CVE-2023-3824

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-3824
In PHP version 8.0.* before 8.0.30,  8.1.* before 8.1.22, and 8.2.* before 8.2.8, when loading phar file, while reading PHAR directory entries, insufficient length checking may lead to a stack buffer overflow, leading potentially to memory corruption or RCE.

9.4 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact LOW

Scope UNCHANGED

References
Link Resource
https://github.com/php/php-src/security/advisories/GHSA-jqcx-ccgc-xwhv Exploit Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/09/msg00002.html Mailing List
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7NBF77WN6DTVTY2RE73IGPYD6M4PIAWA/ Mailing List
https://security.netapp.com/advisory/ntap-20230825-0001/ Third Party Advisory
https://github.com/php/php-src/security/advisories/GHSA-jqcx-ccgc-xwhv Exploit Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/09/msg00002.html Mailing List
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7NBF77WN6DTVTY2RE73IGPYD6M4PIAWA/ Mailing List
https://security.netapp.com/advisory/ntap-20230825-0001/ Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*

Configuration 3 (hide)

cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
History

13 Feb 2025, 17:16

Type Values Removed Values Added
Summary (en) In PHP version 8.0.* before 8.0.30,  8.1.* before 8.1.22, and 8.2.* before 8.2.8, when loading phar file, while reading PHAR directory entries, insufficient length checking may lead to a stack buffer overflow, leading potentially to memory corruption or RCE.  (en) In PHP version 8.0.* before 8.0.30,  8.1.* before 8.1.22, and 8.2.* before 8.2.8, when loading phar file, while reading PHAR directory entries, insufficient length checking may lead to a stack buffer overflow, leading potentially to memory corruption or RCE.

21 Nov 2024, 08:18

Type Values Removed Values Added
CVSS v2 : unknown
v3 : 9.8 		v2 : unknown
v3 : 9.4
Summary
  • (es) En PHP versión 8.0.* antes de 8.0.30, 8.1.* antes de 8.1.22, y 8.2.* antes de 8.2.8, al cargar el archivo phar, mientras se leen las entradas del directorio PHAR, una comprobación de longitud insuficiente puede conducir a un desbordamiento del búfer de pila, llevando potencialmente a corrupción de memoria o RCE.
References () https://github.com/php/php-src/security/advisories/GHSA-jqcx-ccgc-xwhv - Exploit, Third Party Advisory () https://github.com/php/php-src/security/advisories/GHSA-jqcx-ccgc-xwhv - Exploit, Third Party Advisory
References () https://lists.debian.org/debian-lts-announce/2023/09/msg00002.html - Mailing List () https://lists.debian.org/debian-lts-announce/2023/09/msg00002.html - Mailing List
References () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7NBF77WN6DTVTY2RE73IGPYD6M4PIAWA/ - Mailing List () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7NBF77WN6DTVTY2RE73IGPYD6M4PIAWA/ - Mailing List
References () https://security.netapp.com/advisory/ntap-20230825-0001/ - Third Party Advisory () https://security.netapp.com/advisory/ntap-20230825-0001/ - Third Party Advisory

21 Aug 2023, 16:31

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 9.8
CPE cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
CWE CWE-119
References (MISC) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7NBF77WN6DTVTY2RE73IGPYD6M4PIAWA/ - (MISC) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7NBF77WN6DTVTY2RE73IGPYD6M4PIAWA/ - Third Party Advisory
References (MISC) https://github.com/php/php-src/security/advisories/GHSA-jqcx-ccgc-xwhv - (MISC) https://github.com/php/php-src/security/advisories/GHSA-jqcx-ccgc-xwhv - Exploit, Third Party Advisory

12 Aug 2023, 06:19

Type Values Removed Values Added
References
  • (MISC) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7NBF77WN6DTVTY2RE73IGPYD6M4PIAWA/ -

11 Aug 2023, 06:15

Type Values Removed Values Added
New CVE
Information

Published : 2023-08-11 06:15

Updated : 2025-02-13 17:16

NVD link : CVE-2023-3824

Mitre link : CVE-2023-3824

CVE.ORG link : CVE-2023-3824

JSON object : View

Products Affected

php

  • php

fedoraproject

  • fedora

debian

  • debian_linux
CWE
CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer