9.2
Vector
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow more
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less
Source: security@php.net (Secondary)
Description
PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).
Affected (298)
Products: Php: Php · Siemens: Ruggedcom Ape1808 Firmware · Paloaltonetworks: Pan Os, Panorama Virtual Appliance
Configuration B
| Vulnerable Software | Affected Versions |
|---|---|
| All versions |
| Running on/with | Platform Versions |
|---|---|
Siemens Ruggedcom Ape1808 | All versions |
Configuration C
| Vulnerable Software | Affected Versions |
|---|---|
| 10.2.0 ≤ version < 10.2.7 |
Configuration D
| Vulnerable Software | Affected Versions |
|---|---|
| 11.1.0 ≤ version < 11.1.4 |
Configuration E
| Vulnerable Software | Affected Versions |
|---|---|
| 11.2.0 ≤ version < 11.2.4 |
Configuration F
| Vulnerable Software | Affected Versions |
|---|---|
| 12.1.0 ≤ version < 12.1.4 |
Configuration G
| Vulnerable Software | Affected Versions |
|---|---|
| 12.2.0 ≤ version < 12.2.4 |
Configuration H
| Vulnerable Software | Affected Versions |
|---|---|
| All versions |
| Running on/with | Platform Versions |
|---|---|
Paloaltonetworks Panorama M 200 | All versions |
Paloaltonetworks Panorama M 300 | All versions |
Paloaltonetworks Panorama M 500 | All versions |
Paloaltonetworks Panorama M 600 | All versions |
Paloaltonetworks Panorama M 700 | All versions |
Configuration I
| Vulnerable Software | Affected Versions |
|---|---|
| All versions |
Configuration J
| Vulnerable Software | Affected Versions |
|---|---|
| All versions |
| Running on/with | Platform Versions |
|---|---|
Paloaltonetworks Wf 500 | All versions |
Paloaltonetworks Wf 500 B | All versions |
Related CWEs
CWE-1325
Improperly Controlled Sequential Memory Allocation
The product manages a group of objects or resources and performs a separate memory allocation for each object, but it does not properly limit the total amount of memory that is consumed by all of the combined objects.
CWE-416
Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
CWE-755
Improper Handling of Exceptional Conditions
The product does not handle or incorrectly handles an exceptional condition.
CWE-824
Access of Uninitialized Pointer
The product accesses or uses a pointer that has not been initialized.
References (5)
Source: security@php.net
MitigationVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing ListThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing ListThird Party Advisory
Source: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
Third Party Advisory
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
Third Party Advisory
Timeline
No history available yet.