Threats Tagged 'cve-2024-11233'

A security update for PHP on Red Hat Enterprise Linux 9 addresses multiple vulnerabilities including cookie bypass, erroneous password verification, filter bypass, multipart form data parsing errors, configuration bypass, log manipulation, heap buffer over-read, single byte overread, and CRLF injection. These issues collectively pose moderate security risks such as account takeover and information leakage. The update fixes nine distinct CVEs and is rated with moderate severity by Red Hat Product Security.

In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, due to an error in convert.quoted-printable-decode filter certain data can lead to buffer overread by one byte, which can in certain circumstances lead to crashes or disclose content of other memory areas.

HighVulnerabilityGermanyFranceUnited Kingdom+5#cve#cve-2024-11233#cwe-122

A heap buffer over-read vulnerability exists in the mysqlnd extension of PHP, affecting multiple PHP versions prior to specific fixed releases. A hostile MySQL server can exploit this flaw to cause the PHP client to leak partial heap contents, potentially disclosing data from other SQL requests or other users on the same server. This vulnerability has been assigned CVE-2024-8929 and is rated as having moderate security impact. Official patches are available and have been released by vendors including Red Hat.