In PHP versions 7.4.x below 7.4.28, 8.0.x below 8.0.16, and 8.1.x below 8.1.3, when using filter functions with FILTER_VALIDATE_FLOAT filter and min/max limits, if the filter fails, there is a possibility to trigger use of allocated memory after free, which can result it crashes, and potentially in overwrite of other memory chunks and RCE. This issue affects: code that uses FILTER_VALIDATE_FLOAT with min/max limits.
CVSS Details
- CVSS 3.1 Base Score: 8.2
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade php-xmlrpcUpgrade php-pearUpgrade php-develUpgrade php-pecl-rrdUpgrade php-gdUpgrade libzipUpgrade php-pecl-xdebugUpgrade php-pdoUpgrade php-enchantUpgrade php-fpmUpgrade libzip-develUpgrade php-pecl-xdebug3Upgrade php-snmpUpgrade php-cliUpgrade php-pecl-zipUpgrade php-xmlUpgrade php-embeddedUpgrade php-mysqlndUpgrade php-opcacheUpgrade php-mbstringUpgrade php-processUpgrade php-intlUpgrade php-odbcUpgrade php-pecl-apcu-develUpgrade php-pgsqlUpgrade php-pecl-apcuUpgrade apcu-panelUpgrade php-ffiUpgrade php-commonUpgrade php-soapUpgrade phpUpgrade php-dbgUpgrade php-jsonUpgrade php-dbaUpgrade libzip-toolsUpgrade php-ldapUpgrade php-gmpUpgrade php-bcmath | Nov 14, 2022 | Feb 27, 2022 |
| Alpine Linux | — | Upgrade php8Upgrade php7 | Oct 1, 2024 | Feb 27, 2022 |
| Amazon Linux Ami 2 | — | Upgrade php-pdoUpgrade php-gdUpgrade php-intlUpgrade php-cliUpgrade php-processUpgrade php-embeddedUpgrade php-xmlUpgrade php-opcacheUpgrade php-gmpUpgrade php-snmpUpgrade php-soapUpgrade php-enchantUpgrade php-pspellUpgrade php-mysqlndUpgrade phpUpgrade php-ldapUpgrade php-bcmathUpgrade php-dbaUpgrade php-odbcUpgrade php-sodiumUpgrade php-develUpgrade php-pgsqlUpgrade php-debuginfoUpgrade php-commonUpgrade php-dbgUpgrade php-fpmUpgrade php-mbstring | Sep 14, 2023 | Feb 27, 2022 |
| Centos_linux | — | Upgrade php-ffi-debuginfoUpgrade libzip-debuginfoUpgrade php-pecl-zip-debugsourceUpgrade php-bcmathUpgrade php-xmlrpc-debuginfoUpgrade php-pecl-xdebugUpgrade php-process-debuginfoUpgrade php-pecl-xdebug-debuginfoUpgrade php-pecl-rrd-debuginfoUpgrade php-fpmUpgrade php-develUpgrade php-processUpgrade php-fpm-debuginfoUpgrade php-pecl-apcu-debuginfoUpgrade libzip-debugsourceUpgrade php-pecl-apcu-debugsourceUpgrade php-gdUpgrade php-mbstringUpgrade php-pecl-rrdUpgrade php-gd-debuginfoUpgrade php-pgsqlUpgrade php-xmlrpcUpgrade php-pecl-apcu-develUpgrade libzipUpgrade php-pdo-debuginfoUpgrade php-enchantUpgrade php-dbaUpgrade php-pecl-apcuUpgrade libzip-tools-debuginfoUpgrade php-jsonUpgrade php-dba-debuginfoUpgrade php-mysqlnd-debuginfoUpgrade php-cli-debuginfoUpgrade php-debugsourceUpgrade php-ldapUpgrade php-json-debuginfoUpgrade php-soapUpgrade php-mbstring-debuginfoUpgrade php-odbcUpgrade php-pecl-xdebug3-debugsourceUpgrade php-pecl-zipUpgrade php-gmpUpgrade php-xml-debuginfoUpgrade php-pearUpgrade php-pdoUpgrade php-odbc-debuginfoUpgrade php-embeddedUpgrade php-commonUpgrade php-mysqlndUpgrade php-embedded-debuginfoUpgrade php-xmlUpgrade php-dbgUpgrade php-soap-debuginfoUpgrade php-dbg-debuginfoUpgrade phpUpgrade php-ffiUpgrade libzip-develUpgrade php-snmpUpgrade php-ldap-debuginfoUpgrade php-debuginfoUpgrade php-gmp-debuginfoUpgrade php-intl-debuginfoUpgrade php-pecl-zip-debuginfoUpgrade php-cliUpgrade php-common-debuginfoUpgrade apcu-panelUpgrade libzip-toolsUpgrade php-snmp-debuginfoUpgrade php-enchant-debuginfoUpgrade php-intlUpgrade php-pecl-xdebug3-debuginfoUpgrade php-bcmath-debuginfoUpgrade php-pgsql-debuginfoUpgrade php-pecl-rrd-debugsourceUpgrade php-pecl-xdebug-debugsourceUpgrade php-opcacheUpgrade php-opcache-debuginfoUpgrade php-pecl-xdebug3 | Nov 9, 2022 | Feb 27, 2022 |
| Debian | — | Upgrade php7.4 | Nov 4, 2022 | Feb 27, 2022 |
| Gentoo Linux | — | Upgrade dev-lang/php. | Sep 30, 2022 | Feb 27, 2022 |
| Oracle_linux | — | Upgrade php-pgsqlUpgrade php-opcacheUpgrade php-enchantUpgrade apcu-panelUpgrade php-cliUpgrade php-odbcUpgrade php-ffiUpgrade php-dbgUpgrade php-pecl-apcuUpgrade libzipUpgrade php-pecl-zipUpgrade php-embeddedUpgrade php-snmpUpgrade php-mysqlndUpgrade phpUpgrade libzip-toolsUpgrade php-intlUpgrade php-gdUpgrade php-ldapUpgrade libzip-develUpgrade php-bcmathUpgrade php-dbaUpgrade php-pecl-xdebug3Upgrade php-jsonUpgrade php-xmlUpgrade php-develUpgrade php-pdoUpgrade php-pearUpgrade php-pecl-xdebugUpgrade php-pecl-rrdUpgrade php-pecl-apcu-develUpgrade php-mbstringUpgrade php-soapUpgrade php-processUpgrade php-xmlrpcUpgrade php-fpmUpgrade php-commonUpgrade php-gmp | Nov 16, 2022 | Feb 17, 2022 |
| Php | — | Upgrade to PHP version 8.1.3Upgrade to PHP version 7.4.28Upgrade to PHP version 8.0.16 | Mar 14, 2022 | Feb 27, 2022 |
| Redhat_linux | — | Upgrade phpUpgrade php-pecl-zipUpgrade php-processUpgrade php-soapUpgrade libzip-toolsUpgrade php-odbcUpgrade php-pgsqlUpgrade libzip-tools-debuginfoUpgrade php-pgsql-debuginfoUpgrade php-process-debuginfoUpgrade libzip-debugsourceUpgrade php-intlUpgrade php-cli-debuginfoUpgrade php-json-debuginfoUpgrade php-debuginfoUpgrade php-pdo-debuginfoUpgrade php-pecl-apcu-develUpgrade php-gdUpgrade php-xml-debuginfoUpgrade php-pecl-xdebug3-debugsourceUpgrade libzip-debuginfoUpgrade php-gmp-debuginfoUpgrade php-ldap-debuginfoUpgrade php-dba-debuginfoUpgrade php-pecl-rrdUpgrade php-enchantUpgrade php-embeddedUpgrade php-pecl-apcu-debugsourceUpgrade php-bcmath-debuginfoUpgrade php-debugsourceUpgrade php-dbaUpgrade php-ffiUpgrade php-odbc-debuginfoUpgrade php-intl-debuginfoUpgrade php-fpm-debuginfoUpgrade php-opcache-debuginfoUpgrade apcu-panelUpgrade php-soap-debuginfoUpgrade php-snmp-debuginfoUpgrade php-pecl-apcu-debuginfoUpgrade php-mbstringUpgrade php-pecl-xdebug3-debuginfoUpgrade php-jsonUpgrade php-pecl-rrd-debuginfoUpgrade php-mbstring-debuginfoUpgrade php-xmlrpcUpgrade php-mysqlndUpgrade php-fpmUpgrade php-embedded-debuginfoUpgrade php-pearUpgrade php-pecl-xdebug-debugsourceUpgrade php-pecl-apcuUpgrade php-bcmathUpgrade php-snmpUpgrade php-pecl-zip-debugsourceUpgrade php-gmpUpgrade php-dbgUpgrade php-common-debuginfoUpgrade php-pecl-xdebug-debuginfoUpgrade php-xmlUpgrade php-ldapUpgrade php-cliUpgrade php-develUpgrade php-pecl-rrd-debugsourceUpgrade php-pecl-zip-debuginfoUpgrade php-pecl-xdebug3Upgrade php-opcacheUpgrade libzip-develUpgrade php-xmlrpc-debuginfoUpgrade php-ffi-debuginfoUpgrade php-mysqlnd-debuginfoUpgrade php-enchant-debuginfoUpgrade php-pdoUpgrade php-commonUpgrade php-dbg-debuginfoUpgrade php-gd-debuginfoUpgrade libzipUpgrade php-pecl-xdebug | Nov 9, 2022 | Feb 27, 2022 |
| Rocky_linux | — | Upgrade php-common-debuginfoUpgrade php-dbgUpgrade php-pecl-xdebug-debugsourceUpgrade php-debuginfoUpgrade php-ffiUpgrade php-xmlUpgrade php-enchant-debuginfoUpgrade php-json-debuginfoUpgrade php-intl-debuginfoUpgrade php-mysqlndUpgrade php-pecl-zip-debuginfoUpgrade php-cliUpgrade php-pecl-xdebug3-debuginfoUpgrade php-odbcUpgrade php-mbstringUpgrade php-intlUpgrade php-bcmath-debuginfoUpgrade phpUpgrade libzip-debuginfoUpgrade php-pgsql-debuginfoUpgrade php-snmp-debuginfoUpgrade libzip-toolsUpgrade php-pecl-rrd-debugsourceUpgrade php-ldap-debuginfoUpgrade php-dba-debuginfoUpgrade php-mbstring-debuginfoUpgrade libzip-develUpgrade php-opcache-debuginfoUpgrade php-soap-debuginfoUpgrade php-snmpUpgrade php-commonUpgrade php-opcacheUpgrade php-pecl-xdebug3Upgrade php-xmlrpc-debuginfoUpgrade php-pdo-debuginfoUpgrade php-pecl-apcu-develUpgrade php-xmlrpcUpgrade php-pecl-xdebug-debuginfoUpgrade php-pgsqlUpgrade php-pecl-rrdUpgrade php-odbc-debuginfoUpgrade php-ffi-debuginfoUpgrade php-embeddedUpgrade php-cli-debuginfoUpgrade php-pecl-apcu-debuginfoUpgrade php-fpm-debuginfoUpgrade php-ldapUpgrade php-gd-debuginfoUpgrade php-bcmathUpgrade php-xml-debuginfoUpgrade php-fpmUpgrade libzip-tools-debuginfoUpgrade php-develUpgrade php-mysqlnd-debuginfoUpgrade php-enchantUpgrade php-soapUpgrade php-pdoUpgrade php-pecl-zipUpgrade php-process-debuginfoUpgrade php-debugsourceUpgrade libzipUpgrade php-pecl-xdebug3-debugsourceUpgrade php-pecl-xdebugUpgrade php-pecl-apcu-debugsourceUpgrade php-dbg-debuginfoUpgrade php-dbaUpgrade php-pecl-zip-debugsourceUpgrade php-pecl-rrd-debuginfoUpgrade php-gmp-debuginfoUpgrade libzip-debugsourceUpgrade php-gdUpgrade php-jsonUpgrade php-processUpgrade php-pecl-apcuUpgrade php-gmpUpgrade php-embedded-debuginfo | Mar 12, 2024 | Feb 27, 2022 |
| Suse | — | Upgrade php7-sysvsemUpgrade php74-sysvshmUpgrade php74-sqliteUpgrade php7-bcmathUpgrade php7-tokenizerUpgrade php74-curlUpgrade php7-curlUpgrade php7-pgsqlUpgrade php74-bz2Upgrade php7-fastcgiUpgrade php7-pharUpgrade php74-snmpUpgrade php74-socketsUpgrade php74-develUpgrade php74-xslUpgrade php7-ctypeUpgrade php74-tidyUpgrade php74-tokenizerUpgrade php7-testUpgrade php74-gettextUpgrade php74-shmopUpgrade php7-iconvUpgrade apache2-mod_php74Upgrade php7-calendarUpgrade php7-zipUpgrade php74-pcntlUpgrade php7-fileinfoUpgrade php74-pdoUpgrade php74-sodiumUpgrade php74-fpmUpgrade php7-fpmUpgrade php74-pgsqlUpgrade php74-gdUpgrade php7-intlUpgrade php7-xmlwriterUpgrade apache2-mod_php7Upgrade php74-jsonUpgrade php74-odbcUpgrade php74-opcacheUpgrade php74-enchantUpgrade php74-zipUpgrade php7-pcntlUpgrade php7-pdoUpgrade php74-fastcgiUpgrade php7-enchantUpgrade php74-mysqlUpgrade php7-snmpUpgrade php7-ftpUpgrade php7-sysvmsgUpgrade php7-opcacheUpgrade php7-cliUpgrade php74-sysvmsgUpgrade php74-zlibUpgrade php74-domUpgrade php7-odbcUpgrade php7-bz2Upgrade php74-ftpUpgrade php7-shmopUpgrade php7-develUpgrade php7-xslUpgrade php7-gettextUpgrade php7-domUpgrade php7-soapUpgrade php7-embedUpgrade php74-sysvsemUpgrade php74-ctypeUpgrade php7-readlineUpgrade php74Upgrade php74-bcmathUpgrade php7-exifUpgrade php74-readlineUpgrade php7-zlibUpgrade php7-mysqlUpgrade php7-gmpUpgrade php74-calendarUpgrade php74-xmlwriterUpgrade php74-posixUpgrade php7-dbaUpgrade php74-xmlrpcUpgrade php74-fileinfoUpgrade php7-jsonUpgrade php74-ldapUpgrade php7-posixUpgrade php7-xmlreaderUpgrade php7-socketsUpgrade php74-soapUpgrade php7-tidyUpgrade php7-mbstringUpgrade php7-sodiumUpgrade php7-sysvshmUpgrade php7-ldapUpgrade php74-dbaUpgrade php74-pharUpgrade php74-gmpUpgrade php7-sqliteUpgrade php7-firebirdUpgrade php74-intlUpgrade php7Upgrade php7-opensslUpgrade php74-mbstringUpgrade php74-xmlreaderUpgrade php7-xmlrpcUpgrade php7-gdUpgrade php74-iconvUpgrade php74-exifUpgrade php74-openssl | Mar 2, 2022 | Feb 27, 2022 |
| Ubuntu | — | Upgrade php7.4-fpmUpgrade php8.0-cgiUpgrade php8.0-cliUpgrade php7.4-cliUpgrade php7.4-cgiUpgrade php8.0-fpm | Mar 22, 2023 | Feb 27, 2022 |
| Zimbra Collaboration | — | Upgrade Zimbra Collaboration to the latest version | Jan 20, 2025 | Feb 27, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub