BIT-php-min-2024-11233

vendorUSosv

Single byte overread with convert.quoted-printable-decode filter

view advisory published 2025-01-14Licence: per source

In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, due to an error in convert.quoted-printable-decode filter certain data can lead to buffer overread by one byte, which can in certain circumstances lead to crashes or disclose content of other memory areas.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2024-11233US	high8.2	1.61% (76th)	—	2024-11-24
In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, due to an error in convert.quoted-printable-decode filter certain data can lead to buffer overread by…

references

External citations — patches, advisories, analysis.

https://github.com/php/php-src/security/advisories/GHSA-r977-prxv-hc43ADVISORY
https://lists.debian.org/debian-lts-announce/2024/12/msg00007.htmlWEB
https://nvd.nist.gov/vuln/detail/CVE-2024-11233WEB
https://security.netapp.com/advisory/ntap-20241220-0008/WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan