REDHAT-BUG-1685404: Low severity php vulnerability
An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. xmlrpcdecode() can allow a hostile XMLRPC server to cause PHP to read memory outside of allocated areas in base64decodexmlrpc in ext/xmlrpc/libxmlrpc/base64.c.
Upstream commit: http://git.php.net/?p=php-src.git;a=commit;h=1cc2182bcc81e185c14837e659d12b268cb99d63 http://git.php.net/?p=php-src.git;a=commit;h=027f68ff10a439c5c331bcbfdd6eb2a5fca0948a
Reference: https://bugs.php.net/bug.php?id=77380
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-1685404?
The severity of REDHAT-BUG-1685404 is considered high due to potential memory leaks resulting from the vulnerability.
How do I fix REDHAT-BUG-1685404?
To fix REDHAT-BUG-1685404, upgrade to PHP version 5.6.40 or later, 7.1.26 or later, 7.2.14 or later, or 7.3.1 or later.
What versions of PHP are affected by REDHAT-BUG-1685404?
The affected versions of PHP include all versions before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1.
What does REDHAT-BUG-1685404 affect?
REDHAT-BUG-1685404 affects the xmlrpc_decode() function in PHP's XMLRPC extension.
Can REDHAT-BUG-1685404 lead to remote code execution?
REDHAT-BUG-1685404 does not directly lead to remote code execution, but it can cause PHP to read memory outside allocated areas, potentially leading to further exploits.