbleweed

  • [php8-cli]Unknown

    Source package: [php8]

    Details (1)

    • 8.5.9-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 8.1.12-1.1

      Version impact unknown

      pypi · php8 · opensuse · tumbleweed

  • [php8-ctype]Unknown

    Source package: [php8]

    Details (1)

    • 8.5.9-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 8.1.12-1.1

      Version impact unknown

      pypi · php8 · opensuse · tumbleweed

  • [php8-curl]Unknown

    Source package: [php8]

    Details (1)

    • 8.5.9-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 8.1.12-1.1

      Version impact unknown

      pypi · php8 · opensuse · tumbleweed

  • [php8-dba]Unknown

    Source package: [php8]

    Details (1)

    • 8.5.9-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 8.1.12-1.1

      Version impact unknown

      pypi · php8 · opensuse · tumbleweed

  • [php8-devel]Unknown

    Source package: [php8]

    Details (1)

    • 8.5.9-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 8.1.12-1.1

      Version impact unknown

      pypi · php8 · opensuse · tumbleweed

  • [php8-dom]Unknown

    Source package: [php8]

    Details (1)

    • 8.5.9-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 8.1.12-1.1

      Version impact unknown

      pypi · php8 · opensuse · tumbleweed

  • [php8-enchant]Unknown

    Source package: [php8]

    Details (1)

    • 8.5.9-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 8.1.12-1.1

      Version impact unknown

      pypi · php8 · opensuse · tumbleweed

  • [php8-exif]Unknown

    Source package: [php8]

    Details (1)

    • 8.5.9-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 8.1.12-1.1

      Version impact unknown

      pypi · php8 · opensuse · tumbleweed

  • [php8-ffi]Unknown

    Source package: [php8]

    Details (1)

    • 8.5.9-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 8.1.12-1.1

      Version impact unknown

      pypi · php8 · opensuse · tumbleweed

  • [php8-fileinfo]Unknown

    Source package: [php8]

    Details (1)

    • 8.5.9-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 8.1.12-1.1

      Version impact unknown

      pypi · php8 · opensuse · tumbleweed

  • [php8-ftp]Unknown

    Source package: [php8]

    Details (1)

    • 8.5.9-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 8.1.12-1.1

      Version impact unknown

      pypi · php8 · opensuse · tumbleweed

  • [php8-gd]Unknown

    Source package: [php8]

    Details (1)

    • 8.5.9-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 8.1.12-1.1

      Version impact unknown

      pypi · php8 · opensuse · tumbleweed

  • [php8-gettext]Unknown

    Source package: [php8]

    Details (1)

    • 8.5.9-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 8.1.12-1.1

      Version impact unknown

      pypi · php8 · opensuse · tumbleweed

  • [php8-gmp]Unknown

    Source package: [php8]

    Details (1)

    • 8.5.9-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 8.1.12-1.1

      Version impact unknown

      pypi · php8 · opensuse · tumbleweed

  • [php8-iconv]Unknown

    Source package: [php8]

    Details (1)

    • 8.5.9-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 8.1.12-1.1

      Version impact unknown

      pypi · php8 · opensuse · tumbleweed

  • [php8-intl]Unknown

    Source package: [php8]

    Details (1)

    • 8.5.9-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 8.1.12-1.1

      Version impact unknown

      pypi · php8 · opensuse · tumbleweed

  • [php8-ldap]Unknown

    Source package: [php8]

    Details (1)

    • 8.5.9-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 8.1.12-1.1

      Version impact unknown

      pypi · php8 · opensuse · tumbleweed

Next results

Observed:

References

[FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]