CVE-2023-0568
Array overrun in common path resolve code
概要
Array overrun in common path resolve code
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, core path resolution function allocate buffer one byte too small. When resolving paths with lengths close to system MAXPATHLEN setting, this may lead to the byte after the allocated buffer being overwritten with NUL value, which might lead to unauthorized data access or modification.
影響パッケージ
Bitnami
php-min
[{"type":"SEMVER","events":[{"introduced":"8.0.0"},{"fixed":"8.0.28"},{"introduced":"8.1.0"},{"fixed":"8.1.16"},{"introduced":"8.2.0"},{"fixed":"8.2.3"}]}]
Bitnami
libphp
[{"type":"SEMVER","events":[{"introduced":"8.0.0"},{"fixed":"8.0.28"},{"introduced":"8.1.0"},{"fixed":"8.1.16"},{"introduced":"8.2.0"},{"fixed":"8.2.3"}]}]
Bitnami
php
[{"type":"SEMVER","events":[{"introduced":"8.0.0"},{"fixed":"8.0.28"},{"introduced":"8.1.0"},{"fixed":"8.1.16"},{"introduced":"8.2.0"},{"fixed":"8.2.3"}]}]
ディストリビューション別の修正状況
各ディストリビューションが公開している、この CVE の修正パッケージ
- Debian DEBIAN-CVE-2023-0568 php7.4 修正版: 7.4.33-1+deb11u3
参照URL
- advisory bugs.php.net
- web security.netapp.com
- web nvd.nist.gov