PHP vulnerabilities

Circular symbolic links in phar archives could lead to unbounded recursion, exhausting the C stack and crashing the PHP process. This affects PHP versions from 8.2.* before 8.2.33, from 8.3.* before 8.3.33, from 8.4.* before 8.4.24, and from 8.5.* before 8.5.9.

In the AES-WRAP-PAD algorithm implementation in the OpenSSL extension for PHP, there is a buffer allocation flaw. The output buffer size is determined from the plaintext length without accounting for RFC 5649 expansion, which may cause out-of-bounds memory writes.

Vulnerability in PHP (versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6) in the DOMNode::C14N() method causes incorrect XML processing, resulting in a circular linked list in the XML document's data structure. This may cause an infinite loop during subsequent processing, leading to denial of service (DoS).

In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the metaphone() function uses a signed int variable to track the position in the input string. Passing a string longer than 2,147,483,647 bytes causes a signed integer overflow, leading to undefined behavior, out-of-bounds read, segmentation fault, and potential availability impact on the PHP process.

In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, when a SOAP server has a typemap configured, the decoding process contains a mistake which checks the wrong variable in case of a missing value element. This leads to dereferencing a NULL pointer, causing a segmentation fault, allowing a remote unauthenticated attacker to crash the PHP SOAP server process, resulting in denial of service.

In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, a mismatch between encoding lists in Oniguruma and mbfl leads to a NULL pointer dereference and denial of service. Exploitable when user input influences the encoding passed to mb_regex_encoding().

In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, functions like urldecode() pass signed char to ctype functions (e.g., isxdigit()). On systems with default signed char and optimized table-lookup ctype functions (e.g., NetBSD), this can lead to array access with negative offset, potentially causing denial of service.

In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, 8.5.* before 8.5.6, due to improper sanitation of user data, an attacker can craft a URL that causes arbitrary JavaScript execution (XSS) on the target's machine when viewing the PHP-FPM status page.

In PHP versions 8.0.* before 8.0.29, 8.1.* before 8.1.20, and 8.2.* before 8.2.7, when using SOAP HTTP Digest Authentication, the random value generator was not checked for failure and was using a narrower range of values than it should have. In case of random generator failure, it could lead to a disclosure of 31 bits of uninitialized memory from the client to the server.

In PHP 8.0.x before 8.0.28, 8.1.x before 8.1.16, and 8.2.x before 8.2.3, the password_verify() function may accept some invalid Blowfish hashes as valid. If such an invalid hash ends up in the password database, it may allow any password for that entry to be considered valid.

In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0, the bcmath extension functions on some systems, including Windows, can be tricked into reading beyond the allocated space by supplying a string containing characters that are identified as numeric by the OS but aren't ASCII numbers. This can lead to disclosure of the content of some memory locations.