In PHP versions 7.4.x below 7.4.28, 8.0.x below 8.0.16, and 8.1.x below 8.1.3, when using filter functions with FILTER_VALIDATE_FLOAT filter and min/max limits, if the filter fails, there is a possibility to trigger use of allocated memory after free, which can result it crashes, and potentially in overwrite of other memory chunks and RCE. This issue affects: code that uses FILTER_VALIDATE_FLOAT with min/max limits.
CVSS Details
- CVSS 3.1 Base Score: 8.2
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade php-xmlrpcUpgrade php-pecl-rrdUpgrade php-develUpgrade php-pdoUpgrade libzip-develUpgrade libzipUpgrade php-pecl-xdebugUpgrade php-embeddedUpgrade php-xmlUpgrade php-mbstringUpgrade php-opcacheUpgrade php-pearUpgrade php-mysqlndUpgrade php-snmpUpgrade php-pecl-xdebug3Upgrade php-pecl-zipUpgrade php-cliUpgrade php-processUpgrade php-enchantUpgrade php-fpmUpgrade php-gdUpgrade apcu-panelUpgrade php-dbgUpgrade php-dbaUpgrade php-pgsqlUpgrade phpUpgrade php-commonUpgrade php-gmpUpgrade libzip-toolsUpgrade php-odbcUpgrade php-soapUpgrade php-ldapUpgrade php-pecl-apcu-develUpgrade php-ffiUpgrade php-pecl-apcuUpgrade php-intlUpgrade php-jsonUpgrade php-bcmath | Nov 14, 2022 | Feb 27, 2022 |
| Alpine Linux | — | Upgrade php8Upgrade php7 | Oct 1, 2024 | Feb 27, 2022 |
| Amazon Linux Ami 2 | — | Upgrade php-sodiumUpgrade php-mbstringUpgrade php-develUpgrade php-pgsqlUpgrade php-fpmUpgrade php-odbcUpgrade php-dbgUpgrade php-debuginfoUpgrade php-commonUpgrade phpUpgrade php-xmlUpgrade php-enchantUpgrade php-cliUpgrade php-dbaUpgrade php-ldapUpgrade php-mysqlndUpgrade php-gdUpgrade php-embeddedUpgrade php-gmpUpgrade php-soapUpgrade php-pspellUpgrade php-opcacheUpgrade php-snmpUpgrade php-intlUpgrade php-pdoUpgrade php-bcmathUpgrade php-process | Sep 14, 2023 | Feb 27, 2022 |
| Centos_linux | — | Upgrade php-pecl-xdebug-debuginfoUpgrade php-pecl-apcu-develUpgrade libzipUpgrade php-pdo-debuginfoUpgrade php-pecl-xdebug3-debugsourceUpgrade php-pecl-xdebugUpgrade php-gmpUpgrade php-pecl-rrd-debuginfoUpgrade php-fpmUpgrade php-develUpgrade php-processUpgrade php-gd-debuginfoUpgrade php-ldapUpgrade php-enchantUpgrade php-dbaUpgrade php-pgsqlUpgrade php-xmlrpcUpgrade php-pecl-apcuUpgrade php-mysqlnd-debuginfoUpgrade php-cli-debuginfoUpgrade php-gdUpgrade php-mbstringUpgrade php-pecl-rrdUpgrade php-xmlrpc-debuginfoUpgrade php-fpm-debuginfoUpgrade php-ffi-debuginfoUpgrade libzip-debuginfoUpgrade php-pecl-zip-debugsourceUpgrade php-pecl-apcu-debugsourceUpgrade php-pecl-apcu-debuginfoUpgrade libzip-debugsourceUpgrade php-process-debuginfoUpgrade php-mbstring-debuginfoUpgrade php-json-debuginfoUpgrade php-soapUpgrade php-pecl-zipUpgrade php-odbcUpgrade php-jsonUpgrade php-dba-debuginfoUpgrade php-debugsourceUpgrade php-embeddedUpgrade php-bcmathUpgrade php-odbc-debuginfoUpgrade libzip-tools-debuginfoUpgrade php-xml-debuginfoUpgrade php-pdoUpgrade php-pearUpgrade php-intlUpgrade php-intl-debuginfoUpgrade php-enchant-debuginfoUpgrade php-pecl-zip-debuginfoUpgrade php-common-debuginfoUpgrade php-pgsql-debuginfoUpgrade libzip-toolsUpgrade php-snmp-debuginfoUpgrade php-pecl-xdebug-debugsourceUpgrade php-opcacheUpgrade php-opcache-debuginfoUpgrade php-debuginfoUpgrade php-pecl-xdebug3-debuginfoUpgrade php-ldap-debuginfoUpgrade php-snmpUpgrade apcu-panelUpgrade php-xmlUpgrade php-dbgUpgrade php-cliUpgrade php-mysqlndUpgrade php-pecl-rrd-debugsourceUpgrade php-gmp-debuginfoUpgrade phpUpgrade php-embedded-debuginfoUpgrade php-pecl-xdebug3Upgrade php-commonUpgrade php-dbg-debuginfoUpgrade php-ffiUpgrade php-soap-debuginfoUpgrade libzip-develUpgrade php-bcmath-debuginfo | Nov 9, 2022 | Feb 27, 2022 |
| Debian | — | Upgrade php7.4 | Nov 4, 2022 | Feb 27, 2022 |
| Gentoo Linux | — | Upgrade dev-lang/php. | Sep 30, 2022 | Feb 27, 2022 |
| Oracle_linux | — | Upgrade php-mbstringUpgrade php-pecl-xdebug3Upgrade php-soapUpgrade php-gmpUpgrade php-processUpgrade php-pecl-apcu-develUpgrade php-pecl-xdebugUpgrade php-pearUpgrade php-pdoUpgrade php-xmlrpcUpgrade php-fpmUpgrade php-commonUpgrade php-pecl-rrdUpgrade php-xmlUpgrade php-develUpgrade php-jsonUpgrade php-pecl-apcuUpgrade php-enchantUpgrade php-dbgUpgrade phpUpgrade libzipUpgrade php-pecl-zipUpgrade libzip-toolsUpgrade php-odbcUpgrade apcu-panelUpgrade php-cliUpgrade php-ffiUpgrade php-embeddedUpgrade php-dbaUpgrade php-bcmathUpgrade libzip-develUpgrade php-ldapUpgrade php-snmpUpgrade php-gdUpgrade php-pgsqlUpgrade php-opcacheUpgrade php-intlUpgrade php-mysqlnd | Nov 16, 2022 | Feb 17, 2022 |
| Php | — | Upgrade to PHP version 8.1.3Upgrade to PHP version 7.4.28Upgrade to PHP version 8.0.16 | Mar 14, 2022 | Feb 27, 2022 |
| Redhat_linux | — | Upgrade php-soap-debuginfoUpgrade php-dba-debuginfoUpgrade php-pecl-apcu-debugsourceUpgrade php-odbc-debuginfoUpgrade php-embeddedUpgrade php-intl-debuginfoUpgrade php-ffiUpgrade php-dbaUpgrade php-bcmath-debuginfoUpgrade apcu-panelUpgrade php-cli-debuginfoUpgrade phpUpgrade php-intlUpgrade php-processUpgrade libzip-debuginfoUpgrade php-debugsourceUpgrade php-enchantUpgrade libzip-debugsourceUpgrade php-pecl-zipUpgrade php-pdo-debuginfoUpgrade php-ldap-debuginfoUpgrade php-soapUpgrade libzip-tools-debuginfoUpgrade php-odbcUpgrade php-xml-debuginfoUpgrade php-gdUpgrade php-fpm-debuginfoUpgrade php-pecl-rrdUpgrade php-json-debuginfoUpgrade php-snmp-debuginfoUpgrade libzip-toolsUpgrade php-pecl-apcu-debuginfoUpgrade php-opcache-debuginfoUpgrade php-process-debuginfoUpgrade php-pgsql-debuginfoUpgrade php-pecl-xdebug3-debugsourceUpgrade php-debuginfoUpgrade php-pecl-apcu-develUpgrade php-pgsqlUpgrade php-gmp-debuginfoUpgrade php-pdoUpgrade php-fpmUpgrade php-pecl-rrd-debuginfoUpgrade php-develUpgrade php-commonUpgrade php-pecl-xdebug3Upgrade php-gmpUpgrade php-common-debuginfoUpgrade php-pecl-zip-debugsourceUpgrade php-snmpUpgrade php-mysqlndUpgrade php-xmlrpcUpgrade php-enchant-debuginfoUpgrade php-mbstring-debuginfoUpgrade php-opcacheUpgrade php-bcmathUpgrade php-pearUpgrade php-pecl-apcuUpgrade php-pecl-xdebug-debugsourceUpgrade php-pecl-xdebugUpgrade php-pecl-xdebug-debuginfoUpgrade php-dbg-debuginfoUpgrade php-xmlUpgrade php-embedded-debuginfoUpgrade php-cliUpgrade libzipUpgrade php-gd-debuginfoUpgrade php-pecl-xdebug3-debuginfoUpgrade php-jsonUpgrade php-mbstringUpgrade php-pecl-rrd-debugsourceUpgrade libzip-develUpgrade php-ldapUpgrade php-pecl-zip-debuginfoUpgrade php-xmlrpc-debuginfoUpgrade php-mysqlnd-debuginfoUpgrade php-ffi-debuginfoUpgrade php-dbg | Nov 9, 2022 | Feb 27, 2022 |
| Rocky_linux | — | Upgrade php-cliUpgrade libzip-develUpgrade php-dba-debuginfoUpgrade php-snmp-debuginfoUpgrade php-common-debuginfoUpgrade php-pgsql-debuginfoUpgrade php-opcacheUpgrade php-enchant-debuginfoUpgrade php-dbgUpgrade php-debuginfoUpgrade php-pecl-xdebug-debugsourceUpgrade php-opcache-debuginfoUpgrade php-mbstringUpgrade php-ldap-debuginfoUpgrade php-mbstring-debuginfoUpgrade php-pecl-rrd-debugsourceUpgrade php-json-debuginfoUpgrade php-snmpUpgrade php-ffiUpgrade php-bcmath-debuginfoUpgrade php-pecl-xdebug3Upgrade php-pecl-zip-debuginfoUpgrade php-odbcUpgrade libzip-debuginfoUpgrade php-soap-debuginfoUpgrade php-pecl-xdebug3-debuginfoUpgrade php-mysqlndUpgrade php-intl-debuginfoUpgrade php-xmlUpgrade php-commonUpgrade libzip-toolsUpgrade phpUpgrade php-intlUpgrade php-gdUpgrade libzipUpgrade php-pecl-zipUpgrade php-pecl-rrd-debuginfoUpgrade libzip-debugsourceUpgrade php-gmp-debuginfoUpgrade php-debugsourceUpgrade php-pecl-xdebugUpgrade php-pecl-xdebug3-debugsourceUpgrade php-pecl-apcu-debugsourceUpgrade php-dbg-debuginfoUpgrade php-process-debuginfoUpgrade php-pecl-zip-debugsourceUpgrade php-pecl-rrdUpgrade php-odbc-debuginfoUpgrade php-xmlrpcUpgrade php-pgsqlUpgrade php-pecl-xdebug-debuginfoUpgrade php-pecl-apcu-develUpgrade php-ffi-debuginfoUpgrade php-embeddedUpgrade php-xml-debuginfoUpgrade php-fpm-debuginfoUpgrade php-pdoUpgrade php-mysqlnd-debuginfoUpgrade php-fpmUpgrade php-xmlrpc-debuginfoUpgrade php-ldapUpgrade php-gd-debuginfoUpgrade php-develUpgrade php-enchantUpgrade php-pdo-debuginfoUpgrade php-pecl-apcu-debuginfoUpgrade php-dbaUpgrade libzip-tools-debuginfoUpgrade php-soapUpgrade php-jsonUpgrade php-processUpgrade php-embedded-debuginfoUpgrade php-gmpUpgrade php-pecl-apcuUpgrade php-bcmathUpgrade php-cli-debuginfo | Mar 12, 2024 | Feb 27, 2022 |
| Suse | — | Upgrade php7-bcmathUpgrade php7-sysvsemUpgrade php74-tokenizerUpgrade php7-calendarUpgrade php7-xmlwriterUpgrade php74-develUpgrade php74-snmpUpgrade php74-xslUpgrade php7-pgsqlUpgrade php7-fastcgiUpgrade php74-shmopUpgrade php74-gettextUpgrade php7-tokenizerUpgrade php7-curlUpgrade php74-curlUpgrade php7-ctypeUpgrade php74-sysvshmUpgrade php7-pharUpgrade php74-tidyUpgrade php7-pcntlUpgrade php74-socketsUpgrade php74-fpmUpgrade php7-zipUpgrade apache2-mod_php74Upgrade php7-pdoUpgrade php7-iconvUpgrade php74-sqliteUpgrade php74-sodiumUpgrade php7-testUpgrade php74-pdoUpgrade php74-fastcgiUpgrade apache2-mod_php7Upgrade php7-sysvmsgUpgrade php74-mysqlUpgrade php7-opcacheUpgrade php74-odbcUpgrade php74-opcacheUpgrade php74-zipUpgrade php7-snmpUpgrade php74-jsonUpgrade php74-pgsqlUpgrade php7-fileinfoUpgrade php7-intlUpgrade php7-ftpUpgrade php7-fpmUpgrade php74-enchantUpgrade php74-pcntlUpgrade php74-gdUpgrade php74-bz2Upgrade php7-enchantUpgrade php74-fileinfoUpgrade php7-dbaUpgrade php7-soapUpgrade php74-xmlrpcUpgrade php7-mysqlUpgrade php7-shmopUpgrade php74-ftpUpgrade php7-mbstringUpgrade php74-zlibUpgrade php7-embedUpgrade php7-readlineUpgrade php74-gmpUpgrade php7-xmlrpcUpgrade php74-dbaUpgrade php7-sodiumUpgrade php7-xmlreaderUpgrade php74-posixUpgrade php7-gettextUpgrade php7-bz2Upgrade php7-socketsUpgrade php7-opensslUpgrade php74-opensslUpgrade php7-gmpUpgrade php74-iconvUpgrade php7-gdUpgrade php74Upgrade php7-posixUpgrade php74-bcmathUpgrade php7-zlibUpgrade php7-sysvshmUpgrade php7-tidyUpgrade php74-domUpgrade php7-odbcUpgrade php74-exifUpgrade php74-mbstringUpgrade php7-xslUpgrade php74-calendarUpgrade php7-domUpgrade php7-firebirdUpgrade php7-ldapUpgrade php74-pharUpgrade php74-ldapUpgrade php74-xmlwriterUpgrade php7-sqliteUpgrade php74-readlineUpgrade php74-intlUpgrade php7Upgrade php7-develUpgrade php74-sysvsemUpgrade php7-cliUpgrade php74-sysvmsgUpgrade php7-exifUpgrade php74-xmlreaderUpgrade php7-jsonUpgrade php74-soapUpgrade php74-ctype | Mar 2, 2022 | Feb 27, 2022 |
| Ubuntu | — | Upgrade php7.4-fpmUpgrade php8.0-cgiUpgrade php7.4-cliUpgrade php8.0-cliUpgrade php8.0-fpmUpgrade php7.4-cgi | Mar 22, 2023 | Feb 27, 2022 |
| Zimbra Collaboration | — | Upgrade Zimbra Collaboration to the latest version | Jan 20, 2025 | Feb 27, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub