In PHP versions 7.4.x below 7.4.28, 8.0.x below 8.0.16, and 8.1.x below 8.1.3, when using filter functions with FILTER_VALIDATE_FLOAT filter and min/max limits, if the filter fails, there is a possibility to trigger use of allocated memory after free, which can result it crashes, and potentially in overwrite of other memory chunks and RCE. This issue affects: code that uses FILTER_VALIDATE_FLOAT with min/max limits.
CVSS Details
- CVSS 3.1 Base Score: 8.2
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade php-develUpgrade php-pearUpgrade php-pecl-rrdUpgrade php-gdUpgrade php-opcacheUpgrade php-fpmUpgrade php-xmlrpcUpgrade php-pecl-xdebugUpgrade php-pecl-xdebug3Upgrade libzip-develUpgrade php-mysqlndUpgrade php-xmlUpgrade php-processUpgrade php-snmpUpgrade libzipUpgrade php-mbstringUpgrade php-pecl-zipUpgrade php-cliUpgrade php-pdoUpgrade php-enchantUpgrade php-embeddedUpgrade php-intlUpgrade php-ldapUpgrade php-gmpUpgrade php-pecl-apcuUpgrade php-bcmathUpgrade libzip-toolsUpgrade php-soapUpgrade phpUpgrade php-commonUpgrade apcu-panelUpgrade php-jsonUpgrade php-dbaUpgrade php-pgsqlUpgrade php-pecl-apcu-develUpgrade php-ffiUpgrade php-odbcUpgrade php-dbg | Nov 14, 2022 | Feb 27, 2022 |
| Alpine Linux | — | Upgrade php7Upgrade php8 | Oct 1, 2024 | Feb 27, 2022 |
| Amazon Linux Ami 2 | — | Upgrade php-processUpgrade php-pdoUpgrade php-opcacheUpgrade php-soapUpgrade php-gdUpgrade php-pspellUpgrade php-snmpUpgrade php-intlUpgrade php-embeddedUpgrade php-gmpUpgrade php-dbaUpgrade php-xmlUpgrade php-bcmathUpgrade php-mysqlndUpgrade php-cliUpgrade php-enchantUpgrade phpUpgrade php-ldapUpgrade php-sodiumUpgrade php-develUpgrade php-pgsqlUpgrade php-dbgUpgrade php-odbcUpgrade php-debuginfoUpgrade php-mbstringUpgrade php-commonUpgrade php-fpm | Sep 14, 2023 | Feb 27, 2022 |
| Centos_linux | — | Upgrade php-ffiUpgrade php-pecl-xdebug3-debuginfoUpgrade php-xmlUpgrade phpUpgrade php-embedded-debuginfoUpgrade php-dbgUpgrade php-soap-debuginfoUpgrade php-cliUpgrade php-intlUpgrade php-pecl-xdebug3Upgrade php-ldap-debuginfoUpgrade php-gmp-debuginfoUpgrade php-debuginfoUpgrade php-bcmath-debuginfoUpgrade php-pecl-xdebug-debugsourceUpgrade php-pecl-rrd-debugsourceUpgrade php-opcache-debuginfoUpgrade php-opcacheUpgrade libzip-develUpgrade php-snmp-debuginfoUpgrade php-pecl-zip-debuginfoUpgrade php-intl-debuginfoUpgrade php-enchant-debuginfoUpgrade libzip-toolsUpgrade apcu-panelUpgrade php-pgsql-debuginfoUpgrade php-commonUpgrade php-dbg-debuginfoUpgrade php-snmpUpgrade php-common-debuginfoUpgrade php-mysqlndUpgrade php-pecl-apcu-develUpgrade php-dbaUpgrade php-enchantUpgrade php-ldapUpgrade php-json-debuginfoUpgrade php-mbstring-debuginfoUpgrade php-process-debuginfoUpgrade php-pdo-debuginfoUpgrade php-odbcUpgrade php-pecl-xdebug3-debugsourceUpgrade php-pgsqlUpgrade php-pecl-zipUpgrade php-dba-debuginfoUpgrade php-debugsourceUpgrade php-soapUpgrade libzipUpgrade php-gmpUpgrade php-cli-debuginfoUpgrade php-xml-debuginfoUpgrade php-mysqlnd-debuginfoUpgrade php-xmlrpc-debuginfoUpgrade php-bcmathUpgrade php-pearUpgrade php-xmlrpcUpgrade php-pecl-apcuUpgrade php-embeddedUpgrade php-jsonUpgrade libzip-tools-debuginfoUpgrade libzip-debuginfoUpgrade php-ffi-debuginfoUpgrade php-pecl-zip-debugsourceUpgrade php-fpm-debuginfoUpgrade libzip-debugsourceUpgrade php-pecl-apcu-debuginfoUpgrade php-pecl-apcu-debugsourceUpgrade php-mbstringUpgrade php-pecl-rrd-debuginfoUpgrade php-pecl-xdebug-debuginfoUpgrade php-fpmUpgrade php-gdUpgrade php-processUpgrade php-develUpgrade php-gd-debuginfoUpgrade php-pecl-rrdUpgrade php-pecl-xdebugUpgrade php-pdoUpgrade php-odbc-debuginfo | Nov 9, 2022 | Feb 27, 2022 |
| Debian | — | Upgrade php7.4 | Nov 4, 2022 | Feb 27, 2022 |
| Gentoo Linux | — | Upgrade dev-lang/php. | Sep 30, 2022 | Feb 27, 2022 |
| Oracle_linux | — | Upgrade libzipUpgrade phpUpgrade php-pecl-apcuUpgrade php-mysqlndUpgrade php-gdUpgrade php-dbgUpgrade php-enchantUpgrade libzip-toolsUpgrade php-ldapUpgrade php-pgsqlUpgrade php-pecl-zipUpgrade php-opcacheUpgrade php-cliUpgrade php-snmpUpgrade php-intlUpgrade php-dbaUpgrade libzip-develUpgrade php-embeddedUpgrade php-bcmathUpgrade php-odbcUpgrade apcu-panelUpgrade php-ffiUpgrade php-commonUpgrade php-develUpgrade php-processUpgrade php-pecl-apcu-develUpgrade php-pearUpgrade php-soapUpgrade php-mbstringUpgrade php-xmlUpgrade php-jsonUpgrade php-gmpUpgrade php-pecl-xdebugUpgrade php-pecl-xdebug3Upgrade php-pecl-rrdUpgrade php-pdoUpgrade php-xmlrpcUpgrade php-fpm | Nov 16, 2022 | Feb 17, 2022 |
| Php | — | Upgrade to PHP version 8.0.16Upgrade to PHP version 7.4.28Upgrade to PHP version 8.1.3 | Mar 14, 2022 | Feb 27, 2022 |
| Redhat_linux | — | Upgrade php-cli-debuginfoUpgrade php-pecl-zipUpgrade php-embeddedUpgrade php-pecl-apcu-debugsourceUpgrade php-bcmath-debuginfoUpgrade php-intl-debuginfoUpgrade php-dbaUpgrade php-odbc-debuginfoUpgrade php-xml-debuginfoUpgrade php-processUpgrade libzip-tools-debuginfoUpgrade php-pgsqlUpgrade phpUpgrade libzip-debugsourceUpgrade php-ffiUpgrade php-pgsql-debuginfoUpgrade php-soapUpgrade php-debugsourceUpgrade php-snmp-debuginfoUpgrade php-pdo-debuginfoUpgrade libzip-debuginfoUpgrade php-gmp-debuginfoUpgrade php-process-debuginfoUpgrade php-pecl-xdebug3-debugsourceUpgrade php-json-debuginfoUpgrade php-pecl-apcu-debuginfoUpgrade php-ldap-debuginfoUpgrade php-opcache-debuginfoUpgrade php-odbcUpgrade php-pecl-rrdUpgrade libzip-toolsUpgrade php-gdUpgrade php-fpm-debuginfoUpgrade apcu-panelUpgrade php-dba-debuginfoUpgrade php-enchantUpgrade php-debuginfoUpgrade php-soap-debuginfoUpgrade php-pecl-apcu-develUpgrade php-intlUpgrade php-xmlrpcUpgrade php-mbstringUpgrade php-pecl-rrd-debuginfoUpgrade php-common-debuginfoUpgrade php-pdoUpgrade php-mysqlndUpgrade php-snmpUpgrade php-pecl-zip-debugsourceUpgrade php-dbgUpgrade php-gmpUpgrade php-mysqlnd-debuginfoUpgrade php-ffi-debuginfoUpgrade php-xmlrpc-debuginfoUpgrade php-pecl-xdebug3-debuginfoUpgrade php-fpmUpgrade php-cliUpgrade php-pecl-rrd-debugsourceUpgrade php-pecl-xdebug3Upgrade php-pearUpgrade php-pecl-xdebug-debugsourceUpgrade php-bcmathUpgrade php-pecl-zip-debuginfoUpgrade libzip-develUpgrade php-develUpgrade php-pecl-xdebug-debuginfoUpgrade php-mbstring-debuginfoUpgrade php-embedded-debuginfoUpgrade php-pecl-xdebugUpgrade php-dbg-debuginfoUpgrade libzipUpgrade php-commonUpgrade php-jsonUpgrade php-pecl-apcuUpgrade php-opcacheUpgrade php-ldapUpgrade php-gd-debuginfoUpgrade php-xmlUpgrade php-enchant-debuginfo | Nov 9, 2022 | Feb 27, 2022 |
| Rocky_linux | — | Upgrade php-ffiUpgrade libzip-debuginfoUpgrade php-intl-debuginfoUpgrade php-pecl-zip-debuginfoUpgrade libzip-develUpgrade php-snmpUpgrade php-snmp-debuginfoUpgrade php-cliUpgrade php-pgsql-debuginfoUpgrade php-pecl-rrd-debugsourceUpgrade php-ldap-debuginfoUpgrade php-mbstring-debuginfoUpgrade php-common-debuginfoUpgrade php-dba-debuginfoUpgrade php-intlUpgrade php-debuginfoUpgrade php-json-debuginfoUpgrade php-bcmath-debuginfoUpgrade libzip-toolsUpgrade php-enchant-debuginfoUpgrade php-mbstringUpgrade php-pecl-xdebug-debugsourceUpgrade php-dbgUpgrade php-opcacheUpgrade php-opcache-debuginfoUpgrade php-commonUpgrade php-mysqlndUpgrade php-xmlUpgrade php-soap-debuginfoUpgrade php-odbcUpgrade php-pecl-xdebug3Upgrade phpUpgrade php-pecl-xdebug3-debuginfoUpgrade php-dbaUpgrade php-fpmUpgrade php-debugsourceUpgrade php-pecl-zipUpgrade php-enchantUpgrade php-develUpgrade php-xml-debuginfoUpgrade php-gmpUpgrade php-embedded-debuginfoUpgrade php-processUpgrade php-pecl-apcu-debuginfoUpgrade php-fpm-debuginfoUpgrade php-pdoUpgrade libzip-tools-debuginfoUpgrade php-gdUpgrade libzip-debugsourceUpgrade php-pecl-zip-debugsourceUpgrade php-pecl-rrd-debuginfoUpgrade php-gmp-debuginfoUpgrade php-bcmathUpgrade php-pdo-debuginfoUpgrade php-gd-debuginfoUpgrade php-xmlrpc-debuginfoUpgrade php-ldapUpgrade php-jsonUpgrade php-mysqlnd-debuginfoUpgrade php-pecl-apcu-debugsourceUpgrade php-pecl-xdebugUpgrade php-dbg-debuginfoUpgrade libzipUpgrade php-process-debuginfoUpgrade php-pecl-xdebug3-debugsourceUpgrade php-xmlrpcUpgrade php-pgsqlUpgrade php-pecl-xdebug-debuginfoUpgrade php-pecl-rrdUpgrade php-pecl-apcu-develUpgrade php-embeddedUpgrade php-odbc-debuginfoUpgrade php-ffi-debuginfoUpgrade php-pecl-apcuUpgrade php-cli-debuginfoUpgrade php-soap | Mar 12, 2024 | Feb 27, 2022 |
| Suse | — | Upgrade php74-bcmathUpgrade php7-firebirdUpgrade php7Upgrade php7-sqliteUpgrade php74-fileinfoUpgrade php74-readlineUpgrade php74-soapUpgrade php7-soapUpgrade php74-sysvmsgUpgrade php74-opensslUpgrade php74-xmlrpcUpgrade php74-zlibUpgrade php7-odbcUpgrade php7-cliUpgrade php7-tidyUpgrade php74-domUpgrade php74-exifUpgrade php7-sodiumUpgrade php7-mbstringUpgrade php74-calendarUpgrade php7-gettextUpgrade php7-develUpgrade php7-xslUpgrade php7-bz2Upgrade php74-iconvUpgrade php7-mysqlUpgrade php7-dbaUpgrade php74-sysvsemUpgrade php7-domUpgrade php74-mbstringUpgrade php7-gmpUpgrade php7-xmlreaderUpgrade php74-xmlwriterUpgrade php7-exifUpgrade php7-xmlrpcUpgrade php74Upgrade php74-gmpUpgrade php74-ftpUpgrade php7-opensslUpgrade php7-socketsUpgrade php74-ctypeUpgrade php7-sysvshmUpgrade php7-readlineUpgrade php7-gdUpgrade php7-ldapUpgrade php7-jsonUpgrade php74-dbaUpgrade php7-posixUpgrade php7-embedUpgrade php7-shmopUpgrade php74-pharUpgrade php74-ldapUpgrade php7-zlibUpgrade php74-posixUpgrade php74-intlUpgrade php74-xmlreaderUpgrade php7-zipUpgrade php74-jsonUpgrade php74-socketsUpgrade php7-sysvmsgUpgrade php74-zipUpgrade php74-opcacheUpgrade php7-enchantUpgrade php7-snmpUpgrade php74-pgsqlUpgrade php7-opcacheUpgrade php7-pcntlUpgrade php74-pdoUpgrade apache2-mod_php7Upgrade php74-sodiumUpgrade php74-mysqlUpgrade php7-iconvUpgrade php7-xmlwriterUpgrade php7-calendarUpgrade php74-gettextUpgrade php74-sqliteUpgrade php74-shmopUpgrade php7-fastcgiUpgrade php74-curlUpgrade php7-ctypeUpgrade php7-testUpgrade php7-pdoUpgrade php74-enchantUpgrade php74-fastcgiUpgrade php74-snmpUpgrade php74-develUpgrade php74-bz2Upgrade php74-xslUpgrade php7-curlUpgrade php7-pgsqlUpgrade php74-gdUpgrade php7-fileinfoUpgrade php7-fpmUpgrade php74-sysvshmUpgrade php74-tidyUpgrade php7-pharUpgrade php7-intlUpgrade php7-ftpUpgrade php7-tokenizerUpgrade php74-pcntlUpgrade php74-fpmUpgrade php7-sysvsemUpgrade apache2-mod_php74Upgrade php7-bcmathUpgrade php74-tokenizerUpgrade php74-odbc | Mar 2, 2022 | Feb 27, 2022 |
| Ubuntu | — | Upgrade php7.4-cliUpgrade php8.0-fpmUpgrade php8.0-cgiUpgrade php7.4-cgiUpgrade php8.0-cliUpgrade php7.4-fpm | Mar 22, 2023 | Feb 27, 2022 |
| Zimbra Collaboration | — | Upgrade Zimbra Collaboration to the latest version | Jan 20, 2025 | Feb 27, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub