Heap-buffer-overflow in zim_ReflectionEnumBackedCase_getBackingValue in php
Summary
OSV-2022-573: Heap-buffer-overflow in zim_ReflectionEnumBackedCase_getBackingValue. Affects php versions >= ddc0b490f76b469591f851ccbce56c20ef93f333. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PHP is a popular open-source programming language widely used for web development. It provides a powerful and flexible platform for building dynamic websites and applications. This vulnerability affects the PHP package and is related to a heap-buffer-overflow in the function zim_ReflectionEnumBackedCase_getBackingValue.
Vulnerability Detail
The vulnerability is a heap-buffer-overflow read of 4 bytes. It was reported through the OSS-Fuzz project and can lead to a crash in the zim_ReflectionEnumBackedCase_getBackingValue function. The exact cause and impact of the vulnerability are not provided in the report. However, heap-buffer-overflow vulnerabilities can potentially be exploited by attackers to execute arbitrary code or cause a denial-of-service condition.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
No specific workaround is mentioned in the report.
Conclusion
In conclusion, the PHP package is affected by a heap-buffer-overflow vulnerability in the zim_ReflectionEnumBackedCase_getBackingValue function. It is recommended to update the package to a version that includes the fix to mitigate the vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for php →
FAQ
PHP is a popular open-source programming language used for web development.
A heap-buffer-overflow vulnerability occurs when a program writes data beyond the bounds of a buffer allocated in the heap, potentially leading to memory corruption and security issues.
This vulnerability was discovered through the OSS-Fuzz project, which performs continuous fuzz testing on open-source software.
The exact consequences of this vulnerability are not provided in the report. However, heap-buffer-overflow vulnerabilities can potentially be exploited by attackers to execute arbitrary code or cause a denial-of-service condition.
To fix this vulnerability, update the PHP package to a version that includes the fix. The fix was introduced in commit ddc0b490f76b469591f851ccbce56c20ef93f333 in the PHP source code repository.
References
Related vulnerabilities
Recent vulnerabilities recorded for php.
