In PHP versions 7.3.x below 7.3.16 and 7.4.x below 7.4.4, while using mb_strtolower() function with UTF-32LE encoding, certain invalid strings could cause PHP to overwrite stack-allocated buffer. This could lead to memory corruption, crashes and potentially code execution.
CVSS Details
- CVSS 3.1 Base Score: 7.4
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade phpUpgrade php-pgsqlUpgrade php-intlUpgrade php-dbaUpgrade php-pecl-zipUpgrade php-jsonUpgrade php-processUpgrade php-enchantUpgrade php-pecl-apcu-develUpgrade php-gmpUpgrade php-odbcUpgrade apcu-panelUpgrade php-gdUpgrade php-soapUpgrade libzip-toolsUpgrade libzipUpgrade php-pecl-rrdUpgrade php-opcacheUpgrade php-dbgUpgrade php-recodeUpgrade php-commonUpgrade php-bcmathUpgrade php-mysqlndUpgrade php-pecl-apcuUpgrade php-embeddedUpgrade libzip-develUpgrade php-mbstringUpgrade php-develUpgrade php-xmlUpgrade php-pearUpgrade php-snmpUpgrade php-ldapUpgrade php-cliUpgrade php-fpmUpgrade php-pdoUpgrade php-xmlrpcUpgrade php-pecl-xdebug | May 4, 2022 | Apr 1, 2020 |
| Alpine Linux | — | Upgrade php7 | Oct 1, 2024 | Apr 1, 2020 |
| Amazon_linux | — | Upgrade php73 | May 15, 2020 | Apr 1, 2020 |
| Centos_linux | — | Upgrade php-json-debuginfoUpgrade php-odbc-debuginfoUpgrade php-common-debuginfoUpgrade php-debuginfoUpgrade php-fpmUpgrade php-gmp-debuginfoUpgrade php-intlUpgrade php-pecl-zip-debuginfoUpgrade php-xml-debuginfoUpgrade php-soap-debuginfoUpgrade libzip-debuginfoUpgrade php-pecl-xdebug-debugsourceUpgrade php-bcmathUpgrade php-mysqlnd-debuginfoUpgrade php-xmlUpgrade php-develUpgrade php-snmpUpgrade php-ldapUpgrade php-pecl-apcuUpgrade php-fpm-debuginfoUpgrade php-pecl-apcu-debugsourceUpgrade php-dbgUpgrade php-enchant-debuginfoUpgrade php-pecl-zip-debugsourceUpgrade php-dba-debuginfoUpgrade libzip-develUpgrade php-mbstring-debuginfoUpgrade php-pgsql-debuginfoUpgrade php-commonUpgrade php-pgsqlUpgrade php-pecl-xdebug-debuginfoUpgrade apcu-panelUpgrade php-odbcUpgrade php-pecl-zipUpgrade php-gmpUpgrade php-recode-debuginfoUpgrade php-pecl-apcu-develUpgrade php-pdo-debuginfoUpgrade php-pdoUpgrade php-mysqlndUpgrade php-enchantUpgrade php-dbg-debuginfoUpgrade php-embeddedUpgrade libzip-debugsourceUpgrade php-intl-debuginfoUpgrade php-xmlrpcUpgrade php-recodeUpgrade php-process-debuginfoUpgrade php-pecl-xdebugUpgrade php-gdUpgrade php-pecl-rrdUpgrade php-pearUpgrade php-opcacheUpgrade php-pecl-rrd-debugsourceUpgrade php-gd-debuginfoUpgrade libzip-tools-debuginfoUpgrade php-xmlrpc-debuginfoUpgrade php-mbstringUpgrade php-ldap-debuginfoUpgrade php-cli-debuginfoUpgrade libzipUpgrade php-cliUpgrade php-bcmath-debuginfoUpgrade libzip-toolsUpgrade phpUpgrade php-embedded-debuginfoUpgrade php-debugsourceUpgrade php-pecl-apcu-debuginfoUpgrade php-jsonUpgrade php-snmp-debuginfoUpgrade php-dbaUpgrade php-opcache-debuginfoUpgrade php-soapUpgrade php-processUpgrade php-pecl-rrd-debuginfo | Sep 9, 2020 | Apr 1, 2020 |
| Debian | — | Upgrade php7.4 | Jul 8, 2020 | Apr 1, 2020 |
| Gentoo Linux | — | Upgrade dev-lang/php. | Mar 27, 2020 | Mar 26, 2020 |
| Oracle Solaris | — | Upgrade web/php-74 to version 7.4.5-11.4.22.0.1.69.2 on Solaris 11.4Upgrade web/php-73 to version 7.3.17-11.4.22.0.1.69.2 on Solaris 11.4 | Jan 19, 2021 | Apr 1, 2020 |
| Oracle_linux | — | Upgrade php-pecl-rrdUpgrade libzip-develUpgrade php-opcacheUpgrade php-gdUpgrade php-pgsqlUpgrade apcu-panelUpgrade libzip-toolsUpgrade php-soapUpgrade php-intlUpgrade php-processUpgrade php-xmlrpcUpgrade php-dbaUpgrade php-pecl-apcu-develUpgrade php-mbstringUpgrade php-mysqlndUpgrade php-xmlUpgrade php-pecl-xdebugUpgrade php-snmpUpgrade php-enchantUpgrade phpUpgrade php-cliUpgrade php-gmpUpgrade php-pecl-zipUpgrade php-recodeUpgrade php-bcmathUpgrade php-fpmUpgrade php-pdoUpgrade php-commonUpgrade php-develUpgrade php-odbcUpgrade php-pearUpgrade php-jsonUpgrade php-embeddedUpgrade php-ldapUpgrade libzipUpgrade php-pecl-apcuUpgrade php-dbg | Sep 10, 2020 | Apr 1, 2020 |
| Php | — | Upgrade to PHP version 7.3.16Upgrade to PHP version 7.4.4 | Apr 6, 2020 | Apr 1, 2020 |
| Redhat_linux | — | Upgrade libzip-tools-debuginfoUpgrade php-gdUpgrade libzip-develUpgrade libzip-toolsUpgrade php-pdo-debuginfoUpgrade php-pecl-rrd-debugsourceUpgrade php-opcache-debuginfoUpgrade php-opcacheUpgrade php-intl-debuginfoUpgrade php-pecl-apcu-develUpgrade php-pecl-rrdUpgrade php-pecl-apcu-debuginfoUpgrade php-dbaUpgrade php-mysqlnd-debuginfoUpgrade php-soap-debuginfoUpgrade php-ldap-debuginfoUpgrade php-cli-debuginfoUpgrade php-dbg-debuginfoUpgrade php-xmlrpcUpgrade php-soapUpgrade php-bcmath-debuginfoUpgrade apcu-panelUpgrade php-processUpgrade php-pgsqlUpgrade php-mbstringUpgrade php-fpm-debuginfoUpgrade php-xml-debuginfoUpgrade php-debuginfoUpgrade libzip-debugsourceUpgrade php-pgsql-debuginfoUpgrade php-mysqlndUpgrade php-snmp-debuginfoUpgrade php-intlUpgrade php-process-debuginfoUpgrade php-dba-debuginfoUpgrade php-recode-debuginfoUpgrade php-pecl-apcuUpgrade php-jsonUpgrade php-snmpUpgrade php-debugsourceUpgrade php-common-debuginfoUpgrade php-pecl-xdebugUpgrade php-recodeUpgrade php-odbc-debuginfoUpgrade php-cliUpgrade php-gmp-debuginfoUpgrade php-pecl-zipUpgrade php-pearUpgrade php-pecl-xdebug-debugsourceUpgrade phpUpgrade php-pecl-rrd-debuginfoUpgrade php-enchantUpgrade php-dbgUpgrade php-gd-debuginfoUpgrade php-pdoUpgrade php-embedded-debuginfoUpgrade php-develUpgrade libzip-debuginfoUpgrade php-pecl-zip-debugsourceUpgrade libzipUpgrade php-mbstring-debuginfoUpgrade php-embeddedUpgrade php-fpmUpgrade php-xmlrpc-debuginfoUpgrade php-odbcUpgrade php-ldapUpgrade php-enchant-debuginfoUpgrade php-commonUpgrade php-bcmathUpgrade php-json-debuginfoUpgrade php-xmlUpgrade php-pecl-apcu-debugsourceUpgrade php-pecl-xdebug-debuginfoUpgrade php-gmpUpgrade php-pecl-zip-debuginfo | Sep 9, 2020 | Apr 1, 2020 |
| Rocky_linux | — | Upgrade php-pdoUpgrade libzipUpgrade php-pecl-apcu-develUpgrade php-pecl-apcu-debuginfoUpgrade php-gdUpgrade php-cli-debuginfoUpgrade php-pgsqlUpgrade php-mbstring-debuginfoUpgrade libzip-debuginfoUpgrade php-enchant-debuginfoUpgrade php-dbg-debuginfoUpgrade php-soapUpgrade php-xml-debuginfoUpgrade php-json-debuginfoUpgrade php-mysqlnd-debuginfoUpgrade php-pecl-zip-debugsourceUpgrade php-pecl-apcuUpgrade php-xmlrpcUpgrade php-pecl-xdebug-debuginfoUpgrade php-dba-debuginfoUpgrade php-pdo-debuginfoUpgrade php-pecl-rrd-debuginfoUpgrade php-jsonUpgrade php-odbcUpgrade php-pecl-zipUpgrade php-odbc-debuginfoUpgrade php-develUpgrade php-pecl-xdebugUpgrade php-bcmathUpgrade php-dbaUpgrade php-intl-debuginfoUpgrade php-fpmUpgrade php-gd-debuginfoUpgrade php-xmlrpc-debuginfoUpgrade php-mbstringUpgrade libzip-tools-debuginfoUpgrade libzip-debugsourceUpgrade php-enchantUpgrade php-gmpUpgrade php-pecl-xdebug-debugsourceUpgrade php-debugsourceUpgrade php-gmp-debuginfoUpgrade php-embeddedUpgrade php-recodeUpgrade php-ldapUpgrade php-commonUpgrade php-dbgUpgrade libzip-toolsUpgrade php-opcache-debuginfoUpgrade php-bcmath-debuginfoUpgrade php-snmpUpgrade php-pecl-apcu-debugsourceUpgrade php-pecl-rrd-debugsourceUpgrade php-intlUpgrade php-pecl-zip-debuginfoUpgrade php-common-debuginfoUpgrade libzip-develUpgrade php-soap-debuginfoUpgrade php-cliUpgrade php-processUpgrade php-process-debuginfoUpgrade php-mysqlndUpgrade php-fpm-debuginfoUpgrade php-pgsql-debuginfoUpgrade phpUpgrade php-opcacheUpgrade php-ldap-debuginfoUpgrade php-debuginfoUpgrade php-recode-debuginfoUpgrade php-pecl-rrdUpgrade php-snmp-debuginfoUpgrade php-embedded-debuginfoUpgrade php-xml | Mar 12, 2024 | Apr 1, 2020 |
| Ubuntu | — | Upgrade php7.4-fpmUpgrade php7.4-cgiUpgrade libapache2-mod-php7.3Upgrade php7.3-fpmUpgrade php7.3-cgiUpgrade php7.4-mbstringUpgrade php7.3-cliUpgrade php7.3-mbstringUpgrade libapache2-mod-php7.4Upgrade php7.4-cli | Apr 16, 2020 | Apr 1, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub