Niels Dossche

**Name of the Vulnerable Software and Affected Versions** PHP versions prior to 8.4.16-1~deb13u1 PHP 7.4 (affected versions not specified) PHP 8.2 (affected versions not specified) **Description** Several security issues were identified in PHP, a scripting language, potentially leading to denial of service or memory disclosure. **Recommendations** Upgrade php8.4 packages to version 8.4.16-1~deb13u1. At the moment, there is no information about a newer version that contains a fix for this vulnerability. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** PHP versions 8.1.* before 8.1.31 PHP versions 8.2.* before 8.2.26 PHP versions 8.3.* before 8.3.14 **Description** The issue is related to an integer overflow in the `ldap escape()` function on 32-bit systems when handling uncontrolled long string inputs. This can result in an out-of-bounds write, potentially allowing a remote attacker to execute arbitrary code by sending specially crafted data to a web application. The vulnerability is critical and can lead to system crashes or malicious actions. **Recommendations** For PHP versions 8.1.* before 8.1.31, update to version 8.1.31 or later. For PHP versions 8.2.* before 8.2.26, update to version 8.2.26 or later. For PHP versions 8.3.* before 8.3.14, update to version 8.3.14 or later. As a temporary workaround, consider restricting the input to the `ldap escape()` function to prevent long string inputs on 32-bit systems.

**Name of the Vulnerable Software and Affected Versions** typo3/html-sanitizer versions prior to 1.5.3 typo3/html-sanitizer versions prior to 2.1.4 **Description** The issue arises from incorrect handling of DOM processing instructions, allowing bypassing of the cross-site scripting mechanism of typo3/html-sanitizer. **Recommendations** For versions prior to 1.5.3, update to version 1.5.3 to resolve the issue. For versions prior to 2.1.4, update to version 2.1.4 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** PHP versions 8.0.* before 8.0.30 PHP versions 8.1.* before 8.1.22 PHP versions 8.2.* before 8.2.8 **Description** The issue is caused by insufficient length checking when loading phar files, leading to a stack buffer overflow, which can result in memory corruption or remote code execution (RCE). This vulnerability was reportedly exploited by law enforcement agencies in Operation Cronos to compromise the LockBit ransomware group's infrastructure. The group claims that the vulnerability, specifically in PHP version 8.1.2, was used to gain access to their servers. It is estimated that over 2000 individuals and organizations have been affected by LockBit, with the group demanding over $91 million in ransom from American organizations alone. The vulnerability allows for RCE, which can enable attackers to execute arbitrary code on the affected system. **Recommendations** For PHP versions 8.0.* before 8.0.30, update to version 8.0.30 or later. For PHP versions 8.1.* before 8.1.22, update to version 8.1.22 or later. For PHP versions 8.2.* before 8.2.8, update to version 8.2.8 or later. As a temporary workaround, consider disabling the phar functionality until a patch is available. Restrict access to phar files to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** PHP versions 8.0.* through 8.0.28 PHP versions 8.1.* through 8.1.19 PHP versions 8.2.* through 8.2.6 **Description** The issue is related to the use of a random value generator with a narrower range of values than it should have when using SOAP HTTP Digest Authentication. In case of random generator failure, it could lead to a disclosure of 31 bits of uninitialized memory from the client to the server, and it also made easier to a malicious server to guess the client's nonce. **Recommendations** For PHP versions 8.0.* through 8.0.28, update to version 8.0.29 or later. For PHP versions 8.1.* through 8.1.19, update to version 8.1.20 or later. For PHP versions 8.2.* through 8.2.6, update to version 8.2.7 or later. As a temporary workaround, consider disabling the SOAP HTTP Digest Authentication until a patch is available.

**Name of the Vulnerable Software and Affected Versions** PHP versions 8.0.0 through 8.0.27 PHP versions 8.1.0 through 8.1.15 PHP versions 8.2.0 through 8.2.2 **Description** The issue is related to the core path resolution function in PHP, which allocates a buffer one byte too small. When resolving paths with lengths close to the system MAXPATHLEN setting, this may lead to the byte after the allocated buffer being overwritten with a NUL value, potentially resulting in unauthorized data access or modification. **Recommendations** For PHP versions 8.0.0 through 8.0.27, update to version 8.0.28 or later. For PHP versions 8.1.0 through 8.1.15, update to version 8.1.16 or later. For PHP versions 8.2.0 through 8.2.2, update to version 8.2.3 or later.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** A race condition issue has been identified in the Linux kernel, specifically in the IB/rdmavt module. The problem arises from a call to the `rvt error qp` function without proper locking, as required by the function's documentation. This can lead to a lockdep assertion failure and potentially cause a race condition. The issue is related to the `rvt ruc loopback` function, where the call to `rvt error qp` is no longer protected by the `r lock`. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.