Moderate PHP Security Update: Heap-Based Buffer Overflow and Information Disclosure
Summary
ALSA-2026:2799: Moderate: php security update. Affects php versions < 8.0.30-5.el9_7. Fixed in 8.0.30-5.el9_7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PHP is a widely-used open-source scripting language that is especially suited for web development. It allows developers to create dynamic web pages and applications. PHP is often embedded within HTML and is known for its ease of use and flexibility. However, like any software, it is susceptible to vulnerabilities that can compromise its security and the applications built on it.
Vulnerability Detail
This vulnerability arises from a heap-based buffer overflow in the array_merge() function, which can lead to arbitrary code execution. Additionally, there is an information disclosure risk via the getimagesize() function when reading multi-chunk images. These vulnerabilities can expose sensitive data and allow attackers to manipulate the execution flow of applications using PHP, potentially leading to severe security breaches.
How To Fix
Minimum fixed version
8.0.30-5.el9_7
This is the first release that contains the fix.
sudo dnf update phpTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, consider disabling the affected functions or limiting their usage until the update can be applied. However, the best course of action is to update to the patched version as soon as possible.
Conclusion
In summary, the recent PHP security update addresses critical vulnerabilities that could lead to severe security risks. It is crucial for developers and system administrators to update their PHP installations to the latest patched version to safeguard their applications from potential exploits.
See every vulnerability recorded for php →
FAQ
A heap-based buffer overflow occurs when a program writes more data to a buffer located on the heap than it can hold, potentially overwriting adjacent memory and leading to unpredictable behavior.
You can check your PHP version by running 'php -v' in the terminal. If your version is below 8.0.30-5.el9_7, it is vulnerable.
Failing to update PHP can leave your applications exposed to attacks that exploit these vulnerabilities, leading to data breaches, unauthorized access, and potential loss of sensitive information.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Related vulnerabilities
Recent vulnerabilities recorded for php.
