REDHAT-BUG-2468573: High severity PHP PHP vulnerability
In PHP versions 8.4. before 8.4.21 and 8.5. before 8.5.6, when an encoding name containing an embedded NUL byte is passed to mbconvertencoding() or related mbstring functions, the code incorrectly assumes that when strncasecmp() returns 0 it means the strings have the same length. This can lead to out-of-bounds read of global memory, potentially causing a crash or information disclosure or crash. Affected functions include mbconvertencoding(), mbdetectencoding(), mbconvertvariables(), and mbdetectorder(), as well as the mbstring.detectorder and mbstring.httpoutput INI settings.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2468573?
The severity of REDHAT-BUG-2468573 is classified as high with a severity score of 7.
How do I fix REDHAT-BUG-2468573?
To fix REDHAT-BUG-2468573, upgrade PHP to versions 8.4.21 or 8.5.6 or later.
What versions of PHP are affected by REDHAT-BUG-2468573?
PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6 are affected by REDHAT-BUG-2468573.
What functions are impacted by REDHAT-BUG-2468573?
The vulnerability affects mb_convert_encoding() and related mbstring functions.
What is the risk associated with REDHAT-BUG-2468573?
The risk associated with REDHAT-BUG-2468573 includes potential unintended behavior due to incorrect string length assumptions.