PT-2024-8904 · Php+6 · Php+6
Crispy-Fried-Chicken
+1
·
Published
2024-11-15
·
Updated
2026-01-19
·
CVE-2024-8932
CVSS v2.0
10
Critical
| Vector | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions:
PHP versions 8.1.* through 8.1.30
PHP versions 8.2.* through 8.2.25
PHP versions 8.3.* through 8.3.13
Description:
The issue is related to the ldap escape() function in PHP, which can cause an integer overflow when given uncontrolled long string inputs on 32-bit systems, resulting in an out-of-bounds write. This can allow a remote attacker to cause a denial of service. The estimated number of potentially affected devices worldwide is over 700,000 instances.
Recommendations:
For PHP versions 8.1.* through 8.1.30, update to version 8.1.31 or later.
For PHP versions 8.2.* through 8.2.25, update to version 8.2.26 or later.
For PHP versions 8.3.* through 8.3.13, update to version 8.3.14 or later.
As a temporary workaround, consider disabling the
ldap escape() function until a patch is available.Exploit
Fix
DoS
Memory Corruption
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Linuxmint
Php
Red Os
Suse
Ubuntu