Описание
In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, a hostile MySQL server can cause the client to disclose the content of its heap containing data from other SQL requests and possible other data belonging to different users of the same server.
Пакеты
| Пакет | Статус | Версия исправления | Релиз | Тип |
|---|---|---|---|---|
| php8.2 | fixed | 8.2.26-4 | package | |
| php7.4 | removed | package |
Примечания
https://github.com/php/php-src/security/advisories/GHSA-h35g-vwh6-m678
https://github.com/php/php-src/commit/6c0e2eb2f839d066924c164f65f17d1261529334 (php-8.2.26)
Follow-up: https://github.com/php/php-src/commit/abc6de0ddec93564e9faa8065ac5756a1fbaf763 (php-8.2.26)
Follow-up: https://github.com/php/php-src/commit/913031c844737d78a62c4af2aab1c3eeb7dc95bf (php-8.2.26)
https://blog.quarkslab.com/security-audit-of-php-src.html
EPSS
Связанные уязвимости
In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, a hostile MySQL server can cause the client to disclose the content of its heap containing data from other SQL requests and possible other data belonging to different users of the same server.
In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, a hostile MySQL server can cause the client to disclose the content of its heap containing data from other SQL requests and possible other data belonging to different users of the same server.
In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, a hostile MySQL server can cause the client to disclose the content of its heap containing data from other SQL requests and possible other data belonging to different users of the same server.
[Mysqlnd] Leak partial content of the heap through heap buffer over-read
EPSS