Critical Buffer Under-read Vulnerability in PHP5 Package
Summary
ALPINE-CVE-2018-7584: In PHP through 5.6.33, 7.0.x before 7.0.28, 7.1.x through 7.1.14, and 7.2.x through 7.2.2, there is a stack-based buffer under-read while parsing an HTTP response in the php_stream_url_wrap_http_ex function in ext/standa... Affects php5 versions < 5.6.34-r0. Fixed in 5.6.34-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
PHP5 is a widely-used open-source scripting language designed for web development but also used as a general-purpose programming language. It enables developers to create dynamic web pages and applications. The PHP5 package in Alpine Linux versions 3.4 and 3.5 has been found to have a critical vulnerability that can lead to severe security issues if not addressed promptly.
Vulnerability Detail
In PHP versions up to 5.6.33, 7.0.x before 7.0.28, 7.1.x through 7.1.14, and 7.2.x through 7.2.2, a stack-based buffer under-read occurs while parsing an HTTP response in the php_stream_url_wrap_http_ex function located in ext/standard/http_fopen_wrapper.c. This vulnerability can lead to the copying of large strings, potentially allowing an attacker to exploit the system, resulting in data corruption or unauthorized access.
How To Fix
Minimum fixed version
5.6.34-r0
This is the first release that contains the fix.
sudo apk add --upgrade php5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict the use of the affected function in your application code until the package is updated. For example, avoid using 'http_fopen_wrapper' in your scripts until the vulnerability is patched.
Conclusion
The buffer under-read vulnerability in the PHP5 package poses a significant risk to applications using affected versions. It is crucial to update to the patched version to protect your systems from potential exploitation. Regular monitoring and vulnerability management practices, such as those offered by Vulert, can help maintain security in your software.
See every vulnerability recorded for php5 →
FAQ
A buffer under-read vulnerability occurs when a program reads data from a buffer before the intended start point, potentially exposing sensitive data or causing unexpected behavior.
Exploitation of this vulnerability can lead to data corruption, unauthorized access, or even remote code execution, depending on how the application handles the data.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor and alert for open-source vulnerabilities without needing to install any software.
The CVSS score of this vulnerability is 9.8, indicating a critical level of severity that requires immediate attention.
If immediate updates are not possible, consider implementing strict input validation and sanitization to mitigate the risk until a patch can be applied.
References
Related vulnerabilities
Recent vulnerabilities recorded for php5.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
