CVE-2024-11236: Integer overflow in the firebird and dblib quoters causing OOB writes

Q: What is the severity of CVE-2024-11236?

CVE-2024-11236 has a high severity due to integer overflow issues leading to potential out-of-bounds writes and impact on application stability.

Q: How do I fix CVE-2024-11236?

To fix CVE-2024-11236, upgrade PHP to versions 8.1.31, 8.2.26 or later, and 8.3.14 or later.

Q: Which versions of PHP are affected by CVE-2024-11236?

CVE-2024-11236 affects PHP versions 8.1.0 through 8.1.30, 8.2.0 through 8.2.25, and 8.3.0 through 8.3.13.

Q: Is CVE-2024-11236 a critical vulnerability?

CVE-2024-11236 is considered critical because it can allow attackers to exploit the vulnerability through uncontrolled input.

Q: What are the potential consequences of not addressing CVE-2024-11236?

Failing to address CVE-2024-11236 can lead to severe security risks, including application crashes and unauthorized access.

Published Nov 21, 2024

Updated

Fixed bug (Integer overflow in the dblib quoter causing OOB writes). (CVE-2024-11236)

Other sources

In PHP versions 8.1. before 8.1.31, 8.2. before 8.2.26, 8.3. before 8.3.14, uncontrolled long string inputs to ldapescape() function on 32-bit systems can cause an integer overflow, resulting in an out-of-bounds write.

— NVD

Integer overflow in the firebird and dblib quoters causing OOB writes

— Microsoft

Affected Software

16 affected componentsFixes available

PHP PHP<8.1.31

8.1.31

PHP PHP>=8.1.0<8.1.31

PHP PHP>=8.2.0<8.2.26

PHP PHP>=8.3.0<8.3.14

Microsoft azl3 php 8.3.14-1<8.3.14-1

8.3.14-1

Microsoft cbl2 php 8.1.31-1<8.1.31-1

8.1.31-1

Microsoft cbl2 php 8.1.30-1<8.1.31-1

8.1.31-1

Microsoft azl3 php 8.3.12-1<8.3.14-1

8.3.14-1

debian/php8.2<8.2.26-1~deb12u1

8.2.26-1~deb12u1

debian/php8.2

8.2.32-1~deb12u18.2.35-1~deb12u1

alpine/php81<8.1.31-r0

8.1.31-r0

alpine/php83<8.3.14-r0

8.3.14-r0

alpine/php83<8.3.14-r0

8.3.14-r0

alpine/php83<8.3.14-r0

8.3.14-r0

alpine/php83<8.3.14-r0

8.3.14-r0

alpine/php83<8.3.14-r0

8.3.14-r0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade PHP to a version that resolves this vulnerability.
Fixed in 8.1.31
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.3.14-1
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.1.31-1
Upgrade
Upgrade debian/php8.2 to a version that resolves this vulnerability.
Fixed in 8.2.26-1~deb12u1
Upgrade
Upgrade debian/php8.2 to a version that resolves this vulnerability.
Fixed in 8.2.32-1~deb12u1Fixed in 8.2.35-1~deb12u1
Upgrade
Upgrade alpine/php81 to a version that resolves this vulnerability.
Fixed in 8.1.31-r0
Upgrade
Upgrade alpine/php83 to a version that resolves this vulnerability.
Fixed in 8.3.14-r0
Upgrade
Upgrade PHP to a version that resolves this vulnerability.
Fixed in 8.2.26
Upgrade
Upgrade PHP to a version that resolves this vulnerability.
Fixed in 8.3.14

Event History

Nov 21, 2024

CVE Published

via PHP·12:00 AM

Nov 24, 2024

CVE Published

via MITRE·12:44 AM

Data Sourced

via MITRE·12:44 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·01:15 AM

DescriptionSeverityWeaknessAffected Software

Data Sourced

via OSV·01:15 AM

DescriptionSeverityAffected Software

Dec 9, 2024

Data Sourced

via Microsoft·08:00 AM

DescriptionSeverityWeaknessAffected Software

Parent advisories

This vulnerability appears in the following advisories.

DSA-5819

Peer vulnerabilities

Found alongside the following vulnerabilities.

DLA-3986-1

Frequently Asked Questions

What is the severity of CVE-2024-11236?

CVE-2024-11236 has a high severity due to integer overflow issues leading to potential out-of-bounds writes and impact on application stability.

How do I fix CVE-2024-11236?

To fix CVE-2024-11236, upgrade PHP to versions 8.1.31, 8.2.26 or later, and 8.3.14 or later.

Which versions of PHP are affected by CVE-2024-11236?

CVE-2024-11236 affects PHP versions 8.1.0 through 8.1.30, 8.2.0 through 8.2.25, and 8.3.0 through 8.3.13.

Is CVE-2024-11236 a critical vulnerability?

CVE-2024-11236 is considered critical because it can allow attackers to exploit the vulnerability through uncontrolled input.

What are the potential consequences of not addressing CVE-2024-11236?

Failing to address CVE-2024-11236 can lead to severe security risks, including application crashes and unauthorized access.

CVE-2024-11236: Integer overflow in the firebird and dblib quoters causing OOB writes

Other sources

Affected Software

Remediation

Event History

Parent advisories

Peer vulnerabilities

Frequently Asked Questions

What is the severity of CVE-2024-11236?

How do I fix CVE-2024-11236?

Which versions of PHP are affected by CVE-2024-11236?

Is CVE-2024-11236 a critical vulnerability?

What are the potential consequences of not addressing CVE-2024-11236?

Company

Resources

Contact