Description
In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, uncontrolled long string inputs to ldap_escape() function on 32-bit systems can cause an integer overflow, resulting in an out-of-bounds write.
CVSS breakdown
CVSS 3.1
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected products
- PHP Group / PHP8.1.* – 8.1.31
- PHP Group / PHP8.2.* – 8.2.26
- PHP Group / PHP8.3.* – 8.3.14
References
Updated 38m ago · 8 sources