Описание
PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).
Ссылки
- MitigationVendor Advisory
- Mailing ListThird Party Advisory
- Mailing ListThird Party Advisory
- Third Party Advisory
- Third Party Advisory
Уязвимые конфигурации
Одно из
Одновременно
Одно из
Одно из
Одно из
Одно из
Одно из
Одновременно
Одно из
Одновременно
Одно из
EPSS
9.8 Critical
CVSS3
Дефекты
Связанные уязвимости
out-of-memory handling can interrupt PHP while internal request data is only partially initialized. Request cleanup may then treat the invalid data as valid.
PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).
PHP uses longjmp() for out-of-memory (OOM) errors to exit the current ...
Уязвимость функции longjmp() компонента session.upload_progress ядра интерпретатора языка программирования PHP, позволяющая нарушителю выполнить произвольный код
EPSS
9.8 Critical
CVSS3