In PHP versions 7.4.x below 7.4.28, 8.0.x below 8.0.16, and 8.1.x below 8.1.3, when using filter functions with FILTER_VALIDATE_FLOAT filter and min/max limits, if the filter fails, there is a possibility to trigger use of allocated memory after free, which can result it crashes, and potentially in overwrite of other memory chunks and RCE. This issue affects: code that uses FILTER_VALIDATE_FLOAT with min/max limits.
CVSS Details
- CVSS 3.1 Base Score: 8.2
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade php-soapUpgrade php-intlUpgrade php-commonUpgrade php-pecl-apcuUpgrade php-dbgUpgrade php-ffiUpgrade php-odbcUpgrade php-jsonUpgrade phpUpgrade php-pgsqlUpgrade php-ldapUpgrade apcu-panelUpgrade php-bcmathUpgrade php-pecl-apcu-develUpgrade libzip-toolsUpgrade php-gmpUpgrade php-dbaUpgrade php-processUpgrade php-snmpUpgrade php-pecl-xdebug3Upgrade php-fpmUpgrade php-pecl-rrdUpgrade php-develUpgrade libzip-develUpgrade php-opcacheUpgrade php-pecl-xdebugUpgrade libzipUpgrade php-xmlrpcUpgrade php-pdoUpgrade php-enchantUpgrade php-xmlUpgrade php-embeddedUpgrade php-cliUpgrade php-gdUpgrade php-mysqlndUpgrade php-pecl-zipUpgrade php-pearUpgrade php-mbstring | Nov 14, 2022 | Feb 27, 2022 |
| Alpine Linux | — | Upgrade php8Upgrade php7 | Oct 1, 2024 | Feb 27, 2022 |
| Amazon Linux Ami 2 | — | Upgrade php-dbgUpgrade php-sodiumUpgrade php-develUpgrade php-debuginfoUpgrade php-commonUpgrade php-pgsqlUpgrade php-mbstringUpgrade php-fpmUpgrade php-odbcUpgrade php-enchantUpgrade php-gmpUpgrade php-soapUpgrade php-pspellUpgrade phpUpgrade php-mysqlndUpgrade php-bcmathUpgrade php-ldapUpgrade php-snmpUpgrade php-opcacheUpgrade php-gdUpgrade php-pdoUpgrade php-intlUpgrade php-embeddedUpgrade php-cliUpgrade php-xmlUpgrade php-dbaUpgrade php-process | Sep 14, 2023 | Feb 27, 2022 |
| Centos_linux | — | Upgrade php-dba-debuginfoUpgrade php-gdUpgrade php-jsonUpgrade php-gd-debuginfoUpgrade libzip-debuginfoUpgrade libzip-tools-debuginfoUpgrade php-debugsourceUpgrade php-mbstringUpgrade php-ldapUpgrade php-pdo-debuginfoUpgrade php-enchantUpgrade libzipUpgrade php-dbaUpgrade php-pecl-apcu-develUpgrade php-pecl-rrdUpgrade php-pecl-zipUpgrade php-pecl-apcu-debuginfoUpgrade php-process-debuginfoUpgrade php-pecl-apcu-debugsourceUpgrade php-json-debuginfoUpgrade php-mbstring-debuginfoUpgrade php-odbcUpgrade php-pecl-zip-debugsourceUpgrade php-pecl-xdebug3-debugsourceUpgrade php-xmlrpcUpgrade libzip-debugsourceUpgrade php-mysqlnd-debuginfoUpgrade php-xmlrpc-debuginfoUpgrade php-pearUpgrade php-pgsqlUpgrade php-ffi-debuginfoUpgrade php-embeddedUpgrade php-gmpUpgrade php-bcmathUpgrade php-odbc-debuginfoUpgrade php-pecl-rrd-debuginfoUpgrade php-pecl-xdebug-debuginfoUpgrade php-pecl-xdebugUpgrade php-pdoUpgrade php-cli-debuginfoUpgrade php-develUpgrade php-soapUpgrade php-fpmUpgrade php-processUpgrade php-xml-debuginfoUpgrade php-fpm-debuginfoUpgrade php-pecl-apcuUpgrade php-pecl-rrd-debugsourceUpgrade php-pecl-xdebug3-debuginfoUpgrade php-common-debuginfoUpgrade php-ffiUpgrade php-snmpUpgrade php-dbgUpgrade php-xmlUpgrade phpUpgrade php-mysqlndUpgrade php-soap-debuginfoUpgrade php-cliUpgrade php-embedded-debuginfoUpgrade libzip-toolsUpgrade apcu-panelUpgrade php-snmp-debuginfoUpgrade php-pecl-zip-debuginfoUpgrade php-intl-debuginfoUpgrade php-intlUpgrade php-enchant-debuginfoUpgrade php-pecl-xdebug3Upgrade php-bcmath-debuginfoUpgrade libzip-develUpgrade php-opcache-debuginfoUpgrade php-pgsql-debuginfoUpgrade php-pecl-xdebug-debugsourceUpgrade php-opcacheUpgrade php-ldap-debuginfoUpgrade php-commonUpgrade php-dbg-debuginfoUpgrade php-gmp-debuginfoUpgrade php-debuginfo | Nov 9, 2022 | Feb 27, 2022 |
| Debian | — | Upgrade php7.4 | Nov 4, 2022 | Feb 27, 2022 |
| Gentoo Linux | — | Upgrade dev-lang/php. | Sep 30, 2022 | Feb 27, 2022 |
| Oracle_linux | — | Upgrade php-pecl-zipUpgrade php-cliUpgrade php-snmpUpgrade php-ffiUpgrade phpUpgrade php-gdUpgrade php-ldapUpgrade php-dbgUpgrade php-enchantUpgrade libzipUpgrade php-pecl-apcuUpgrade libzip-develUpgrade php-odbcUpgrade php-pgsqlUpgrade apcu-panelUpgrade php-opcacheUpgrade libzip-toolsUpgrade php-mysqlndUpgrade php-intlUpgrade php-embeddedUpgrade php-bcmathUpgrade php-dbaUpgrade php-gmpUpgrade php-pecl-xdebug3Upgrade php-pearUpgrade php-jsonUpgrade php-xmlUpgrade php-develUpgrade php-pecl-rrdUpgrade php-pdoUpgrade php-fpmUpgrade php-commonUpgrade php-xmlrpcUpgrade php-soapUpgrade php-mbstringUpgrade php-pecl-xdebugUpgrade php-processUpgrade php-pecl-apcu-devel | Nov 16, 2022 | Feb 17, 2022 |
| Php | — | Upgrade to PHP version 8.1.3Upgrade to PHP version 8.0.16Upgrade to PHP version 7.4.28 | Mar 14, 2022 | Feb 27, 2022 |
| Redhat_linux | — | Upgrade php-json-debuginfoUpgrade php-fpm-debuginfoUpgrade php-cli-debuginfoUpgrade php-processUpgrade php-bcmath-debuginfoUpgrade php-embeddedUpgrade php-pecl-apcu-debugsourceUpgrade php-gmp-debuginfoUpgrade php-odbc-debuginfoUpgrade libzip-toolsUpgrade php-pecl-apcu-develUpgrade php-dbaUpgrade php-ffiUpgrade php-intl-debuginfoUpgrade php-debugsourceUpgrade php-ldap-debuginfoUpgrade php-gdUpgrade php-process-debuginfoUpgrade libzip-debugsourceUpgrade php-odbcUpgrade php-intlUpgrade phpUpgrade php-pecl-xdebug3-debugsourceUpgrade php-xml-debuginfoUpgrade php-pecl-zipUpgrade php-debuginfoUpgrade php-pgsqlUpgrade php-pecl-apcu-debuginfoUpgrade php-soapUpgrade php-pgsql-debuginfoUpgrade php-pdo-debuginfoUpgrade php-opcache-debuginfoUpgrade php-pecl-rrdUpgrade php-snmp-debuginfoUpgrade libzip-tools-debuginfoUpgrade php-dba-debuginfoUpgrade php-enchantUpgrade libzip-debuginfoUpgrade php-soap-debuginfoUpgrade apcu-panelUpgrade php-pecl-rrd-debugsourceUpgrade php-xmlrpc-debuginfoUpgrade php-dbg-debuginfoUpgrade php-pecl-xdebugUpgrade php-bcmathUpgrade php-pecl-xdebug3-debuginfoUpgrade php-pecl-xdebug-debugsourceUpgrade libzipUpgrade php-pecl-zip-debugsourceUpgrade php-pecl-xdebug-debuginfoUpgrade php-snmpUpgrade php-pecl-zip-debuginfoUpgrade php-common-debuginfoUpgrade php-mysqlnd-debuginfoUpgrade php-dbgUpgrade php-gd-debuginfoUpgrade php-jsonUpgrade php-opcacheUpgrade php-mbstringUpgrade php-embedded-debuginfoUpgrade php-xmlUpgrade php-pecl-xdebug3Upgrade php-cliUpgrade php-fpmUpgrade php-mbstring-debuginfoUpgrade php-enchant-debuginfoUpgrade php-pecl-rrd-debuginfoUpgrade php-xmlrpcUpgrade libzip-develUpgrade php-ldapUpgrade php-ffi-debuginfoUpgrade php-commonUpgrade php-pecl-apcuUpgrade php-develUpgrade php-mysqlndUpgrade php-gmpUpgrade php-pdoUpgrade php-pear | Nov 9, 2022 | Feb 27, 2022 |
| Rocky_linux | — | Upgrade php-commonUpgrade php-intl-debuginfoUpgrade php-pecl-xdebug3Upgrade php-pecl-zip-debuginfoUpgrade libzip-debuginfoUpgrade php-opcacheUpgrade php-opcache-debuginfoUpgrade php-mbstringUpgrade php-json-debuginfoUpgrade php-pecl-xdebug-debugsourceUpgrade php-odbcUpgrade php-ldap-debuginfoUpgrade libzip-toolsUpgrade php-mysqlndUpgrade php-cliUpgrade phpUpgrade php-xmlUpgrade php-snmp-debuginfoUpgrade php-enchant-debuginfoUpgrade php-ffiUpgrade php-dba-debuginfoUpgrade php-bcmath-debuginfoUpgrade php-pgsql-debuginfoUpgrade php-pecl-xdebug3-debuginfoUpgrade libzip-develUpgrade php-dbgUpgrade php-mbstring-debuginfoUpgrade php-soap-debuginfoUpgrade php-intlUpgrade php-debuginfoUpgrade php-snmpUpgrade php-common-debuginfoUpgrade php-pecl-rrd-debugsourceUpgrade php-gmpUpgrade php-pgsqlUpgrade php-gd-debuginfoUpgrade php-develUpgrade php-ldapUpgrade php-processUpgrade libzip-tools-debuginfoUpgrade php-pdo-debuginfoUpgrade php-bcmathUpgrade php-xmlrpc-debuginfoUpgrade php-pecl-apcuUpgrade php-xml-debuginfoUpgrade php-embedded-debuginfoUpgrade php-enchantUpgrade php-pecl-zipUpgrade php-pdoUpgrade php-mysqlnd-debuginfoUpgrade php-soapUpgrade php-fpmUpgrade php-gmp-debuginfoUpgrade php-gdUpgrade php-pecl-xdebug-debuginfoUpgrade php-pecl-rrd-debuginfoUpgrade libzip-debugsourceUpgrade php-embeddedUpgrade php-xmlrpcUpgrade php-pecl-apcu-develUpgrade php-odbc-debuginfoUpgrade php-ffi-debuginfoUpgrade php-cli-debuginfoUpgrade php-pecl-apcu-debuginfoUpgrade php-jsonUpgrade php-fpm-debuginfoUpgrade php-dbaUpgrade php-pecl-zip-debugsourceUpgrade php-pecl-rrdUpgrade php-debugsourceUpgrade php-pecl-xdebugUpgrade php-pecl-apcu-debugsourceUpgrade libzipUpgrade php-dbg-debuginfoUpgrade php-process-debuginfoUpgrade php-pecl-xdebug3-debugsource | Mar 12, 2024 | Feb 27, 2022 |
| Suse | — | Upgrade php74-gmpUpgrade php7-mysqlUpgrade php7-mbstringUpgrade php7-odbcUpgrade php74-exifUpgrade php7-bz2Upgrade php7Upgrade php74-fileinfoUpgrade php74-dbaUpgrade php74-readlineUpgrade php74-posixUpgrade php7-xmlreaderUpgrade php7-embedUpgrade php74-ctypeUpgrade php7-domUpgrade php7-sqliteUpgrade php74-mbstringUpgrade php7-readlineUpgrade php74-sysvsemUpgrade php74-iconvUpgrade php7-gdUpgrade php7-xslUpgrade php7-dbaUpgrade php7-xmlrpcUpgrade php7-cliUpgrade php7-shmopUpgrade php74-zlibUpgrade php7-develUpgrade php74-ftpUpgrade php74-xmlwriterUpgrade php74-calendarUpgrade php74-ldapUpgrade php7-jsonUpgrade php7-soapUpgrade php74-pharUpgrade php74-sysvmsgUpgrade php74-opensslUpgrade php7-firebirdUpgrade php74-soapUpgrade php7-gettextUpgrade php7-ldapUpgrade php7-socketsUpgrade php74-domUpgrade php74-xmlreaderUpgrade php7-sodiumUpgrade php7-tidyUpgrade php7-sysvshmUpgrade php7-exifUpgrade php74-intlUpgrade php7-gmpUpgrade php7-opensslUpgrade php74-xmlrpcUpgrade php7-zlibUpgrade php7-posixUpgrade php74Upgrade php74-bcmathUpgrade php7-pharUpgrade php74-curlUpgrade php7-fileinfoUpgrade php7-pcntlUpgrade php7-fastcgiUpgrade php7-pgsqlUpgrade php7-ctypeUpgrade php7-curlUpgrade php7-tokenizerUpgrade php74-bz2Upgrade php74-snmpUpgrade php74-xslUpgrade php74-gettextUpgrade php74-enchantUpgrade php74-socketsUpgrade php7-testUpgrade php7-pdoUpgrade php74-jsonUpgrade php74-shmopUpgrade php74-fastcgiUpgrade php74-fpmUpgrade php7-bcmathUpgrade php74-tokenizerUpgrade php7-sysvsemUpgrade apache2-mod_php74Upgrade php74-sysvshmUpgrade php7-sysvmsgUpgrade php74-gdUpgrade php74-mysqlUpgrade php74-pdoUpgrade php7-fpmUpgrade apache2-mod_php7Upgrade php74-pcntlUpgrade php7-ftpUpgrade php74-pgsqlUpgrade php74-zipUpgrade php74-opcacheUpgrade php74-odbcUpgrade php7-snmpUpgrade php7-enchantUpgrade php7-opcacheUpgrade php74-tidyUpgrade php7-intlUpgrade php7-zipUpgrade php7-iconvUpgrade php7-calendarUpgrade php7-xmlwriterUpgrade php74-sodiumUpgrade php74-sqliteUpgrade php74-devel | Mar 2, 2022 | Feb 27, 2022 |
| Ubuntu | — | Upgrade php8.0-cgiUpgrade php7.4-cgiUpgrade php7.4-cliUpgrade php8.0-cliUpgrade php8.0-fpmUpgrade php7.4-fpm | Mar 22, 2023 | Feb 27, 2022 |
| Zimbra Collaboration | — | Upgrade Zimbra Collaboration to the latest version | Jan 20, 2025 | Feb 27, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub