<p>Upgrade <code>Alpine:3.19</code> <code>php81</code> to version 8.1.0_rc5-r0 or higher.</p>

Out-of-bounds Write Affecting php81 package, versions <8.1.0_rc5-r0

Threat Intelligence

0.15% (52^nd percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk ID SNYK-ALPINE319-PHP81-6110726
published 8 Dec 2023
disclosed 25 Oct 2021

Report a new vulnerability Found a mistake?

Introduced: 25 Oct 2021

CVE-2021-21703 Open this link in a new tab CWE-787 Open this link in a new tab

How to fix?

Upgrade Alpine:3.19 php81 to version 8.1.0_rc5-r0 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream php81 package and not the php81 package as distributed by Alpine. See How to fix? for Alpine:3.19 relevant fixed versions and status.

In PHP versions 7.3.x up to and including 7.3.31, 7.4.x below 7.4.25 and 8.0.x below 8.0.12, when running PHP FPM SAPI with main FPM daemon process running as root and child worker processes running as lower-privileged users, it is possible for the child processes to access memory shared with the main process and write to it, modifying it in a way that would cause the root process to conduct invalid memory reads and writes, which can be used to escalate privileges from local unprivileged user to the root user.

References

CVSS Scores

version 3.1

Attack Vector (AV)

Local
Attack Complexity (AC)

High
Privileges Required (PR)

Low
User Interaction (UI)

None

Scope (S)

Unchanged

Confidentiality (C)

High
Integrity (I)

High
Availability (A)

High

Out-of-bounds Write Affecting php81 package, versions <8.1.0_rc5-r0

Severity

Snyk's Security Team recommends NVD's CVSS assessment