CVE-2024-11235
Reference counting in php_request_shutdown causes Use-After-Free
概要
Reference counting in php_request_shutdown causes Use-After-Free
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
In PHP versions 8.3.* before 8.3.19 and 8.4.* before 8.4.5, a code sequence involving __set handler or ??= operator and exceptions can lead to a use-after-free vulnerability. If the third party can control the memory layout leading to this, for example by supplying specially crafted inputs to the script, it could lead to remote code execution.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
影響パッケージ
Bitnami
libphp
[{"type":"SEMVER","events":[{"introduced":"8.3.0"},{"fixed":"8.3.19"},{"introduced":"8.4.0"},{"fixed":"8.4.5"}]}]
Bitnami
php-min
[{"type":"SEMVER","events":[{"introduced":"8.3.0"},{"fixed":"8.3.19"},{"introduced":"8.4.0"},{"fixed":"8.4.5"}]}]
Bitnami
php
[{"type":"SEMVER","events":[{"introduced":"8.3.0"},{"fixed":"8.3.19"},{"introduced":"8.4.0"},{"fixed":"8.4.5"}]}]
ディストリビューション別の修正状況
各ディストリビューションが公開している、この CVE の修正パッケージ
- Debian DEBIAN-CVE-2024-11235 php8.4 修正版: 8.4.5-1
参照URL
- advisory github.com
- advisory nvd.nist.gov
- advisory github.com