Integer Overflow or Wraparound Affecting php-devel package, versions <0:7.3.20-1.module+el8.2.0+7373+b272fdef


Severity

Recommended
medium

Based on CentOS security rating

    Threat Intelligence

    EPSS
    1.18% (86th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-CENTOS8-PHPDEVEL-1941869
  • published 26 Jul 2021
  • disclosed 14 May 2020

How to fix?

Upgrade Centos:8 php-devel to version 0:7.3.20-1.module+el8.2.0+7373+b272fdef or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream php-devel package and not the php-devel package as distributed by Centos. See How to fix? for Centos:8 relevant fixed versions and status.

In PHP versions 7.2.x below 7.2.31, 7.3.x below 7.3.18 and 7.4.x below 7.4.6, when HTTP file uploads are allowed, supplying overly long filenames or field names could lead PHP engine to try to allocate oversized memory storage, hit the memory limit and stop processing the request, without cleaning up temporary files created by upload request. This potentially could lead to accumulation of uncleaned temporary files exhausting the disk space on the target server.

CVSS Scores

version 3.1
Expand this section

NVD

5.3 medium
  • Attack Vector (AV)
    Network
  • Attack Complexity (AC)
    Low
  • Privileges Required (PR)
    None
  • User Interaction (UI)
    None
  • Scope (S)
    Unchanged
  • Confidentiality (C)
    None
  • Integrity (I)
    None
  • Availability (A)
    Low
Expand this section

Red Hat

7.5 high
Expand this section

SUSE

5.3 medium