Niels Dossche

تم تحديد العديد من الثغرات الأمنية في PHP، وهي لغة برمجة نصية، مما قد يؤدي إلى رفض الخدمة أو تسرب الذاكرة.

The issue is related to an integer overflow in the `ldap escape()` function on 32-bit systems when handling uncontrolled long string inputs. This can result in an out-of-bounds write, potentially allowing a remote attacker to execute arbitrary code by sending specially crafted data to a web application. The vulnerability is critical and can lead to system crashes or malicious actions.

The issue arises from incorrect handling of DOM processing instructions, allowing bypassing of the cross-site scripting mechanism of typo3/html-sanitizer.

The issue is caused by insufficient length checking when loading phar files, leading to a stack buffer overflow, which can result in memory corruption or remote code execution (RCE). This vulnerability was reportedly exploited by law enforcement agencies in Operation Cronos to compromise the LockBit ransomware group's infrastructure. The group claims that the vulnerability, specifically in PHP version 8.1.2, was used to gain access to their servers. It is estimated that over 2000 individuals and organizations have been affected by LockBit, with the group demanding over $91 million in ransom from American organizations alone. The vulnerability allows for RCE, which can enable attackers to execute arbitrary code on the affected system.

The issue is related to the use of a random value generator with a narrower range of values than it should have when using SOAP HTTP Digest Authentication. In case of random generator failure, it could lead to a disclosure of 31 bits of uninitialized memory from the client to the server, and it also made easier to a malicious server to guess the client's nonce.

The issue is related to the core path resolution function in PHP, which allocates a buffer one byte too small. When resolving paths with lengths close to the system MAXPATHLEN setting, this may lead to the byte after the allocated buffer being overwritten with a NUL value, potentially resulting in unauthorized data access or modification.

تم تحديد مشكلة تتعلق بحالة التنافس في نواة Linux، وتحديدًا في الوحدة النمطية IB/rdmavt. تنشأ المشكلة عن استدعاء الدالة `rvt error qp` دون القفل المناسب، كما هو مطلوب في وثائق الدالة. قد يؤدي ذلك إلى فشل في تأكيد lockdep، مما قد يتسبب في حدوث حالة تنافس. ترتبط المشكلة بالدالة `rvt ruc loopback`، حيث لم يعد استدعاء `rvt error qp` محميًّا بواسطة `r lock`.