CVE-2023-0568: Array overrun in common path resolve code

Q: What is CVE-2023-0568?

CVE-2023-0568 is a vulnerability in PHP that caused a 1-byte array overrun in common path resolve code.

Q: How severe is CVE-2023-0568?

CVE-2023-0568 has a severity rating of <severity rating>.

Published Feb 14, 2023

Updated

Fixed bug (1-byte array overrun in common path resolve code). (CVE-2023-0568)

Other sources

In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, core path resolution function allocate buffer one byte too small. When resolving paths with lengths close to system MAXPATHLEN setting, this may lead to the byte after the allocated buffer being overwritten with NUL value, which might lead to unauthorized data access or modification.

— Launchpad

Affected Software

21 affected componentsFixes available

PHP PHP>=8.0.0<8.0.28

PHP PHP>=8.1.0<8.1.16

PHP PHP>=8.2.0<8.2.3

PHP PHP<8.2.3

8.2.3

F5 BIG-IP=17.5.0, >=17.1.0<=17.1.2

17.5.117.1.3

F5 BIG-IP>=16.1.0<=16.1.6

F5 BIG-IP>=15.1.0<=15.1.10

F5 BIG-IP>=14.1.0<=14.1.5

F5 BIG-IP>=13.1.0<=13.1.5

debian/php8.2

8.2.32-1~deb12u18.2.35-1~deb12u1

alpine/php7<7.4.33-r1

7.4.33-r1

alpine/php8<8.0.28-r0

8.0.28-r0

alpine/php81<8.1.17-r0

8.1.17-r0

alpine/php81<8.1.16-r0

8.1.16-r0

alpine/php81<8.1.16-r0

8.1.16-r0

alpine/php81<8.1.16-r0

8.1.16-r0

alpine/php82<8.2.3-r0

8.2.3-r0

alpine/php82<8.2.3-r0

8.2.3-r0

alpine/php82<8.2.3-r0

8.2.3-r0

alpine/php82<8.2.3-r0

8.2.3-r0

alpine/php82<8.2.3-r0

8.2.3-r0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade PHP to a version that resolves this vulnerability.
Fixed in 8.2.3
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 17.5.117.1.3
Upgrade
Upgrade debian/php8.2 to a version that resolves this vulnerability.
Fixed in 8.2.32-1~deb12u1Fixed in 8.2.35-1~deb12u1
Upgrade
Upgrade alpine/php7 to a version that resolves this vulnerability.
Fixed in 7.4.33-r1
Upgrade
Upgrade alpine/php8 to a version that resolves this vulnerability.
Fixed in 8.0.28-r0
Upgrade
Upgrade alpine/php81 to a version that resolves this vulnerability.
Fixed in 8.1.17-r0
Upgrade
Upgrade alpine/php81 to a version that resolves this vulnerability.
Fixed in 8.1.16-r0
Upgrade
Upgrade alpine/php82 to a version that resolves this vulnerability.
Fixed in 8.2.3-r0
Upgrade
Upgrade PHP to a version that resolves this vulnerability.
Fixed in 8.0.28
Upgrade
Upgrade PHP to a version that resolves this vulnerability.
Fixed in 8.1.16

Event History

Feb 14, 2023

CVE Published

via PHP·12:00 AM

Feb 16, 2023

CVE Published

via MITRE·06:34 AM

Data Sourced

via MITRE·06:34 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:15 AM

RemedyDescriptionSeverityWeaknessAffected Software

Data Sourced

via OSV·07:15 AM

DescriptionSeverityAffected Software

Feb 17, 2023

Data Sourced

via Red Hat·08:31 AM

DescriptionSeverityAffected Software

May 23, 2023

Advisory Published

via F5·06:48 PM

Data Sourced

via F5·06:48 PM

DescriptionSeverityWeaknessAffected Software

Parent advisories

This vulnerability appears in the following advisories.

DSA-5363

Peer vulnerabilities

Found alongside the following vulnerabilities.

DLA-3345-1

Frequently Asked Questions

What is CVE-2023-0568?

CVE-2023-0568 is a vulnerability in PHP that caused a 1-byte array overrun in common path resolve code.

How severe is CVE-2023-0568?

CVE-2023-0568 has a severity rating of <severity rating>.

How can I fix CVE-2023-0568?

To fix CVE-2023-0568, you need to update your PHP installation to version 8.2.3 or later.

Is there a reference to learn more about CVE-2023-0568?

Yes, you can find more information about CVE-2023-0568 in the PHP ChangeLog for version 8.2.3.

CVE-2023-0568: Array overrun in common path resolve code

Other sources

Affected Software

Remediation

Event History

Parent advisories

Peer vulnerabilities

Frequently Asked Questions

What is CVE-2023-0568?

How severe is CVE-2023-0568?

How can I fix CVE-2023-0568?

Is there a reference to learn more about CVE-2023-0568?

Company

Resources

Contact