In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, core path resolution function allocate buffer one byte too small. When resolving paths with lengths close to system MAXPATHLEN setting, this may lead to the byte after the allocated buffer being overwritten with NUL value, which might lead to unauthorized data access or modification.
References
| Link | Resource |
|---|---|
| https://bugs.php.net/bug.php?id=81746 | Exploit Issue Tracking Patch Vendor Advisory |
| https://security.netapp.com/advisory/ntap-20230517-0001/ |
Configurations
Configuration 1 (hide)
|
History
17 May 2023, 20:15
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, core path resolution function allocate buffer one byte too small. When resolving paths with lengths close to system MAXPATHLEN setting, this may lead to the byte after the allocated buffer being overwritten with NUL value, which might lead to unauthorized data access or modification. | |
| References |
|
03 Mar 2023, 18:02
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.1 |
24 Feb 2023, 18:09
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-770 | |
| CPE | cpe:2.3:a:php:php:*:*:*:*:*:*:*:* | |
| References | (MISC) https://bugs.php.net/bug.php?id=81746 - Exploit, Issue Tracking, Patch, Vendor Advisory | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
| First Time |
Php
Php php |
16 Feb 2023, 07:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-02-16 07:15
Updated : 2023-12-10 14:48
NVD link : CVE-2023-0568
Mitre link : CVE-2023-0568
CVE.ORG link : CVE-2023-0568
JSON object : View
Products Affected
php
- php