CVE-2024-8926
EUVD-2024-4948908.10.2024, 04:15
In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using a certain non-standard configurations of Windows codepages, the fixes for CVE-2024-4577 https://github.com/advisories/GHSA-vxpp-6299-mxw3 may still be bypassed and the same command injection related to Windows "Best Fit" codepage behavior can be achieved. This may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| php | php | 8.1.30 < 𝑥 < 8.1.30 |
| php | php | 8.2.24 < 𝑥 < 8.2.24 |
| php | php | 8.3.12 < 𝑥 < 8.3.12 |
| php | php | 8.1.0 ≤ 𝑥 < 8.1.30 |
| php | php | 8.2.0 ≤ 𝑥 < 8.2.24 |
| php | php | 8.3.0 ≤ 𝑥 < 8.3.12 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases