Threats Tagged 'cve-2024-8929'

A security update for PHP on Red Hat Enterprise Linux 9 addresses multiple vulnerabilities including cookie bypass, erroneous password verification, filter bypass, multipart form data parsing errors, configuration bypass, log manipulation, heap buffer over-read, single byte overread, and CRLF injection. These issues collectively pose moderate security risks such as account takeover and information leakage. The update fixes nine distinct CVEs and is rated with moderate severity by Red Hat Product Security.

A heap buffer over-read vulnerability exists in the mysqlnd extension of PHP, affecting multiple PHP versions prior to specific fixed releases. A hostile MySQL server can exploit this flaw to cause the PHP client to leak partial heap contents, potentially disclosing data from other SQL requests or other users on the same server. This vulnerability has been assigned CVE-2024-8929 and is rated as having moderate security impact. Official patches are available and have been released by vendors including Red Hat.

In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, a hostile MySQL server can cause the client to disclose the content of its heap containing data from other SQL requests and possible other data belonging to different users of the same server.

MediumVulnerabilityGermanyFranceUnited Kingdom+4#cve#cve-2024-8929#cwe-200