CVE-2024-8929
Leak partial content of the heap through heap buffer over-read in mysqlnd
Summary
Leak partial content of the heap through heap buffer over-read in mysqlnd
Original description
The description as published by the source.
In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, a hostile MySQL server can cause the client to disclose the content of its heap containing data from other SQL requests and possible other data belonging to different users of the same server.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Affected packages
Bitnami
libphp
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"8.1.31"},{"introduced":"8.2.0"},{"fixed":"8.2.24"},{"introduced":"8.3.0"},{"fixed":"8.3.14"}]}]
Bitnami
php-min
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"8.1.31"},{"introduced":"8.2.0"},{"fixed":"8.2.24"},{"introduced":"8.3.0"},{"fixed":"8.3.14"}]}]
Bitnami
php
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"8.1.31"},{"introduced":"8.2.0"},{"fixed":"8.2.24"},{"introduced":"8.3.0"},{"fixed":"8.3.14"}]}]
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2024-8929 php7.4 Fixed in: 7.4.33-1+deb11u7
References
- advisory github.com
- advisory nvd.nist.gov
- advisory security.netapp.com
- advisory github.com
- web lists.debian.org