CVE-2024-8929

In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, a hostile MySQL server can cause the client to disclose the content of its heap containing data from other SQL requests and possible other data belonging to different users of the same server.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
5.8 MEDIUM
ADJACENT_NETWORK
HIGH
LOW
CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
phpCNA
5.8 MEDIUM
ADJACENT_NETWORK
HIGH
LOW
CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
CISA-ADPADP
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 11%
VendorProductVersion
phpphp
8.1.0 ≤
𝑥
< 8.1.31
phpphp
8.2.0 ≤
𝑥
< 8.2.26
phpphp
8.3.0 ≤
𝑥
< 8.3.14
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
php7.4
bullseye
vulnerable
bullseye (security)
7.4.33-1+deb11u8
fixed
php8.2
bookworm
8.2.28-1~deb12u1
fixed
bookworm (security)
8.2.28-1~deb12u1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
php5
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
dne
trusty
needs-triage
php7.0
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
dne
xenial
Fixed 7.0.33-0ubuntu0.16.04.16+esm14
released
php7.2
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
dne
bionic
needs-triage
php7.4
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
Fixed 7.4.3-4ubuntu2.26
released
php8.1
plucky
dne
oracular
dne
noble
dne
jammy
Fixed 8.1.2-1ubuntu2.20
released
focal
dne
php8.3
plucky
dne
oracular
Fixed 8.3.11-0ubuntu0.24.10.4
released
noble
Fixed 8.3.6-0ubuntu0.24.04.3
released
jammy
dne
focal
dne
Common Weakness Enumeration
References
https://github.com/php/php-src/security/advisories/GHSA-h35g-vwh6-m678
https://security.netapp.com/advisory/ntap-20250110-0008/