REDHAT-BUG-2468561: Medium severity PHP PHP vulnerability
In PHP versions 8.2. before 8.2.31, 8.3. before 8.3.31, 8.4. before 8.4.21, and 8.5. before 8.5.6, some functions, including urldecode(), pass signed char to ctype functions (like isxdigit()). On the systems with default signed char and optimized table-lookup ctype functions - such as NetBSD - this can lead to accessing array with negative offset, which can trigger a denial of service.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
phpto a version that resolves this vulnerability.Fixed in 8.2.31 - Upgrade
Upgrade
phpto a version that resolves this vulnerability.Fixed in 8.3.31 - Upgrade
Upgrade
phpto a version that resolves this vulnerability.Fixed in 8.4.21 - Upgrade
Upgrade
phpto a version that resolves this vulnerability.Fixed in 8.5.6
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2468561?
The severity of REDHAT-BUG-2468561 is assessed as medium (4).
How do I fix REDHAT-BUG-2468561?
To fix REDHAT-BUG-2468561, you should upgrade PHP to the latest recommended version that is beyond the vulnerable versions mentioned.
Which PHP versions are affected by REDHAT-BUG-2468561?
REDHAT-BUG-2468561 affects PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6.
What impact does REDHAT-BUG-2468561 have on systems?
The impact of REDHAT-BUG-2468561 may lead to unexpected behavior in certain PHP functions on systems with default signed char.
Is REDHAT-BUG-2468561 present in newer PHP versions?
No, REDHAT-BUG-2468561 is not present in PHP versions that have been updated to the secure releases after the mentioned vulnerabilities.