In PHP versions 7.4.x below 7.4.28, 8.0.x below 8.0.16, and 8.1.x below 8.1.3, when using filter functions with FILTER_VALIDATE_FLOAT filter and min/max limits, if the filter fails, there is a possibility to trigger use of allocated memory after free, which can result it crashes, and potentially in overwrite of other memory chunks and RCE. This issue affects: code that uses FILTER_VALIDATE_FLOAT with min/max limits.
CVSS Details
- CVSS 3.1 Base Score: 8.2
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade php-embeddedUpgrade php-processUpgrade php-pecl-zipUpgrade php-pearUpgrade php-cliUpgrade libzipUpgrade php-gdUpgrade php-mysqlndUpgrade php-snmpUpgrade php-pecl-xdebugUpgrade php-develUpgrade php-xmlrpcUpgrade php-enchantUpgrade php-opcacheUpgrade php-pecl-rrdUpgrade php-mbstringUpgrade php-pecl-xdebug3Upgrade php-fpmUpgrade libzip-develUpgrade php-pdoUpgrade php-xmlUpgrade php-gmpUpgrade php-pecl-apcu-develUpgrade php-odbcUpgrade php-ldapUpgrade php-commonUpgrade phpUpgrade apcu-panelUpgrade libzip-toolsUpgrade php-bcmathUpgrade php-intlUpgrade php-dbaUpgrade php-pgsqlUpgrade php-soapUpgrade php-jsonUpgrade php-dbgUpgrade php-ffiUpgrade php-pecl-apcu | Nov 14, 2022 | Feb 27, 2022 |
| Alpine Linux | — | Upgrade php7Upgrade php8 | Oct 1, 2024 | Feb 27, 2022 |
| Amazon Linux Ami 2 | — | Upgrade php-debuginfoUpgrade php-commonUpgrade php-sodiumUpgrade php-odbcUpgrade php-pgsqlUpgrade php-fpmUpgrade php-develUpgrade php-dbgUpgrade php-mbstringUpgrade php-snmpUpgrade php-bcmathUpgrade php-gdUpgrade php-xmlUpgrade php-soapUpgrade php-pspellUpgrade php-gmpUpgrade php-pdoUpgrade php-intlUpgrade php-dbaUpgrade php-mysqlndUpgrade php-ldapUpgrade phpUpgrade php-processUpgrade php-embeddedUpgrade php-enchantUpgrade php-cliUpgrade php-opcache | Sep 14, 2023 | Feb 27, 2022 |
| Centos_linux | — | Upgrade php-gd-debuginfoUpgrade php-pecl-rrdUpgrade php-mbstringUpgrade php-pecl-xdebug3-debugsourceUpgrade php-json-debuginfoUpgrade php-process-debuginfoUpgrade libzipUpgrade php-pdo-debuginfoUpgrade php-ldapUpgrade php-enchantUpgrade php-pecl-apcu-develUpgrade php-dbaUpgrade php-gdUpgrade php-pecl-apcuUpgrade php-gmpUpgrade php-xml-debuginfoUpgrade php-pecl-xdebugUpgrade php-pearUpgrade php-pdoUpgrade php-odbc-debuginfoUpgrade php-embeddedUpgrade php-bcmathUpgrade php-xmlrpc-debuginfoUpgrade php-dba-debuginfoUpgrade libzip-debugsourceUpgrade php-fpm-debuginfoUpgrade php-ffi-debuginfoUpgrade php-pecl-zip-debugsourceUpgrade php-pecl-apcu-debuginfoUpgrade php-jsonUpgrade php-xmlrpcUpgrade php-pgsqlUpgrade php-mysqlnd-debuginfoUpgrade php-cli-debuginfoUpgrade php-debugsourceUpgrade libzip-tools-debuginfoUpgrade libzip-debuginfoUpgrade php-pecl-apcu-debugsourceUpgrade php-odbcUpgrade php-mbstring-debuginfoUpgrade php-soapUpgrade php-pecl-xdebug-debuginfoUpgrade php-pecl-rrd-debuginfoUpgrade php-fpmUpgrade php-develUpgrade php-processUpgrade php-pecl-zipUpgrade php-pecl-rrd-debugsourceUpgrade php-pecl-xdebug-debugsourceUpgrade php-common-debuginfoUpgrade php-intlUpgrade php-pecl-zip-debuginfoUpgrade php-enchant-debuginfoUpgrade apcu-panelUpgrade php-pgsql-debuginfoUpgrade php-commonUpgrade php-ffiUpgrade php-opcacheUpgrade php-debuginfoUpgrade php-gmp-debuginfoUpgrade php-pecl-xdebug3Upgrade php-dbg-debuginfoUpgrade libzip-toolsUpgrade php-opcache-debuginfoUpgrade php-pecl-xdebug3-debuginfoUpgrade php-xmlUpgrade php-intl-debuginfoUpgrade php-soap-debuginfoUpgrade php-snmp-debuginfoUpgrade php-cliUpgrade php-dbgUpgrade phpUpgrade php-ldap-debuginfoUpgrade php-mysqlndUpgrade php-embedded-debuginfoUpgrade libzip-develUpgrade php-bcmath-debuginfoUpgrade php-snmp | Nov 9, 2022 | Feb 27, 2022 |
| Debian | — | Upgrade php7.4 | Nov 4, 2022 | Feb 27, 2022 |
| Gentoo Linux | — | Upgrade dev-lang/php. | Sep 30, 2022 | Feb 27, 2022 |
| Oracle_linux | — | Upgrade libzip-toolsUpgrade php-intlUpgrade apcu-panelUpgrade php-mysqlndUpgrade php-opcacheUpgrade php-gdUpgrade php-odbcUpgrade php-dbgUpgrade php-ffiUpgrade phpUpgrade php-cliUpgrade libzipUpgrade php-pgsqlUpgrade php-pecl-apcuUpgrade php-embeddedUpgrade php-pecl-zipUpgrade php-enchantUpgrade php-snmpUpgrade php-ldapUpgrade php-dbaUpgrade libzip-develUpgrade php-bcmathUpgrade php-jsonUpgrade php-processUpgrade php-pecl-rrdUpgrade php-pearUpgrade php-develUpgrade php-mbstringUpgrade php-pecl-apcu-develUpgrade php-soapUpgrade php-commonUpgrade php-xmlrpcUpgrade php-xmlUpgrade php-fpmUpgrade php-pecl-xdebugUpgrade php-pdoUpgrade php-gmpUpgrade php-pecl-xdebug3 | Nov 16, 2022 | Feb 17, 2022 |
| Php | — | Upgrade to PHP version 7.4.28Upgrade to PHP version 8.0.16Upgrade to PHP version 8.1.3 | Mar 14, 2022 | Feb 27, 2022 |
| Redhat_linux | — | Upgrade php-dbaUpgrade php-pecl-rrdUpgrade libzip-debuginfoUpgrade php-process-debuginfoUpgrade php-intl-debuginfoUpgrade php-snmp-debuginfoUpgrade php-processUpgrade php-pecl-apcu-debugsourceUpgrade php-odbc-debuginfoUpgrade apcu-panelUpgrade php-pecl-xdebug3-debugsourceUpgrade php-xml-debuginfoUpgrade php-pecl-apcu-develUpgrade php-cli-debuginfoUpgrade php-pgsql-debuginfoUpgrade php-pgsqlUpgrade phpUpgrade php-dba-debuginfoUpgrade php-pecl-zipUpgrade libzip-toolsUpgrade php-soapUpgrade php-odbcUpgrade php-ffiUpgrade libzip-debugsourceUpgrade php-enchantUpgrade php-intlUpgrade libzip-tools-debuginfoUpgrade php-debugsourceUpgrade php-pdo-debuginfoUpgrade php-bcmath-debuginfoUpgrade php-json-debuginfoUpgrade php-embeddedUpgrade php-debuginfoUpgrade php-gmp-debuginfoUpgrade php-opcache-debuginfoUpgrade php-pecl-apcu-debuginfoUpgrade php-ldap-debuginfoUpgrade php-soap-debuginfoUpgrade php-fpm-debuginfoUpgrade php-gdUpgrade php-pecl-xdebug3-debuginfoUpgrade php-jsonUpgrade php-snmpUpgrade libzipUpgrade php-pecl-xdebugUpgrade php-xmlrpc-debuginfoUpgrade php-gmpUpgrade php-common-debuginfoUpgrade php-pecl-xdebug-debugsourceUpgrade php-pearUpgrade php-bcmathUpgrade php-gd-debuginfoUpgrade libzip-develUpgrade php-mbstringUpgrade php-mysqlnd-debuginfoUpgrade php-cliUpgrade php-pecl-xdebug-debuginfoUpgrade php-pecl-apcuUpgrade php-pecl-xdebug3Upgrade php-opcacheUpgrade php-pecl-rrd-debugsourceUpgrade php-xmlUpgrade php-embedded-debuginfoUpgrade php-pecl-zip-debuginfoUpgrade php-ldapUpgrade php-pecl-zip-debugsourceUpgrade php-develUpgrade php-xmlrpcUpgrade php-pdoUpgrade php-pecl-rrd-debuginfoUpgrade php-mbstring-debuginfoUpgrade php-fpmUpgrade php-ffi-debuginfoUpgrade php-mysqlndUpgrade php-dbgUpgrade php-enchant-debuginfoUpgrade php-commonUpgrade php-dbg-debuginfo | Nov 9, 2022 | Feb 27, 2022 |
| Rocky_linux | — | Upgrade php-gd-debuginfoUpgrade php-pdo-debuginfoUpgrade php-pecl-xdebugUpgrade php-ldapUpgrade libzipUpgrade php-dbg-debuginfoUpgrade php-pecl-apcu-debugsourceUpgrade php-embedded-debuginfoUpgrade php-debugsourceUpgrade php-pecl-xdebug3-debugsourceUpgrade php-process-debuginfoUpgrade php-pecl-apcuUpgrade php-xmlrpc-debuginfoUpgrade php-processUpgrade php-gmpUpgrade libzip-debugsourceUpgrade php-embeddedUpgrade php-pecl-rrdUpgrade php-pgsqlUpgrade php-xmlrpcUpgrade php-pecl-xdebug-debuginfoUpgrade php-ffi-debuginfoUpgrade php-odbc-debuginfoUpgrade php-soapUpgrade php-xml-debuginfoUpgrade php-dbaUpgrade php-enchantUpgrade php-jsonUpgrade php-pecl-apcu-debuginfoUpgrade php-cli-debuginfoUpgrade php-mysqlnd-debuginfoUpgrade php-develUpgrade libzip-tools-debuginfoUpgrade php-pecl-zip-debugsourceUpgrade php-bcmathUpgrade php-pecl-rrd-debuginfoUpgrade php-gmp-debuginfoUpgrade php-fpm-debuginfoUpgrade php-pdoUpgrade php-pecl-zipUpgrade php-gdUpgrade php-fpmUpgrade php-pecl-apcu-develUpgrade php-dbgUpgrade php-intlUpgrade libzip-develUpgrade php-debuginfoUpgrade php-enchant-debuginfoUpgrade php-ffiUpgrade php-opcache-debuginfoUpgrade php-soap-debuginfoUpgrade php-bcmath-debuginfoUpgrade phpUpgrade libzip-toolsUpgrade php-opcacheUpgrade php-mbstringUpgrade php-xmlUpgrade php-intl-debuginfoUpgrade php-commonUpgrade libzip-debuginfoUpgrade php-pecl-zip-debuginfoUpgrade php-pecl-xdebug3-debuginfoUpgrade php-pecl-xdebug3Upgrade php-mysqlndUpgrade php-odbcUpgrade php-cliUpgrade php-snmpUpgrade php-pgsql-debuginfoUpgrade php-dba-debuginfoUpgrade php-snmp-debuginfoUpgrade php-mbstring-debuginfoUpgrade php-ldap-debuginfoUpgrade php-pecl-rrd-debugsourceUpgrade php-common-debuginfoUpgrade php-pecl-xdebug-debugsourceUpgrade php-json-debuginfo | Mar 12, 2024 | Feb 27, 2022 |
| Suse | — | Upgrade php74-pgsqlUpgrade php7-fastcgiUpgrade php74-fpmUpgrade php74-tokenizerUpgrade php7-enchantUpgrade php7-bcmathUpgrade php7-intlUpgrade apache2-mod_php74Upgrade php74-curlUpgrade php74-socketsUpgrade php74-enchantUpgrade php74-fastcgiUpgrade php7-testUpgrade php74-jsonUpgrade php7-ftpUpgrade php7-pdoUpgrade php7-ctypeUpgrade php74-gettextUpgrade php74-sodiumUpgrade php7-calendarUpgrade apache2-mod_php7Upgrade php7-iconvUpgrade php74-odbcUpgrade php74-opcacheUpgrade php7-zipUpgrade php74-shmopUpgrade php7-sysvmsgUpgrade php74-pcntlUpgrade php74-zipUpgrade php7-pcntlUpgrade php74-sqliteUpgrade php7-xmlwriterUpgrade php7-fpmUpgrade php74-pdoUpgrade php7-fileinfoUpgrade php74-sysvshmUpgrade php7-pharUpgrade php7-opcacheUpgrade php7-sysvsemUpgrade php7-snmpUpgrade php74-gdUpgrade php74-bz2Upgrade php74-mysqlUpgrade php74-xslUpgrade php7-pgsqlUpgrade php74-develUpgrade php74-snmpUpgrade php7-tokenizerUpgrade php74-tidyUpgrade php7-curlUpgrade php7-readlineUpgrade php74-zlibUpgrade php7-cliUpgrade php74-ctypeUpgrade php74-sysvmsgUpgrade php7-mysqlUpgrade php74-sysvsemUpgrade php7-embedUpgrade php7-sqliteUpgrade php7-firebirdUpgrade php7-xmlrpcUpgrade php7-jsonUpgrade php74-ldapUpgrade php74-xmlwriterUpgrade php7-ldapUpgrade php74-dbaUpgrade php7-tidyUpgrade php7-develUpgrade php74-domUpgrade php74-calendarUpgrade php74-exifUpgrade php74-intlUpgrade php74-xmlreaderUpgrade php74-soapUpgrade php74-gmpUpgrade php74-readlineUpgrade php74Upgrade php7-posixUpgrade php74-bcmathUpgrade php7-sodiumUpgrade php7-dbaUpgrade php7Upgrade php7-zlibUpgrade php7-exifUpgrade php74-ftpUpgrade php74-fileinfoUpgrade php7-domUpgrade php74-mbstringUpgrade php7-xmlreaderUpgrade php74-opensslUpgrade php7-bz2Upgrade php74-posixUpgrade php74-xmlrpcUpgrade php74-iconvUpgrade php7-gdUpgrade php7-socketsUpgrade php7-soapUpgrade php7-gettextUpgrade php7-gmpUpgrade php7-opensslUpgrade php7-sysvshmUpgrade php74-pharUpgrade php7-xslUpgrade php7-odbcUpgrade php7-shmopUpgrade php7-mbstring | Mar 2, 2022 | Feb 27, 2022 |
| Ubuntu | — | Upgrade php7.4-fpmUpgrade php7.4-cgiUpgrade php7.4-cliUpgrade php8.0-fpmUpgrade php8.0-cgiUpgrade php8.0-cli | Mar 22, 2023 | Feb 27, 2022 |
| Zimbra Collaboration | — | Upgrade Zimbra Collaboration to the latest version | Jan 20, 2025 | Feb 27, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub