REDHAT-BUG-2468564: Null Pointer Dereference
In PHP versions 8.2. before 8.2.31, 8.3. before 8.3.31, 8.4. before 8.4.21, and 8.5. before 8.5.6, a mismatch between encoding lists in Oniguruma and mbfl leads to a NULL pointer dereference, resulting in a segmentation fault and denial of service. The vulnerability is exploitable when user-controlled input can influence the encoding passed to mbregexencoding().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.2.31 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.3.31 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.4.21 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.5.6 - Compensating control
Ensure user-controlled input cannot influence the encoding passed to mb_regex_encoding() (because exploitation is possible when the encoding argument is influenced by user-controlled input).
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2468564?
The severity of REDHAT-BUG-2468564 is classified as medium.
How do I fix REDHAT-BUG-2468564?
To fix REDHAT-BUG-2468564, update PHP to versions 8.2.31, 8.3.31, 8.4.21, or 8.5.6 or later.
What versions of PHP are affected by REDHAT-BUG-2468564?
Versions of PHP affected by REDHAT-BUG-2468564 include 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6.
What type of vulnerability is REDHAT-BUG-2468564?
REDHAT-BUG-2468564 is classified as a Null Pointer Dereference vulnerability.
What is the potential impact of REDHAT-BUG-2468564?
The potential impact of REDHAT-BUG-2468564 includes a denial of service due to a segmentation fault.