Dynamic-stack-buffer-overflow in zend_calc_live_ranges in PHP
Summary
OSV-2021-1670: Dynamic-stack-buffer-overflow in zend_calc_live_ranges. Affects php across 2 version ranges.
>= 9c6b843ff0f4b7af926a69ef89d7f9ec1db31866, < 91734fc5795bc07dc718f9d884a014a90097e56f
>= efb901ebedf941039241c6194c452f8a16d807aa
Fixed in 91734fc5795bc07dc718f9d884a014a90097e56f. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PHP is a popular open-source programming language widely used for web development. It provides a powerful and flexible platform for building dynamic websites and applications. The vulnerability in question, identified as OSV-2021-1670, affects the PHP package. This vulnerability is related to a dynamic-stack-buffer-overflow in the zend_calc_live_ranges function. The function is part of the PHP compiler and is responsible for calculating live ranges during the compilation process. The vulnerability can potentially lead to a crash due to a read overflow of 4 bytes.
Vulnerability Detail
The vulnerability occurs in the zend_calc_live_ranges function during the pass_two phase of the compilation process in PHP. It is triggered by a dynamic-stack-buffer-overflow, specifically a read overflow of 4 bytes. An attacker could potentially exploit this vulnerability to cause a crash or execute arbitrary code. The vulnerability was reported through the OSS-Fuzz project, and more details can be found in the provided link. The severity of the vulnerability is not specified in the available information.
How To Fix
Minimum fixed version
91734fc5795bc07dc718f9d884a014a90097e56f
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No specific workaround is mentioned in the available information. It is recommended to apply the fix by updating the PHP package to a version that includes the necessary patch.
Conclusion
In conclusion, the vulnerability OSV-2021-1670 in PHP is related to a dynamic-stack-buffer-overflow in the zend_calc_live_ranges function. It can potentially lead to a crash or arbitrary code execution. To mitigate this vulnerability, it is advised to update the PHP package to a version that includes the necessary fix. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for php →
FAQ
PHP is a popular open-source programming language used for web development. It provides a powerful and flexible platform for building dynamic websites and applications.
zend_calc_live_ranges is a function in the PHP compiler that is responsible for calculating live ranges during the compilation process.
A dynamic-stack-buffer-overflow is a type of buffer overflow vulnerability that occurs when a program writes data beyond the bounds of a dynamically allocated stack buffer.
An attacker could potentially exploit this vulnerability to cause a crash or execute arbitrary code.
Yes, a fix for this vulnerability is available. It is recommended to update the PHP package to a version that includes the fix.
References
Related vulnerabilities
Recent vulnerabilities recorded for php.
