In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, uncontrolled long string inputs to ldap_escape() function on 32-bit systems can cause an integer overflow, resulting in an out-of-bounds write.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade php83Upgrade php81 | Aug 8, 2025 | Nov 24, 2024 |
| Debian | — | Upgrade php8.2Upgrade php7.4 | Dec 2, 2024 | Nov 24, 2024 |
| Php | — | Upgrade to PHP version 8.1.31Upgrade to PHP version 8.3.14Upgrade to PHP version 8.2.26 | Dec 2, 2024 | Nov 24, 2024 |
| Suse | — | Upgrade php8Upgrade php8-tokenizerUpgrade php8-xslUpgrade php8-calendarUpgrade php8-opensslUpgrade php8-pdoUpgrade php8-opcacheUpgrade php8-readlineUpgrade php8-dbaUpgrade php8-enchantUpgrade php8-exifUpgrade php8-testUpgrade php8-gmpUpgrade php8-ctypeUpgrade php8-zlibUpgrade php8-sysvmsgUpgrade php8-develUpgrade php8-ldapUpgrade php8-xmlwriterUpgrade php8-mysqlUpgrade php8-embedUpgrade php8-domUpgrade php8-intlUpgrade php8-curlUpgrade php8-fastcgiUpgrade php8-cliUpgrade php8-zipUpgrade php8-odbcUpgrade php8-bz2Upgrade php8-socketsUpgrade php8-gdUpgrade php8-ffiUpgrade php8-bcmathUpgrade apache2-mod_php8Upgrade php8-iconvUpgrade php8-sysvshmUpgrade php8-soapUpgrade php8-mbstringUpgrade php8-fpm-apacheUpgrade php8-sqliteUpgrade php8-fileinfoUpgrade php8-tidyUpgrade php8-shmopUpgrade php8-pgsqlUpgrade php8-gettextUpgrade php8-sodiumUpgrade php8-pharUpgrade php8-ftpUpgrade php8-xmlreaderUpgrade php8-pcntlUpgrade php8-posixUpgrade php8-sysvsemUpgrade php8-fpmUpgrade php8-snmp | Jan 3, 2025 | Nov 24, 2024 |
| Ubuntu | — | Upgrade php8.1-fpmUpgrade php7.2-pgsql (Ubuntu Pro)Upgrade php8.3-fpmUpgrade php8.3-mysqlUpgrade libphp7.0-embed (Ubuntu Pro)Upgrade php7.4Upgrade php7.2-sqlite3 (Ubuntu Pro)Upgrade php7.0-pgsql (Ubuntu Pro)Upgrade php7.0-mysql (Ubuntu Pro)Upgrade php7.2-common (Ubuntu Pro)Upgrade php7.4-cliUpgrade libapache2-mod-php7.4Upgrade php8.1-cgiUpgrade php7.0-common (Ubuntu Pro)Upgrade php8.3Upgrade libapache2-mod-php8.0Upgrade libapache2-mod-php7.0 (Ubuntu Pro)Upgrade libapache2-mod-php8.1Upgrade php7.0 (Ubuntu Pro)Upgrade php7.0-interbase (Ubuntu Pro)Upgrade php7.4-mysqlUpgrade php7.4-cgiUpgrade libapache2-mod-php8.3Upgrade php8.1Upgrade libphp7.2-embed (Ubuntu Pro)Upgrade php7.0-dev (Ubuntu Pro)Upgrade libapache2-mod-php7.2 (Ubuntu Pro)Upgrade php7.2-dev (Ubuntu Pro)Upgrade php8.1-mysqlUpgrade php8.3-cliUpgrade php7.0-sqlite3 (Ubuntu Pro)Upgrade php8.3-cgiUpgrade php8.1-cliUpgrade php7.2-mysql (Ubuntu Pro)Upgrade php7.2-interbase (Ubuntu Pro)Upgrade php7.2 (Ubuntu Pro)Upgrade php7.4-fpmUpgrade php8.1-enchant | Dec 13, 2024 | Nov 24, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub