Critical Integer Overflow Vulnerability in PHP Packages: CVE-2024-11236
Summary
UBUNTU-CVE-2024-11236: In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, uncontrolled long string inputs to ldap_escape() function on 32-bit systems can cause an integer overflow, resulting in an out-of-bounds writ... Affects php5 versions 5.5.3+dfsg-1ubuntu2 – 5.5.9+dfsg-1ubuntu4.9. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PHP is a widely-used open-source scripting language designed for web development but also used as a general-purpose programming language. It is known for its ease of use and flexibility, allowing developers to create dynamic web pages efficiently. The affected packages include various versions of PHP (5, 7.0, 7.2, 7.4, 8.1, 8.3) that are integral to running web applications. This vulnerability exposes these packages to potential exploitation due to uncontrolled long string inputs in the ldap_escape() function, particularly on 32-bit systems.
Vulnerability Detail
In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, and 8.3.* before 8.3.14, an integer overflow can occur when the ldap_escape() function receives uncontrolled long string inputs. This flaw can lead to an out-of-bounds write, allowing attackers to manipulate memory, potentially leading to arbitrary code execution or denial of service. The vulnerability has a CVSS score of 9.8, indicating a critical severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, consider limiting the input length to the ldap_escape() function to prevent potential exploitation until the packages can be updated. This can be done by validating and sanitizing user inputs before processing them.
Conclusion
The CVE-2024-11236 vulnerability poses a significant risk to various PHP packages due to an integer overflow issue in the ldap_escape() function. It is essential to update to the patched versions to safeguard applications from potential exploitation. Utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for php5 →
FAQ
CVE-2024-11236 is a critical vulnerability in PHP that allows for integer overflow in the ldap_escape() function, potentially leading to memory manipulation.
You can use Vulert, which monitors open-source vulnerabilities in your software. By uploading your manifest file, you can check for vulnerabilities without needing to install any software.
Exploitation of this vulnerability can lead to arbitrary code execution, memory corruption, or denial of service, severely impacting the security and functionality of affected applications.
Yes, patches are available for the affected PHP versions. It is crucial to update to the latest versions to mitigate the risk.
Regularly update your software packages, monitor for vulnerabilities using tools like Vulert, and implement input validation and sanitization practices.
Related vulnerabilities
Recent vulnerabilities recorded for php5.
