vulnerability
Alma Linux: CVE-2024-11235: Important: php:8.3 security update (ALSA-2025-7418)
| Severity | CVSS | Published | Added | Modified |
|---|---|---|---|---|
| 9 | (AV:N/AC:M/Au:N/C:C/I:C/A:C) | Apr 4, 2025 | Jul 4, 2025 | Mar 31, 2026 |
Severity
9
CVSS
(AV:N/AC:M/Au:N/C:C/I:C/A:C)
Published
Apr 4, 2025
Added
Jul 4, 2025
Modified
Mar 31, 2026
Description
In PHP versions 8.3.* before 8.3.19 and 8.4.* before 8.4.5, a code sequence involving __set handler or ??= operator and exceptions can lead to a use-after-free vulnerability. If the third party can control the memory layout leading to this, for example by supplying specially crafted inputs to the script, it could lead to remote code execution.
Solutions
alma-upgrade-apcu-panelalma-upgrade-phpalma-upgrade-php-bcmathalma-upgrade-php-clialma-upgrade-php-commonalma-upgrade-php-dbaalma-upgrade-php-dbgalma-upgrade-php-develalma-upgrade-php-embeddedalma-upgrade-php-enchantalma-upgrade-php-ffialma-upgrade-php-fpmalma-upgrade-php-gdalma-upgrade-php-gmpalma-upgrade-php-intlalma-upgrade-php-ldapalma-upgrade-php-mbstringalma-upgrade-php-mysqlndalma-upgrade-php-odbcalma-upgrade-php-opcachealma-upgrade-php-pdoalma-upgrade-php-pecl-apcualma-upgrade-php-pecl-apcu-develalma-upgrade-php-pecl-redis6alma-upgrade-php-pecl-rrd
Rapid7 Labs
2026 Global Threat Landscape Report
The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.