CVE-2024-8929: Leak partial content of the heap through heap buffer over-read in mysqlnd
Fixed bug (Leak partial content of the heap through heap buffer over-read). (CVE-2024-8929)
Other sources
In PHP versions 8.1. before 8.1.31, 8.2. before 8.2.26, 8.3. before 8.3.14, a hostile MySQL server can cause the client to disclose the content of its heap containing data from other SQL requests and possible other data belonging to different users of the same server.
— NVD
Leak partial content of the heap through heap buffer over-read in mysqlnd
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PHPto a version that resolves this vulnerability.Fixed in 8.1.31 - Upgrade
Upgrade
debian/php8.2to a version that resolves this vulnerability.Fixed in 8.2.32-1~deb12u1Fixed in 8.2.35-1~deb12u1 - Upgrade
Upgrade
debian/php8.2to a version that resolves this vulnerability.Fixed in 8.2.26-1~deb12u1 - Upgrade
Upgrade
alpine/php81to a version that resolves this vulnerability.Fixed in 8.1.31-r0 - Upgrade
Upgrade
alpine/php83to a version that resolves this vulnerability.Fixed in 8.3.14-r0 - Upgrade
Upgrade
PHPto a version that resolves this vulnerability.Fixed in 8.2.26 - Upgrade
Upgrade
PHPto a version that resolves this vulnerability.Fixed in 8.3.14
Event History
Frequently Asked Questions
What is the severity of CVE-2024-8929?
CVE-2024-8929 has a high severity level due to its potential to leak sensitive information from the heap.
How do I fix CVE-2024-8929?
To fix CVE-2024-8929, upgrade PHP to version 8.1.31 or later, 8.2.26 or later, or to 8.3.14 or later.
What versions of PHP are affected by CVE-2024-8929?
PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, and 8.3.* before 8.3.14 are affected by CVE-2024-8929.
What types of attacks are possible with CVE-2024-8929?
CVE-2024-8929 allows attackers with access to a hostile MySQL server to exploit heap buffer over-read vulnerabilities.
Is CVE-2024-8929 a client-side or server-side vulnerability?
CVE-2024-8929 is considered a client-side vulnerability as it affects the PHP client when interacting with a malicious MySQL server.