CVE-2022-31627

In PHP versions 8.1.x below 8.1.8, when fileinfo functions, such as finfo_buffer, due to incorrect patch applied to the third party code from libmagic, incorrect function may be used to free allocated memory, which may lead to heap corruption.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.7 HIGH
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
Base Score
CVSS 3.x
EPSS Score
Percentile: 74%
Affected Products (NVD)
VendorProductVersion
phpphp
8.1.0 ≤
𝑥
< 8.1.8
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
php7.4
bullseye
7.4.33-1+deb11u5
fixed
bullseye (security)
7.4.33-1+deb11u6
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
php5
bionic
dne
focal
dne
impish
dne
jammy
dne
kinetic
dne
trusty
not-affected
xenial
dne
php7.0
bionic
dne
focal
dne
impish
dne
jammy
dne
kinetic
dne
trusty
dne
xenial
not-affected
php7.2
bionic
not-affected
focal
dne
impish
dne
jammy
dne
kinetic
dne
trusty
dne
xenial
dne
php7.4
bionic
dne
focal
not-affected
impish
dne
jammy
dne
kinetic
dne
trusty
dne
xenial
dne
php8.0
bionic
dne
focal
dne
impish
not-affected
jammy
dne
kinetic
dne
trusty
dne
xenial
dne
php8.1
bionic
dne
focal
dne
impish
dne
jammy
Fixed 8.1.2-1ubuntu2.2
released
kinetic
Fixed 8.1.5-1ubuntu3
released
trusty
dne
xenial
dne
Amazon Linux logo
Amazon Linux Releases
Amazon Package
Release
php8.1
Amazon Linux 2023
0:8.1.14-1.amzn2023.0.2
fixed
php8.1-bcmath
Amazon Linux 2023
0:8.1.14-1.amzn2023.0.2
fixed
php8.1-bcmath-debuginfo
Amazon Linux 2023
0:8.1.14-1.amzn2023.0.2
fixed
php8.1-cli
Amazon Linux 2023
0:8.1.14-1.amzn2023.0.2
fixed
php8.1-cli-debuginfo
Amazon Linux 2023
0:8.1.14-1.amzn2023.0.2
fixed
php8.1-common
Amazon Linux 2023
0:8.1.14-1.amzn2023.0.2
fixed
php8.1-common-debuginfo
Amazon Linux 2023
0:8.1.14-1.amzn2023.0.2
fixed
php8.1-dba
Amazon Linux 2023
0:8.1.14-1.amzn2023.0.2
fixed
php8.1-dba-debuginfo
Amazon Linux 2023
0:8.1.14-1.amzn2023.0.2
fixed
php8.1-dbg
Amazon Linux 2023
0:8.1.14-1.amzn2023.0.2
fixed
php8.1-dbg-debuginfo
Amazon Linux 2023
0:8.1.14-1.amzn2023.0.2
fixed
php8.1-debuginfo
Amazon Linux 2023
0:8.1.14-1.amzn2023.0.2
fixed
php8.1-debugsource
Amazon Linux 2023
0:8.1.14-1.amzn2023.0.2
fixed
php8.1-devel
Amazon Linux 2023
0:8.1.14-1.amzn2023.0.2
fixed
php8.1-embedded
Amazon Linux 2023
0:8.1.14-1.amzn2023.0.2
fixed
php8.1-embedded-debuginfo
Amazon Linux 2023
0:8.1.14-1.amzn2023.0.2
fixed
php8.1-enchant
Amazon Linux 2023
0:8.1.14-1.amzn2023.0.2
fixed
php8.1-enchant-debuginfo
Amazon Linux 2023
0:8.1.14-1.amzn2023.0.2
fixed
php8.1-ffi
Amazon Linux 2023
0:8.1.14-1.amzn2023.0.2
fixed
php8.1-ffi-debuginfo
Amazon Linux 2023
0:8.1.14-1.amzn2023.0.2
fixed
php8.1-fpm
Amazon Linux 2023
0:8.1.14-1.amzn2023.0.2
fixed
php8.1-fpm-debuginfo
Amazon Linux 2023
0:8.1.14-1.amzn2023.0.2
fixed
php8.1-gd
Amazon Linux 2023
0:8.1.14-1.amzn2023.0.2
fixed
php8.1-gd-debuginfo
Amazon Linux 2023
0:8.1.14-1.amzn2023.0.2
fixed
php8.1-gmp
Amazon Linux 2023
0:8.1.14-1.amzn2023.0.2
fixed
php8.1-gmp-debuginfo
Amazon Linux 2023
0:8.1.14-1.amzn2023.0.2
fixed
php8.1-intl
Amazon Linux 2023
0:8.1.14-1.amzn2023.0.2
fixed
php8.1-intl-debuginfo
Amazon Linux 2023
0:8.1.14-1.amzn2023.0.2
fixed
php8.1-ldap
Amazon Linux 2023
0:8.1.14-1.amzn2023.0.2
fixed
php8.1-ldap-debuginfo
Amazon Linux 2023
0:8.1.14-1.amzn2023.0.2
fixed
php8.1-mbstring
Amazon Linux 2023
0:8.1.14-1.amzn2023.0.2
fixed
php8.1-mbstring-debuginfo
Amazon Linux 2023
0:8.1.14-1.amzn2023.0.2
fixed
php8.1-mysqlnd
Amazon Linux 2023
0:8.1.14-1.amzn2023.0.2
fixed
php8.1-mysqlnd-debuginfo
Amazon Linux 2023
0:8.1.14-1.amzn2023.0.2
fixed
php8.1-odbc
Amazon Linux 2023
0:8.1.14-1.amzn2023.0.2
fixed
php8.1-odbc-debuginfo
Amazon Linux 2023
0:8.1.14-1.amzn2023.0.2
fixed
php8.1-opcache
Amazon Linux 2023
0:8.1.14-1.amzn2023.0.2
fixed
php8.1-opcache-debuginfo
Amazon Linux 2023
0:8.1.14-1.amzn2023.0.2
fixed
php8.1-pdo
Amazon Linux 2023
0:8.1.14-1.amzn2023.0.2
fixed
php8.1-pdo-debuginfo
Amazon Linux 2023
0:8.1.14-1.amzn2023.0.2
fixed
php8.1-pgsql
Amazon Linux 2023
0:8.1.14-1.amzn2023.0.2
fixed
php8.1-pgsql-debuginfo
Amazon Linux 2023
0:8.1.14-1.amzn2023.0.2
fixed
php8.1-process
Amazon Linux 2023
0:8.1.14-1.amzn2023.0.2
fixed
php8.1-process-debuginfo
Amazon Linux 2023
0:8.1.14-1.amzn2023.0.2
fixed
php8.1-soap
Amazon Linux 2023
0:8.1.14-1.amzn2023.0.2
fixed
php8.1-soap-debuginfo
Amazon Linux 2023
0:8.1.14-1.amzn2023.0.2
fixed
php8.1-tidy
Amazon Linux 2023
0:8.1.14-1.amzn2023.0.2
fixed
php8.1-tidy-debuginfo
Amazon Linux 2023
0:8.1.14-1.amzn2023.0.2
fixed
php8.1-xml
Amazon Linux 2023
0:8.1.14-1.amzn2023.0.2
fixed
php8.1-xml-debuginfo
Amazon Linux 2023
0:8.1.14-1.amzn2023.0.2
fixed
Azure Linux logo
Azure Linux Releases
Azure Package
Release
php
Azure Linux 3.0
0:8.3.8-1.azl3
fixed
Common Weakness Enumeration
References
https://bugs.php.net/bug.php?id=81723
https://security.gentoo.org/glsa/202209-20
https://security.netapp.com/advisory/ntap-20220826-0008/
https://bugs.php.net/bug.php?id=81723
https://security.gentoo.org/glsa/202209-20
https://security.netapp.com/advisory/ntap-20220826-0008/