CVE-2022-31625
Freeing unallocated memory in php_pgsql_free_params()
概要
Freeing unallocated memory in php_pgsql_free_params()
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when using Postgres database extension, supplying invalid parameters to the parametrized query may lead to PHP attempting to free memory using uninitialized data as pointers. This could lead to RCE vulnerability or denial of service.
影響パッケージ
Bitnami
libphp
[{"type":"SEMVER","events":[{"introduced":"7.4.0"},{"fixed":"7.4.30"},{"introduced":"8.0.0"},{"fixed":"8.0.20"},{"introduced":"8.1.0"},{"fixed":"8.1.7"}]}]
Bitnami
php
[{"type":"SEMVER","events":[{"introduced":"7.4.0"},{"fixed":"7.4.30"},{"introduced":"8.0.0"},{"fixed":"8.0.20"},{"introduced":"8.1.0"},{"fixed":"8.1.7"}]}]
Bitnami
php-min
[{"type":"SEMVER","events":[{"introduced":"7.4.0"},{"fixed":"7.4.30"},{"introduced":"8.0.0"},{"fixed":"8.0.20"},{"introduced":"8.1.0"},{"fixed":"8.1.7"}]}]
ディストリビューション別の修正状況
各ディストリビューションが公開している、この CVE の修正パッケージ
- Debian DEBIAN-CVE-2022-31625 php7.4 修正版: 7.4.30-1+deb11u1
参照URL
- advisory bugs.php.net
- advisory lists.debian.org
- advisory security.gentoo.org
- advisory security.netapp.com
- advisory debian.org
- web lists.fedoraproject.org
- web lists.fedoraproject.org
- web nvd.nist.gov