CVE-2023-0568 Array overrun in common path resolve code

2023-02-1606:34:04

CWE-131

php

www.cve.org

php 8.0.x

php 8.1.x

php 8.2.x

buffer overrun

unauthorized data access

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

8.4 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

55.4%

JSON

In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, core path resolution function allocate buffer one byte too small. When resolving paths with lengths close to system MAXPATHLEN setting, this may lead to the byte after the allocated buffer being overwritten with NUL value, which might lead to unauthorized data access or modification.

CNA Affected

[
  {
    "defaultStatus": "affected",
    "product": "PHP",
    "repo": "https://github.com/php/php-src",
    "vendor": "PHP Group",
    "versions": [
      {
        "lessThan": "8.0.28",
        "status": "affected",
        "version": "8.0.x",
        "versionType": "semver"
      },
      {
        "lessThan": "8.1.16",
        "status": "affected",
        "version": "8.1.x",
        "versionType": "semver"
      },
      {
        "lessThan": "8.2.3",
        "status": "affected",
        "version": "8.2.x",
        "versionType": "semver"
      }
    ]
  }
]