In PHP versions 7.4.x below 7.4.28, 8.0.x below 8.0.16, and 8.1.x below 8.1.3, when using filter functions with FILTER_VALIDATE_FLOAT filter and min/max limits, if the filter fails, there is a possibility to trigger use of allocated memory after free, which can result it crashes, and potentially in overwrite of other memory chunks and RCE. This issue affects: code that uses FILTER_VALIDATE_FLOAT with min/max limits.
CVSS Details
- CVSS 3.1 Base Score: 8.2
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade php-opcacheUpgrade php-develUpgrade php-pdoUpgrade php-embeddedUpgrade php-pecl-xdebugUpgrade php-xmlrpcUpgrade libzipUpgrade php-processUpgrade php-pecl-xdebug3Upgrade php-cliUpgrade php-enchantUpgrade php-pearUpgrade php-mbstringUpgrade php-xmlUpgrade php-pecl-zipUpgrade php-snmpUpgrade php-gdUpgrade php-mysqlndUpgrade libzip-develUpgrade php-pecl-rrdUpgrade php-fpmUpgrade php-ffiUpgrade phpUpgrade php-commonUpgrade php-jsonUpgrade php-dbgUpgrade libzip-toolsUpgrade php-intlUpgrade apcu-panelUpgrade php-soapUpgrade php-bcmathUpgrade php-pecl-apcu-develUpgrade php-ldapUpgrade php-odbcUpgrade php-pecl-apcuUpgrade php-pgsqlUpgrade php-gmpUpgrade php-dba | Nov 14, 2022 | Feb 27, 2022 |
| Alpine Linux | — | Upgrade php8Upgrade php7 | Oct 1, 2024 | Feb 27, 2022 |
| Amazon Linux Ami 2 | — | Upgrade php-sodiumUpgrade php-commonUpgrade php-develUpgrade php-mbstringUpgrade php-fpmUpgrade php-odbcUpgrade php-pgsqlUpgrade php-debuginfoUpgrade php-dbgUpgrade php-soapUpgrade php-xmlUpgrade php-cliUpgrade php-intlUpgrade php-processUpgrade php-enchantUpgrade php-gdUpgrade php-pdoUpgrade php-snmpUpgrade php-pspellUpgrade php-embeddedUpgrade php-opcacheUpgrade php-gmpUpgrade php-dbaUpgrade phpUpgrade php-mysqlndUpgrade php-ldapUpgrade php-bcmath | Sep 14, 2023 | Feb 27, 2022 |
| Centos_linux | — | Upgrade php-pgsqlUpgrade php-pdoUpgrade php-fpm-debuginfoUpgrade php-ffi-debuginfoUpgrade php-pecl-apcuUpgrade php-xmlrpcUpgrade php-cli-debuginfoUpgrade php-pecl-xdebug-debuginfoUpgrade php-pecl-rrd-debuginfoUpgrade php-fpmUpgrade php-develUpgrade php-processUpgrade libzip-debuginfoUpgrade php-pecl-zip-debugsourceUpgrade php-pecl-apcu-debugsourceUpgrade php-pecl-apcu-debuginfoUpgrade libzip-debugsourceUpgrade php-xmlrpc-debuginfoUpgrade php-odbc-debuginfoUpgrade php-pdo-debuginfoUpgrade php-ldapUpgrade php-enchantUpgrade php-dbaUpgrade php-pecl-xdebugUpgrade php-pearUpgrade php-gmpUpgrade php-bcmathUpgrade php-xml-debuginfoUpgrade php-odbcUpgrade php-mysqlnd-debuginfoUpgrade php-process-debuginfoUpgrade php-json-debuginfoUpgrade php-pecl-xdebug3-debugsourceUpgrade php-pecl-apcu-develUpgrade php-mbstring-debuginfoUpgrade php-pecl-zipUpgrade php-soapUpgrade php-mbstringUpgrade php-gd-debuginfoUpgrade php-pecl-rrdUpgrade php-jsonUpgrade php-debugsourceUpgrade php-dba-debuginfoUpgrade libzip-tools-debuginfoUpgrade php-gdUpgrade libzipUpgrade php-embeddedUpgrade php-ffiUpgrade php-pgsql-debuginfoUpgrade php-opcacheUpgrade php-pecl-rrd-debugsourceUpgrade php-intl-debuginfoUpgrade php-soap-debuginfoUpgrade php-xmlUpgrade php-opcache-debuginfoUpgrade php-commonUpgrade php-pecl-zip-debuginfoUpgrade php-snmp-debuginfoUpgrade php-intlUpgrade php-pecl-xdebug-debugsourceUpgrade php-cliUpgrade php-dbg-debuginfoUpgrade php-debuginfoUpgrade php-gmp-debuginfoUpgrade php-ldap-debuginfoUpgrade php-embedded-debuginfoUpgrade apcu-panelUpgrade php-dbgUpgrade php-mysqlndUpgrade php-enchant-debuginfoUpgrade php-common-debuginfoUpgrade libzip-develUpgrade php-snmpUpgrade php-bcmath-debuginfoUpgrade php-pecl-xdebug3-debuginfoUpgrade php-pecl-xdebug3Upgrade phpUpgrade libzip-tools | Nov 9, 2022 | Feb 27, 2022 |
| Debian | — | Upgrade php7.4 | Nov 4, 2022 | Feb 27, 2022 |
| Gentoo Linux | — | Upgrade dev-lang/php. | Sep 30, 2022 | Feb 27, 2022 |
| Oracle_linux | — | Upgrade php-opcacheUpgrade php-bcmathUpgrade php-enchantUpgrade php-pecl-apcuUpgrade phpUpgrade php-dbaUpgrade apcu-panelUpgrade php-dbgUpgrade libzipUpgrade libzip-develUpgrade php-mysqlndUpgrade php-intlUpgrade php-gdUpgrade libzip-toolsUpgrade php-snmpUpgrade php-ldapUpgrade php-pecl-zipUpgrade php-embeddedUpgrade php-cliUpgrade php-ffiUpgrade php-odbcUpgrade php-pgsqlUpgrade php-pecl-xdebug3Upgrade php-processUpgrade php-mbstringUpgrade php-soapUpgrade php-xmlUpgrade php-develUpgrade php-jsonUpgrade php-pearUpgrade php-pecl-apcu-develUpgrade php-gmpUpgrade php-pdoUpgrade php-pecl-rrdUpgrade php-pecl-xdebugUpgrade php-xmlrpcUpgrade php-fpmUpgrade php-common | Nov 16, 2022 | Feb 17, 2022 |
| Php | — | Upgrade to PHP version 8.0.16Upgrade to PHP version 7.4.28Upgrade to PHP version 8.1.3 | Mar 14, 2022 | Feb 27, 2022 |
| Redhat_linux | — | Upgrade php-pecl-zip-debugsourceUpgrade php-commonUpgrade php-ffi-debuginfoUpgrade php-pecl-xdebugUpgrade php-gmpUpgrade php-common-debuginfoUpgrade php-dbgUpgrade libzip-develUpgrade libzipUpgrade php-snmpUpgrade php-mysqlnd-debuginfoUpgrade php-dbg-debuginfoUpgrade php-pecl-xdebug-debuginfoUpgrade php-develUpgrade php-xmlrpcUpgrade php-ldapUpgrade php-jsonUpgrade php-pecl-zip-debuginfoUpgrade php-gd-debuginfoUpgrade php-pecl-xdebug3-debuginfoUpgrade php-pecl-rrd-debuginfoUpgrade php-pdoUpgrade php-mbstringUpgrade php-bcmathUpgrade php-mbstring-debuginfoUpgrade php-xmlrpc-debuginfoUpgrade php-mysqlndUpgrade php-fpmUpgrade php-enchant-debuginfoUpgrade php-pecl-apcuUpgrade php-pearUpgrade php-pecl-xdebug-debugsourceUpgrade php-xmlUpgrade php-pecl-rrd-debugsourceUpgrade php-embedded-debuginfoUpgrade php-opcacheUpgrade php-pecl-xdebug3Upgrade php-cliUpgrade php-pdo-debuginfoUpgrade php-odbcUpgrade php-gmp-debuginfoUpgrade php-bcmath-debuginfoUpgrade php-pecl-apcu-develUpgrade libzip-debugsourceUpgrade php-debuginfoUpgrade php-json-debuginfoUpgrade libzip-tools-debuginfoUpgrade php-soapUpgrade php-pecl-zipUpgrade php-intl-debuginfoUpgrade php-ldap-debuginfoUpgrade php-snmp-debuginfoUpgrade libzip-debuginfoUpgrade php-intlUpgrade php-odbc-debuginfoUpgrade php-embeddedUpgrade php-ffiUpgrade php-debugsourceUpgrade php-process-debuginfoUpgrade php-pecl-apcu-debuginfoUpgrade php-pecl-rrdUpgrade php-pecl-apcu-debugsourceUpgrade php-gdUpgrade php-opcache-debuginfoUpgrade php-pgsqlUpgrade php-pgsql-debuginfoUpgrade php-dbaUpgrade apcu-panelUpgrade php-dba-debuginfoUpgrade php-soap-debuginfoUpgrade php-enchantUpgrade libzip-toolsUpgrade php-pecl-xdebug3-debugsourceUpgrade php-fpm-debuginfoUpgrade php-processUpgrade php-xml-debuginfoUpgrade phpUpgrade php-cli-debuginfo | Nov 9, 2022 | Feb 27, 2022 |
| Rocky_linux | — | Upgrade php-gmp-debuginfoUpgrade php-pecl-rrd-debuginfoUpgrade php-pecl-zipUpgrade php-pdoUpgrade php-pecl-zip-debugsourceUpgrade php-fpmUpgrade php-mysqlnd-debuginfoUpgrade libzip-debugsourceUpgrade php-gdUpgrade php-cli-debuginfoUpgrade php-pecl-apcu-debuginfoUpgrade php-xml-debuginfoUpgrade php-fpm-debuginfoUpgrade php-jsonUpgrade php-bcmathUpgrade php-soapUpgrade php-enchantUpgrade libzip-tools-debuginfoUpgrade php-dbaUpgrade php-dbg-debuginfoUpgrade php-pecl-xdebugUpgrade php-pgsqlUpgrade php-pecl-apcu-debugsourceUpgrade php-pecl-rrdUpgrade php-process-debuginfoUpgrade php-pecl-xdebug-debuginfoUpgrade php-develUpgrade php-gd-debuginfoUpgrade php-ffi-debuginfoUpgrade php-xmlrpcUpgrade php-pdo-debuginfoUpgrade php-xmlrpc-debuginfoUpgrade php-ldapUpgrade php-debugsourceUpgrade php-embeddedUpgrade php-processUpgrade php-pecl-xdebug3-debugsourceUpgrade libzipUpgrade php-odbc-debuginfoUpgrade php-gmpUpgrade php-pecl-apcuUpgrade php-pecl-apcu-develUpgrade php-embedded-debuginfoUpgrade php-opcacheUpgrade php-dba-debuginfoUpgrade php-mbstringUpgrade php-opcache-debuginfoUpgrade php-pgsql-debuginfoUpgrade php-snmpUpgrade libzip-develUpgrade php-soap-debuginfoUpgrade php-mbstring-debuginfoUpgrade php-commonUpgrade php-enchant-debuginfoUpgrade phpUpgrade php-xmlUpgrade php-cliUpgrade php-ffiUpgrade php-common-debuginfoUpgrade php-json-debuginfoUpgrade libzip-toolsUpgrade php-ldap-debuginfoUpgrade php-pecl-xdebug3Upgrade php-pecl-xdebug3-debuginfoUpgrade php-intl-debuginfoUpgrade libzip-debuginfoUpgrade php-pecl-zip-debuginfoUpgrade php-pecl-rrd-debugsourceUpgrade php-odbcUpgrade php-intlUpgrade php-debuginfoUpgrade php-mysqlndUpgrade php-bcmath-debuginfoUpgrade php-pecl-xdebug-debugsourceUpgrade php-dbgUpgrade php-snmp-debuginfo | Mar 12, 2024 | Feb 27, 2022 |
| Suse | — | Upgrade php7-ctypeUpgrade php74-sqliteUpgrade php74-tokenizerUpgrade php74-enchantUpgrade php74-fpmUpgrade php74-shmopUpgrade php7-pdoUpgrade php7-bcmathUpgrade php7-calendarUpgrade php74-sodiumUpgrade php7-zipUpgrade php74-jsonUpgrade php74-socketsUpgrade php7-xmlwriterUpgrade apache2-mod_php74Upgrade php7-fastcgiUpgrade php7-pgsqlUpgrade php74-gdUpgrade php7-fpmUpgrade php74-sysvshmUpgrade php74-develUpgrade php7-sysvsemUpgrade php74-xslUpgrade php74-fastcgiUpgrade php74-pgsqlUpgrade php7-tokenizerUpgrade apache2-mod_php7Upgrade php74-bz2Upgrade php74-pdoUpgrade php7-ftpUpgrade php7-fileinfoUpgrade php74-zipUpgrade php7-snmpUpgrade php74-pcntlUpgrade php7-sysvmsgUpgrade php74-odbcUpgrade php7-enchantUpgrade php7-intlUpgrade php7-pharUpgrade php7-pcntlUpgrade php74-snmpUpgrade php74-opcacheUpgrade php7-curlUpgrade php7-opcacheUpgrade php7-iconvUpgrade php7-testUpgrade php74-gettextUpgrade php74-mysqlUpgrade php74-tidyUpgrade php74-curlUpgrade php74Upgrade php74-iconvUpgrade php7-gmpUpgrade php7-zlibUpgrade php7-sysvshmUpgrade php7-posixUpgrade php7-gdUpgrade php7-exifUpgrade php7-shmopUpgrade php74-pharUpgrade php74-ldapUpgrade php7-xmlreaderUpgrade php7-ldapUpgrade php7-gettextUpgrade php7-domUpgrade php74-dbaUpgrade php7-tidyUpgrade php74-calendarUpgrade php7-xslUpgrade php74-xmlreaderUpgrade php7-xmlrpcUpgrade php74-ftpUpgrade php74-gmpUpgrade php7-mbstringUpgrade php7-mysqlUpgrade php7-dbaUpgrade php7Upgrade php7-firebirdUpgrade php74-intlUpgrade php7-sqliteUpgrade php7-opensslUpgrade php74-soapUpgrade php74-readlineUpgrade php74-fileinfoUpgrade php7-odbcUpgrade php74-exifUpgrade php74-posixUpgrade php7-readlineUpgrade php7-cliUpgrade php74-sysvmsgUpgrade php74-zlibUpgrade php7-embedUpgrade php74-sysvsemUpgrade php74-ctypeUpgrade php7-develUpgrade php7-jsonUpgrade php7-bz2Upgrade php74-xmlwriterUpgrade php74-opensslUpgrade php7-sodiumUpgrade php7-soapUpgrade php74-xmlrpcUpgrade php7-socketsUpgrade php74-mbstringUpgrade php74-domUpgrade php74-bcmath | Mar 2, 2022 | Feb 27, 2022 |
| Ubuntu | — | Upgrade php7.4-cgiUpgrade php8.0-fpmUpgrade php8.0-cliUpgrade php7.4-cliUpgrade php8.0-cgiUpgrade php7.4-fpm | Mar 22, 2023 | Feb 27, 2022 |
| Zimbra Collaboration | — | Upgrade Zimbra Collaboration to the latest version | Jan 20, 2025 | Feb 27, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub