How many CVEs have a located fix in php/php-src?

73 published CVEs have a fix traced to functions in php/php-src, touching 108 functions across 53 files.

Which function in php/php-src has been patched by the most CVEs?

php_wddx_pop_element in ext/wddx/wddx.c has been changed by 5 CVE fixes, from 2016 to 2017.

How large is a typical CVE fix in php/php-src?

The median fix changes 10 lines. 68% of fixes change 20 lines or fewer, and 59% change a single function.

How is a fix located to a function?

The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

RadicalNotion.AI

Log in Create an account

c

#50 of 500 repositories

php/php-src

Name: php/php-src: functions patched by CVE fixes
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

Functions and files changed by CVE fixes in this repository.

Latest located fix February 27, 2022

73

CVE fixes located

Published CVEs

108

Functions patched

Distinct function sites

53

Files patched

Distinct source files

2013–2022

Years covered

By CVE publication date

Overview

73 published CVEs have a fix traced to functions in php/php-src, the earliest published in 2013. Those fixes changed 108 distinct functions across 53 files, in 1,269 patch hunks.

Among the 500 repositories tracked here, php/php-src ranks #50 by the number of CVEs with a located fix.

Most patched functions

Functions in php/php-src changed by the most CVE fixes.

Most patched files

Files in php/php-src changed by the most CVE fixes.

1ext/wddx/wddx.c10 CVEs · 6 functions
2main/php_version.h7 CVEs · 0 functions
3ext/standard/var_unserializer.c5 CVEs · 5 functions
4ext/gd/gd.c4 CVEs · 3 functions
5Zend/zend.h3 CVEs · 0 functions
6ext/gd/libgd/gd.c2 CVEs · 9 functions
7ext/exif/exif.c2 CVEs · 2 functions
8ext/spl/spl_array.c2 CVEs · 2 functions
9ext/phar/phar.c2 CVEs · 1 functions
10ext/standard/dns.c2 CVEs · 1 functions

Fix size

How much code a CVE fix in php/php-src changes, with backports counted once.

10

Median lines changed

Added plus removed, per CVE

68%

Fixes of 20 lines or fewer

Share of CVE fixes

59%

Fixes in a single function

Share of CVE fixes

Latest CVEs

The most recently published CVEs with a fix located in php/php-src, and the functions each fix changed.

CVE-2021-21708
CVE-2021-21708
Critical · CVSS 9.8
EPSS 3.0%2022-02-27
CVE-2019-11047
CVE-2019-11047
Medium · CVSS 6.5
EPSS 7.5%2019-12-23
CVE-2017-7189
CVE-2017-7189parse_ip_address_ex
High · CVSS 7.5
EPSS 2.4%2019-07-10
Uninitialized read in gdImageCreateFromXbm
CVE-2019-11038
Medium · CVSS 5.3
EPSS 4.3%2019-06-18
CVE-2019-6978
CVE-2019-6978gdImageGifPtr gdImageJpegPtr gdImageWBMPPtr
Critical · CVSS 9.8
EPSS 4.5%2019-01-28
CVE-2018-17082
CVE-2018-17082
Medium · CVSS 6.1
EPSS 4.1%2018-09-16
CVE-2018-15132
CVE-2018-15132
High · CVSS 7.5
EPSS 5.1%2018-08-07
CVE-2018-14851
CVE-2018-14851
Medium · CVSS 5.5
EPSS 4.3%2018-08-02
CVE-2018-7584
CVE-2018-7584php_stream_url_wrap_http_ex
Critical · CVSS 9.8
EPSS 87.3%2018-03-01
CVE-2015-9253
CVE-2015-9253
Medium · CVSS 6.5
EPSS 4.2%2018-02-19
CVE-2017-16642
CVE-2017-16642scan License
High · CVSS 7.5
EPSS 26.4%2017-11-07
CVE-2017-12932
CVE-2017-12932php_var_unserialize_internal process_nested_data
Critical · CVSS 9.8
EPSS 7.4%2017-08-18

Get an alert for each new php/php-src CVE, with the patched functions and AI-written analysis.

Monitor php-src CVEs

Other repositories

Repositories with a similar number of located CVE fixes.

apache/camel73 CVEs bcgit/bc-java73 CVEs wordpress/core73 CVEs FasterXML/jackson-databind72 CVEs ImageMagick/ImageMagick671 CVEs open-webui/open-webui71 CVEs symfony/symfony76 CVEs TYPO3/typo376 CVEs

Browse all repositories

Frequently asked questions

Common questions about CVE fixes in php/php-src.

How many CVEs have a located fix in php/php-src?: 73 published CVEs have a fix traced to functions in php/php-src, touching 108 functions across 53 files.
Which function in php/php-src has been patched by the most CVEs?: php_wddx_pop_element in ext/wddx/wddx.c has been changed by 5 CVE fixes, from 2016 to 2017.
How large is a typical CVE fix in php/php-src?: The median fix changes 10 lines. 68% of fixes change 20 lines or fewer, and 59% change a single function.
How is a fix located to a function?: The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

References

Fix locations are computed by RadicalNotion.AI from the upstream patch diff of each CVE. CVE data is sourced from the CVE Program.

Track php/php-src CVEs

Get an alert when a new CVE lands in this repository, with the patched functions and AI-written remediation guidance.

Create an account See pricing