CVE-2023-0568
16.02.2023, 07:15
In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, core path resolution function allocate buffer one byte too small. When resolving paths with lengths close to system MAXPATHLEN setting, this may lead to the byte after the allocated buffer being overwritten with NUL value, which might lead to unauthorized data access or modification.Enginsight
| Vendor | Product | Version |
|---|---|---|
| php | php | 8.0.0 ≤ 𝑥 < 8.0.28 |
| php | php | 8.1.0 ≤ 𝑥 < 8.1.16 |
| php | php | 8.2.0 ≤ 𝑥 < 8.2.3 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
Ubuntu Product | |||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| php5 |
| ||||||||||||||||||||
| php7.0 |
| ||||||||||||||||||||
| php7.2 |
| ||||||||||||||||||||
| php7.4 |
| ||||||||||||||||||||
| php8.1 |
|
Common Weakness Enumeration
- CWE-131 - Incorrect Calculation of Buffer SizeThe software does not correctly calculate the size to be used when allocating a buffer, which could lead to a buffer overflow.
- CWE-770 - Allocation of Resources Without Limits or ThrottlingThe software allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.