In PHP versions 7.3.x below 7.3.16 and 7.4.x below 7.4.4, while using mb_strtolower() function with UTF-32LE encoding, certain invalid strings could cause PHP to overwrite stack-allocated buffer. This could lead to memory corruption, crashes and potentially code execution.
CVSS Details
- CVSS 3.1 Base Score: 7.4
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade php-xmlUpgrade libzip-develUpgrade php-dbgUpgrade php-pecl-apcuUpgrade php-pearUpgrade php-embeddedUpgrade php-xmlrpcUpgrade php-fpmUpgrade php-commonUpgrade php-develUpgrade php-pecl-xdebugUpgrade php-mbstringUpgrade php-recodeUpgrade php-pdoUpgrade php-mysqlndUpgrade php-snmpUpgrade php-opcacheUpgrade php-ldapUpgrade php-cliUpgrade php-bcmathUpgrade libzip-toolsUpgrade php-pgsqlUpgrade php-jsonUpgrade php-enchantUpgrade php-intlUpgrade php-gdUpgrade php-pecl-apcu-develUpgrade phpUpgrade php-dbaUpgrade php-odbcUpgrade php-pecl-zipUpgrade php-gmpUpgrade libzipUpgrade php-processUpgrade php-pecl-rrdUpgrade php-soapUpgrade apcu-panel | May 4, 2022 | Apr 1, 2020 |
| Alpine Linux | — | Upgrade php7 | Oct 1, 2024 | Apr 1, 2020 |
| Amazon_linux | — | Upgrade php73 | May 15, 2020 | Apr 1, 2020 |
| Centos_linux | — | Upgrade libzip-debugsourceUpgrade php-dbg-debuginfoUpgrade php-embeddedUpgrade php-enchantUpgrade php-gmpUpgrade php-pdoUpgrade php-pdo-debuginfoUpgrade php-debugsourceUpgrade php-embedded-debuginfoUpgrade php-dbaUpgrade phpUpgrade php-pecl-apcu-develUpgrade php-process-debuginfoUpgrade php-opcacheUpgrade php-pecl-rrd-debuginfoUpgrade php-processUpgrade libzip-toolsUpgrade php-mysqlndUpgrade php-jsonUpgrade php-pecl-apcu-debuginfoUpgrade php-pecl-rrd-debugsourceUpgrade php-opcache-debuginfoUpgrade php-pearUpgrade php-cliUpgrade php-cli-debuginfoUpgrade libzipUpgrade php-ldap-debuginfoUpgrade php-xmlrpcUpgrade php-recode-debuginfoUpgrade php-xmlrpc-debuginfoUpgrade php-pecl-zipUpgrade php-gd-debuginfoUpgrade php-gdUpgrade php-bcmath-debuginfoUpgrade php-pecl-rrdUpgrade php-recodeUpgrade php-mbstringUpgrade php-snmp-debuginfoUpgrade php-soapUpgrade php-intl-debuginfoUpgrade php-pecl-xdebugUpgrade libzip-tools-debuginfoUpgrade php-snmpUpgrade php-bcmathUpgrade php-ldapUpgrade php-fpm-debuginfoUpgrade php-enchant-debuginfoUpgrade php-pgsql-debuginfoUpgrade php-pecl-apcu-debugsourceUpgrade php-xml-debuginfoUpgrade php-fpmUpgrade php-pgsqlUpgrade php-odbcUpgrade apcu-panelUpgrade php-dba-debuginfoUpgrade php-gmp-debuginfoUpgrade libzip-debuginfoUpgrade php-soap-debuginfoUpgrade php-pecl-xdebug-debugsourceUpgrade php-develUpgrade php-pecl-zip-debuginfoUpgrade php-dbgUpgrade php-mysqlnd-debuginfoUpgrade php-commonUpgrade libzip-develUpgrade php-xmlUpgrade php-pecl-xdebug-debuginfoUpgrade php-odbc-debuginfoUpgrade php-json-debuginfoUpgrade php-intlUpgrade php-debuginfoUpgrade php-common-debuginfoUpgrade php-pecl-zip-debugsourceUpgrade php-pecl-apcuUpgrade php-mbstring-debuginfo | Sep 9, 2020 | Apr 1, 2020 |
| Debian | — | Upgrade php7.4 | Jul 8, 2020 | Apr 1, 2020 |
| Gentoo Linux | — | Upgrade dev-lang/php. | Mar 27, 2020 | Mar 26, 2020 |
| Oracle Solaris | — | Upgrade web/php-73 to version 7.3.17-11.4.22.0.1.69.2 on Solaris 11.4Upgrade web/php-74 to version 7.4.5-11.4.22.0.1.69.2 on Solaris 11.4 | Jan 19, 2021 | Apr 1, 2020 |
| Oracle_linux | — | Upgrade php-pecl-apcuUpgrade php-pecl-xdebugUpgrade php-dbgUpgrade libzipUpgrade php-cliUpgrade phpUpgrade php-pdoUpgrade php-bcmathUpgrade php-enchantUpgrade php-xmlUpgrade php-embeddedUpgrade php-gmpUpgrade php-snmpUpgrade php-ldapUpgrade php-pecl-zipUpgrade php-recodeUpgrade php-commonUpgrade php-develUpgrade php-pearUpgrade php-jsonUpgrade php-fpmUpgrade php-odbcUpgrade libzip-toolsUpgrade php-intlUpgrade php-mbstringUpgrade php-gdUpgrade php-pecl-apcu-develUpgrade apcu-panelUpgrade php-mysqlndUpgrade php-opcacheUpgrade php-pecl-rrdUpgrade php-processUpgrade libzip-develUpgrade php-xmlrpcUpgrade php-dbaUpgrade php-soapUpgrade php-pgsql | Sep 10, 2020 | Apr 1, 2020 |
| Php | — | Upgrade to PHP version 7.4.4Upgrade to PHP version 7.3.16 | Apr 6, 2020 | Apr 1, 2020 |
| Redhat_linux | — | Upgrade php-embedded-debuginfoUpgrade php-embeddedUpgrade php-xmlUpgrade php-pecl-rrd-debuginfoUpgrade php-ldapUpgrade php-recode-debuginfoUpgrade php-pecl-xdebug-debugsourceUpgrade php-gmp-debuginfoUpgrade php-pearUpgrade php-enchantUpgrade php-pecl-zipUpgrade php-debugsourceUpgrade php-json-debuginfoUpgrade phpUpgrade php-common-debuginfoUpgrade php-pecl-xdebugUpgrade php-pdoUpgrade php-cliUpgrade php-odbc-debuginfoUpgrade php-xmlrpc-debuginfoUpgrade php-gd-debuginfoUpgrade php-enchant-debuginfoUpgrade php-gmpUpgrade php-pecl-xdebug-debuginfoUpgrade libzip-debuginfoUpgrade php-pecl-zip-debugsourceUpgrade php-pecl-apcu-debugsourceUpgrade php-commonUpgrade php-bcmathUpgrade php-dba-debuginfoUpgrade php-jsonUpgrade php-mbstring-debuginfoUpgrade php-fpmUpgrade php-pecl-zip-debuginfoUpgrade php-pecl-apcuUpgrade php-recodeUpgrade php-snmpUpgrade libzipUpgrade php-odbcUpgrade php-dbgUpgrade php-develUpgrade php-pgsqlUpgrade libzip-debugsourceUpgrade php-process-debuginfoUpgrade php-xml-debuginfoUpgrade php-soap-debuginfoUpgrade php-opcache-debuginfoUpgrade php-pdo-debuginfoUpgrade php-mysqlnd-debuginfoUpgrade php-mbstringUpgrade libzip-toolsUpgrade php-cli-debuginfoUpgrade php-pecl-apcu-debuginfoUpgrade php-ldap-debuginfoUpgrade apcu-panelUpgrade php-bcmath-debuginfoUpgrade php-opcacheUpgrade php-gdUpgrade php-soapUpgrade php-xmlrpcUpgrade php-pgsql-debuginfoUpgrade php-debuginfoUpgrade php-dbg-debuginfoUpgrade php-dbaUpgrade php-pecl-rrd-debugsourceUpgrade php-intl-debuginfoUpgrade php-intlUpgrade libzip-develUpgrade php-mysqlndUpgrade php-processUpgrade libzip-tools-debuginfoUpgrade php-pecl-apcu-develUpgrade php-fpm-debuginfoUpgrade php-snmp-debuginfoUpgrade php-pecl-rrd | Sep 9, 2020 | Apr 1, 2020 |
| Rocky_linux | — | Upgrade php-pecl-apcu-debuginfoUpgrade php-bcmathUpgrade php-gmpUpgrade php-xml-debuginfoUpgrade php-xmlrpc-debuginfoUpgrade php-gdUpgrade php-mysqlnd-debuginfoUpgrade php-pecl-apcu-develUpgrade php-pecl-xdebug-debuginfoUpgrade php-intl-debuginfoUpgrade php-mbstringUpgrade php-cli-debuginfoUpgrade php-pecl-xdebug-debugsourceUpgrade php-gd-debuginfoUpgrade libzip-debugsourceUpgrade php-fpmUpgrade php-xmlrpcUpgrade libzipUpgrade php-pecl-zipUpgrade php-pgsqlUpgrade php-pdoUpgrade php-pdo-debuginfoUpgrade libzip-tools-debuginfoUpgrade php-jsonUpgrade php-develUpgrade php-odbc-debuginfoUpgrade php-dba-debuginfoUpgrade php-pecl-apcuUpgrade libzip-debuginfoUpgrade php-dbaUpgrade php-odbcUpgrade php-pecl-xdebugUpgrade php-dbg-debuginfoUpgrade php-json-debuginfoUpgrade php-enchantUpgrade php-enchant-debuginfoUpgrade php-soapUpgrade php-pecl-rrd-debuginfoUpgrade php-mbstring-debuginfoUpgrade php-pecl-zip-debugsourceUpgrade php-debuginfoUpgrade php-recodeUpgrade libzip-toolsUpgrade php-mysqlndUpgrade libzip-develUpgrade php-soap-debuginfoUpgrade php-process-debuginfoUpgrade php-pgsql-debuginfoUpgrade php-commonUpgrade php-pecl-rrdUpgrade php-ldap-debuginfoUpgrade php-recode-debuginfoUpgrade php-opcacheUpgrade php-common-debuginfoUpgrade php-intlUpgrade php-xmlUpgrade php-embedded-debuginfoUpgrade php-pecl-apcu-debugsourceUpgrade php-pecl-rrd-debugsourceUpgrade php-snmpUpgrade php-ldapUpgrade php-embeddedUpgrade php-dbgUpgrade php-gmp-debuginfoUpgrade php-fpm-debuginfoUpgrade php-cliUpgrade phpUpgrade php-processUpgrade php-snmp-debuginfoUpgrade php-opcache-debuginfoUpgrade php-bcmath-debuginfoUpgrade php-pecl-zip-debuginfoUpgrade php-debugsource | Mar 12, 2024 | Apr 1, 2020 |
| Ubuntu | — | Upgrade php7.4-cgiUpgrade php7.4-mbstringUpgrade php7.3-fpmUpgrade php7.4-fpmUpgrade libapache2-mod-php7.3Upgrade php7.3-cliUpgrade php7.3-cgiUpgrade php7.3-mbstringUpgrade php7.4-cliUpgrade libapache2-mod-php7.4 | Apr 16, 2020 | Apr 1, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub