Buffer Overread Vulnerability in PHP Packages - CVE-2024-11233
Summary
UBUNTU-CVE-2024-11233: In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, due to an error in convert.quoted-printable-decode filter certain data can lead to buffer overread by one byte, which can in certain circumst... Affects php5 versions 5.5.3+dfsg-1ubuntu2 – 5.5.9+dfsg-1ubuntu4.9. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PHP is a widely-used open-source scripting language especially suited for web development. It allows developers to create dynamic web pages and applications. The affected packages include various versions of PHP (5.5, 7.0, 7.2, 7.4, 8.1, 8.3) that are integral to running web applications. This vulnerability arises from an error in the 'convert.quoted-printable-decode' filter, which can lead to security issues.
Vulnerability Detail
In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, and 8.3.* before 8.3.14, a flaw in the 'convert.quoted-printable-decode' filter can cause a buffer overread by one byte. This can potentially lead to application crashes or the disclosure of sensitive information from other memory areas, posing a significant risk to applications relying on these PHP versions.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate updating is not feasible, consider disabling the 'convert.quoted-printable-decode' filter in your application until a patch can be applied. This can be done by avoiding the use of this filter in your code where possible.
Conclusion
The CVE-2024-11233 vulnerability poses a significant risk to various PHP versions, allowing for potential buffer overreads. It is crucial to update to the patched versions to safeguard your applications. For real-time monitoring of vulnerabilities, consider using Vulert, which can alert you to issues without requiring code access.
See every vulnerability recorded for php5 →
FAQ
CVE-2024-11233 is a vulnerability in certain PHP versions that can lead to buffer overreads, potentially exposing sensitive data.
The affected versions include PHP 8.1.* before 8.1.31, 8.2.* before 8.2.26, and 8.3.* before 8.3.14.
You can use Vulert, which monitors open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without needing to sign up.
Exploiting this vulnerability can lead to application crashes or unauthorized access to sensitive information stored in memory.
Yes, you can temporarily disable the 'convert.quoted-printable-decode' filter in your application until you can apply the necessary updates.
Related vulnerabilities
Recent vulnerabilities recorded for php5.
