CVE-2024-8929

EUVD-2024-49638
In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, a hostile MySQL server can cause the client to disclose the content of its heap containing data from other SQL requests and possible other data belonging to different users of the same server.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.8 MEDIUM
ADJACENT_NETWORK
HIGH
LOW
CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
phpCNA
5.8 MEDIUM
ADJACENT_NETWORK
HIGH
LOW
CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 71%
Affected Products (NVD)
VendorProductVersion
phpphp
8.1.0 ≤
𝑥
< 8.1.31
phpphp
8.2.0 ≤
𝑥
< 8.2.26
phpphp
8.3.0 ≤
𝑥
< 8.3.14
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
php7.4
bullseye
vulnerable
bullseye (security)
7.4.33-1+deb11u9
fixed
php8.2
bookworm
8.2.29-1~deb12u1
fixed
bookworm (security)
8.2.29-1~deb12u1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
php5
focal
dne
jammy
dne
noble
dne
oracular
dne
plucky
dne
questing
dne
trusty
needs-triage
php7.0
focal
dne
jammy
dne
noble
dne
oracular
dne
plucky
dne
questing
dne
xenial
Fixed 7.0.33-0ubuntu0.16.04.16+esm14
released
php7.2
bionic
needs-triage
focal
dne
jammy
dne
noble
dne
oracular
dne
plucky
dne
questing
dne
php7.4
focal
Fixed 7.4.3-4ubuntu2.26
released
jammy
dne
noble
dne
oracular
dne
plucky
dne
questing
dne
php8.1
focal
dne
jammy
Fixed 8.1.2-1ubuntu2.20
released
noble
dne
oracular
dne
plucky
dne
questing
dne
php8.3
focal
dne
jammy
dne
noble
Fixed 8.3.6-0ubuntu0.24.04.3
released
oracular
Fixed 8.3.11-0ubuntu0.24.10.4
released
plucky
dne
questing
dne
Common Weakness Enumeration
References
https://github.com/php/php-src/security/advisories/GHSA-h35g-vwh6-m678
https://lists.debian.org/debian-lts-announce/2024/12/msg00007.html
https://security.netapp.com/advisory/ntap-20250110-0008/