Critical Use-After-Free Vulnerability in PHP Packages: CVE-2024-11235
Summary
UBUNTU-CVE-2024-11235: In PHP versions 8.3.* before 8.3.19 and 8.4.* before 8.4.5, a code sequence involving __set handler or ??= operator and exceptions can lead to a use-after-free vulnerability. Affects php5 versions 5.5.3+dfsg-1ubuntu2 – 5.5.9+dfsg-1ubuntu4.9. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PHP is a widely-used open-source scripting language designed for web development but also used as a general-purpose programming language. It is known for its ease of use, flexibility, and extensive community support. The affected packages include various versions of PHP, specifically 5.5, 7.2, 7.4, 8.1, 8.3, and 8.4, which are integral for running dynamic web applications. This vulnerability exposes these packages to potential remote code execution, making it critical for users to address it promptly.
Vulnerability Detail
In PHP versions 8.3.* before 8.3.19 and 8.4.* before 8.4.5, a code sequence involving the __set handler or the ??= operator and exceptions can lead to a use-after-free vulnerability. This flaw allows attackers to control the memory layout by supplying specially crafted inputs to the script, potentially leading to remote code execution. The CVSS score for this vulnerability is 8.1, indicating a high severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate patching is not feasible, consider disabling the affected PHP features or restricting input validation to mitigate the risk until an update can be applied.
Conclusion
The CVE-2024-11235 vulnerability poses a significant risk to various PHP packages, allowing for potential remote code execution. It is crucial for users to update their PHP installations to the latest patched versions to mitigate this risk. Regular monitoring and vulnerability management practices, such as using tools like Vulert, can help maintain application security.
See every vulnerability recorded for php5 →
FAQ
CVE-2024-11235 is a critical vulnerability in multiple PHP versions that can lead to remote code execution due to a use-after-free issue.
The affected versions include PHP 5.5, 7.2, 7.4, 8.1, 8.3, and 8.4.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If exploited, this vulnerability could allow attackers to execute arbitrary code on the server, leading to data breaches or service disruptions.
The best protection is to update to the patched versions of the affected PHP packages as soon as possible.
Related vulnerabilities
Recent vulnerabilities recorded for php5.
