CVE-2022-31625
Freeing unallocated memory in php_pgsql_free_params()
Summary
Freeing unallocated memory in php_pgsql_free_params()
Original description
The description as published by the source.
In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when using Postgres database extension, supplying invalid parameters to the parametrized query may lead to PHP attempting to free memory using uninitialized data as pointers. This could lead to RCE vulnerability or denial of service.
Affected packages
Bitnami
libphp
[{"type":"SEMVER","events":[{"introduced":"7.4.0"},{"fixed":"7.4.30"},{"introduced":"8.0.0"},{"fixed":"8.0.20"},{"introduced":"8.1.0"},{"fixed":"8.1.7"}]}]
Bitnami
php
[{"type":"SEMVER","events":[{"introduced":"7.4.0"},{"fixed":"7.4.30"},{"introduced":"8.0.0"},{"fixed":"8.0.20"},{"introduced":"8.1.0"},{"fixed":"8.1.7"}]}]
Bitnami
php-min
[{"type":"SEMVER","events":[{"introduced":"7.4.0"},{"fixed":"7.4.30"},{"introduced":"8.0.0"},{"fixed":"8.0.20"},{"introduced":"8.1.0"},{"fixed":"8.1.7"}]}]
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2022-31625 php7.4 Fixed in: 7.4.30-1+deb11u1
References
- advisory lists.fedoraproject.org
- advisory lists.fedoraproject.org
- advisory nvd.nist.gov
- advisory security.gentoo.org
- advisory security.netapp.com
- advisory debian.org
- advisory github.com
- web bugs.php.net
- web lists.debian.org