Heap-use-after-free in i_zval_ptr_dtor in PHP
Summary
OSV-2021-1199: Heap-use-after-free in i_zval_ptr_dtor. Affects php versions >= 1902f730ee2bda60552f34c0643e2d7b47e4fb64, < 24ff7eee3f04070d8ab1b31f57d17f0c840185bf. Fixed in 24ff7eee3f04070d8ab1b31f57d17f0c840185bf. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
PHP is a popular general-purpose scripting language widely used for web development. It is known for its flexibility, ease of use, and extensive library support. The vulnerability in question affects the PHP package and is related to a heap-use-after-free issue in the i_zval_ptr_dtor function.
Vulnerability Detail
The vulnerability arises due to a heap-use-after-free condition in the i_zval_ptr_dtor function. This can lead to a crash, specifically a heap-use-after-free read, when certain operations are performed. The vulnerability has been reported and tracked in the OSS-Fuzz project, with more details available in the provided link. The severity of this vulnerability is classified as HIGH.
How To Fix
Minimum fixed version
24ff7eee3f04070d8ab1b31f57d17f0c840185bf
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
At present, no specific workaround has been provided for this vulnerability. It is advised to follow the recommended fix and update the PHP package to a patched version.
Conclusion
In conclusion, the PHP package is affected by a heap-use-after-free vulnerability in the i_zval_ptr_dtor function. It is crucial to update the PHP package to a version that includes the fix to mitigate the vulnerability. For further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for php →
FAQ
PHP is a popular scripting language used for web development, known for its flexibility and extensive library support.
A heap-use-after-free vulnerability occurs when a program attempts to access memory that has already been freed. This can lead to crashes or potentially exploitable behavior.
OSS-Fuzz is an open-source fuzzing project by Google that aims to find vulnerabilities in open-source software through automated testing.
The severity of this vulnerability is classified as HIGH.
More information about this vulnerability can be found in the provided OSS-Fuzz report link.
References
Related vulnerabilities
Recent vulnerabilities recorded for php.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
