In PHP versions 7.3.x below 7.3.16 and 7.4.x below 7.4.4, while using mb_strtolower() function with UTF-32LE encoding, certain invalid strings could cause PHP to overwrite stack-allocated buffer. This could lead to memory corruption, crashes and potentially code execution.
CVSS Details
- CVSS 3.1 Base Score: 7.4
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade apcu-panelUpgrade php-intlUpgrade libzipUpgrade phpUpgrade php-gmpUpgrade php-enchantUpgrade php-pecl-rrdUpgrade php-odbcUpgrade php-pecl-apcu-develUpgrade php-dbaUpgrade php-pgsqlUpgrade php-jsonUpgrade php-gdUpgrade php-soapUpgrade php-processUpgrade libzip-toolsUpgrade php-pecl-zipUpgrade php-pdoUpgrade libzip-develUpgrade php-pearUpgrade php-dbgUpgrade php-mbstringUpgrade php-bcmathUpgrade php-xmlrpcUpgrade php-snmpUpgrade php-commonUpgrade php-opcacheUpgrade php-pecl-xdebugUpgrade php-pecl-apcuUpgrade php-ldapUpgrade php-recodeUpgrade php-develUpgrade php-xmlUpgrade php-mysqlndUpgrade php-fpmUpgrade php-cliUpgrade php-embedded | May 4, 2022 | Apr 1, 2020 |
| Alpine Linux | — | Upgrade php7 | Oct 1, 2024 | Apr 1, 2020 |
| Amazon_linux | — | Upgrade php73 | May 15, 2020 | Apr 1, 2020 |
| Centos_linux | — | Upgrade libzip-debuginfoUpgrade php-xml-debuginfoUpgrade php-xmlUpgrade php-develUpgrade libzip-develUpgrade php-mysqlnd-debuginfoUpgrade php-intlUpgrade apcu-panelUpgrade php-pecl-apcuUpgrade php-pecl-apcu-debugsourceUpgrade php-ldapUpgrade php-pecl-zip-debugsourceUpgrade php-pgsql-debuginfoUpgrade php-mbstring-debuginfoUpgrade php-fpm-debuginfoUpgrade php-debuginfoUpgrade php-commonUpgrade php-dbgUpgrade php-pgsqlUpgrade php-pecl-zip-debuginfoUpgrade php-json-debuginfoUpgrade php-odbc-debuginfoUpgrade php-enchant-debuginfoUpgrade php-fpmUpgrade php-pecl-xdebug-debugsourceUpgrade php-snmpUpgrade php-pecl-xdebug-debuginfoUpgrade php-dba-debuginfoUpgrade php-odbcUpgrade php-soap-debuginfoUpgrade php-bcmathUpgrade php-common-debuginfoUpgrade php-gmp-debuginfoUpgrade php-pecl-rrd-debugsourceUpgrade php-intl-debuginfoUpgrade php-cli-debuginfoUpgrade php-cliUpgrade libzipUpgrade php-recode-debuginfoUpgrade php-xmlrpc-debuginfoUpgrade php-pdoUpgrade php-enchantUpgrade php-dbg-debuginfoUpgrade libzip-debugsourceUpgrade php-gmpUpgrade php-embeddedUpgrade php-gd-debuginfoUpgrade php-mysqlndUpgrade php-pecl-rrdUpgrade phpUpgrade php-opcache-debuginfoUpgrade php-embedded-debuginfoUpgrade php-debugsourceUpgrade php-pecl-apcu-debuginfoUpgrade php-jsonUpgrade php-gdUpgrade php-recodeUpgrade php-process-debuginfoUpgrade php-pecl-xdebugUpgrade php-bcmath-debuginfoUpgrade php-soapUpgrade php-snmp-debuginfoUpgrade libzip-toolsUpgrade libzip-tools-debuginfoUpgrade php-pdo-debuginfoUpgrade php-xmlrpcUpgrade php-dbaUpgrade php-opcacheUpgrade php-processUpgrade php-pecl-rrd-debuginfoUpgrade php-pecl-apcu-develUpgrade php-pearUpgrade php-mbstringUpgrade php-pecl-zipUpgrade php-ldap-debuginfo | Sep 9, 2020 | Apr 1, 2020 |
| Debian | — | Upgrade php7.4 | Jul 8, 2020 | Apr 1, 2020 |
| Gentoo Linux | — | Upgrade dev-lang/php. | Mar 27, 2020 | Mar 26, 2020 |
| Oracle Solaris | — | Upgrade web/php-74 to version 7.4.5-11.4.22.0.1.69.2 on Solaris 11.4Upgrade web/php-73 to version 7.3.17-11.4.22.0.1.69.2 on Solaris 11.4 | Jan 19, 2021 | Apr 1, 2020 |
| Oracle_linux | — | Upgrade php-dbgUpgrade php-ldapUpgrade php-odbcUpgrade php-snmpUpgrade php-pdoUpgrade php-commonUpgrade php-recodeUpgrade php-bcmathUpgrade php-pecl-apcuUpgrade php-develUpgrade php-fpmUpgrade php-embeddedUpgrade php-xmlUpgrade php-enchantUpgrade php-jsonUpgrade php-pearUpgrade phpUpgrade php-pecl-zipUpgrade php-gmpUpgrade php-cliUpgrade libzipUpgrade php-pecl-xdebugUpgrade php-mbstringUpgrade php-mysqlndUpgrade libzip-toolsUpgrade php-xmlrpcUpgrade php-processUpgrade php-dbaUpgrade php-pecl-apcu-develUpgrade php-pgsqlUpgrade php-gdUpgrade php-soapUpgrade php-pecl-rrdUpgrade apcu-panelUpgrade php-opcacheUpgrade php-intlUpgrade libzip-devel | Sep 10, 2020 | Apr 1, 2020 |
| Php | — | Upgrade to PHP version 7.4.4Upgrade to PHP version 7.3.16 | Apr 6, 2020 | Apr 1, 2020 |
| Redhat_linux | — | Upgrade php-ldap-debuginfoUpgrade php-soapUpgrade apcu-panelUpgrade php-gdUpgrade php-pgsql-debuginfoUpgrade php-dbaUpgrade php-bcmath-debuginfoUpgrade php-xmlrpcUpgrade php-opcacheUpgrade php-processUpgrade php-debuginfoUpgrade php-pecl-rrd-debugsourceUpgrade libzip-tools-debuginfoUpgrade libzip-develUpgrade php-intl-debuginfoUpgrade libzip-debugsourceUpgrade php-pecl-rrdUpgrade php-soap-debuginfoUpgrade php-xml-debuginfoUpgrade php-pecl-apcu-debuginfoUpgrade php-dbg-debuginfoUpgrade php-cli-debuginfoUpgrade php-pdo-debuginfoUpgrade php-pecl-apcu-develUpgrade php-mysqlnd-debuginfoUpgrade libzip-toolsUpgrade php-opcache-debuginfoUpgrade php-snmp-debuginfoUpgrade php-mbstringUpgrade php-pgsqlUpgrade php-fpm-debuginfoUpgrade php-process-debuginfoUpgrade php-intlUpgrade php-mysqlndUpgrade php-xmlrpc-debuginfoUpgrade php-pecl-apcu-debugsourceUpgrade php-odbc-debuginfoUpgrade php-pecl-rrd-debuginfoUpgrade phpUpgrade php-pecl-xdebugUpgrade php-develUpgrade php-pdoUpgrade php-fpmUpgrade php-recodeUpgrade php-odbcUpgrade php-pecl-xdebug-debuginfoUpgrade php-dba-debuginfoUpgrade php-enchant-debuginfoUpgrade php-snmpUpgrade php-cliUpgrade php-pecl-xdebug-debugsourceUpgrade php-bcmathUpgrade php-pecl-apcuUpgrade php-commonUpgrade php-dbgUpgrade php-pecl-zip-debuginfoUpgrade php-debugsourceUpgrade php-json-debuginfoUpgrade php-ldapUpgrade php-recode-debuginfoUpgrade php-gd-debuginfoUpgrade php-common-debuginfoUpgrade php-pecl-zipUpgrade php-gmp-debuginfoUpgrade php-xmlUpgrade php-pearUpgrade php-embedded-debuginfoUpgrade php-jsonUpgrade php-embeddedUpgrade php-gmpUpgrade libzip-debuginfoUpgrade php-pecl-zip-debugsourceUpgrade libzipUpgrade php-mbstring-debuginfoUpgrade php-enchant | Sep 9, 2020 | Apr 1, 2020 |
| Rocky_linux | — | Upgrade libzipUpgrade php-xmlrpcUpgrade php-pdo-debuginfoUpgrade php-develUpgrade php-gmpUpgrade php-pecl-xdebugUpgrade php-odbc-debuginfoUpgrade php-pecl-apcuUpgrade php-pdoUpgrade php-gdUpgrade php-pecl-apcu-debuginfoUpgrade php-odbcUpgrade php-pecl-apcu-develUpgrade php-dba-debuginfoUpgrade php-mbstring-debuginfoUpgrade php-jsonUpgrade php-pecl-rrd-debuginfoUpgrade php-mbstringUpgrade php-pgsqlUpgrade php-bcmathUpgrade php-xml-debuginfoUpgrade libzip-tools-debuginfoUpgrade libzip-debugsourceUpgrade php-enchant-debuginfoUpgrade libzip-debuginfoUpgrade php-xmlrpc-debuginfoUpgrade php-gd-debuginfoUpgrade php-pecl-xdebug-debugsourceUpgrade php-pecl-zip-debugsourceUpgrade php-soapUpgrade php-pecl-xdebug-debuginfoUpgrade php-mysqlnd-debuginfoUpgrade php-dbaUpgrade php-dbg-debuginfoUpgrade php-enchantUpgrade php-pecl-zipUpgrade php-intl-debuginfoUpgrade php-json-debuginfoUpgrade php-fpmUpgrade php-cli-debuginfoUpgrade php-ldap-debuginfoUpgrade php-recodeUpgrade php-xmlUpgrade php-intlUpgrade php-common-debuginfoUpgrade php-soap-debuginfoUpgrade php-process-debuginfoUpgrade php-pgsql-debuginfoUpgrade libzip-develUpgrade php-pecl-apcu-debugsourceUpgrade php-cliUpgrade php-fpm-debuginfoUpgrade php-processUpgrade phpUpgrade php-mysqlndUpgrade libzip-toolsUpgrade php-pecl-zip-debuginfoUpgrade php-debugsourceUpgrade php-commonUpgrade php-dbgUpgrade php-opcache-debuginfoUpgrade php-recode-debuginfoUpgrade php-debuginfoUpgrade php-ldapUpgrade php-snmp-debuginfoUpgrade php-pecl-rrdUpgrade php-pecl-rrd-debugsourceUpgrade php-opcacheUpgrade php-bcmath-debuginfoUpgrade php-snmpUpgrade php-embedded-debuginfoUpgrade php-gmp-debuginfoUpgrade php-embedded | Mar 12, 2024 | Apr 1, 2020 |
| Ubuntu | — | Upgrade php7.4-cgiUpgrade php7.4-mbstringUpgrade php7.3-cliUpgrade libapache2-mod-php7.3Upgrade php7.3-fpmUpgrade php7.3-cgiUpgrade php7.4-fpmUpgrade php7.4-cliUpgrade libapache2-mod-php7.4Upgrade php7.3-mbstring | Apr 16, 2020 | Apr 1, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub