CVE-2024-8932: OOB access in ldap_escape
Fixed bug (OOB access in ldapescape). (CVE-2024-8932)
Other sources
In PHP versions 8.1. before 8.1.31, 8.2. before 8.2.26, 8.3. before 8.3.14, uncontrolled long string inputs to ldapescape() function on 32-bit systems can cause an integer overflow, resulting in an out-of-bounds write.
— NVD
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PHPto a version that resolves this vulnerability.Fixed in 8.1.31 - Upgrade
Upgrade
debian/php7.4to a version that resolves this vulnerability.Fixed in 7.4.33-1+deb11u8 - Upgrade
Upgrade
debian/php8.2to a version that resolves this vulnerability.Fixed in 8.2.26-1~deb12u1Fixed in 8.2.28-1~deb12u1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.1.31-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.3.14-1 - Upgrade
Upgrade
PHPto a version that resolves this vulnerability.Fixed in 8.2.26 - Upgrade
Upgrade
PHPto a version that resolves this vulnerability.Fixed in 8.3.14
Event History
Frequently Asked Questions
What is the severity of CVE-2024-8932?
CVE-2024-8932 is a high-severity vulnerability due to potential out-of-bounds writes resulting from an integer overflow.
How do I fix CVE-2024-8932?
To fix CVE-2024-8932, upgrade your PHP version to 8.1.31 or later, 8.2.26 or later, or ensure your PHP 7.4 is updated to 7.4.33-1+deb11u7.
Which versions of PHP are affected by CVE-2024-8932?
CVE-2024-8932 affects PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, and 8.3.* before 8.3.14 on 32-bit systems.
What systems are primarily at risk from CVE-2024-8932?
CVE-2024-8932 primarily impacts 32-bit systems running vulnerable PHP versions.
What happens if CVE-2024-8932 is exploited?
Exploitation of CVE-2024-8932 can lead to uncontrolled long string inputs causing an integer overflow, resulting in potential out-of-bounds write vulnerabilities.