Ilija Tovilo

PHP contains a use-after-free flaw where global state, error handling, object, and extension state may not be correctly reset or may be repopulated after being reset. This occurs because some states point to memory owned by a single request; if a fatal error interrupts the cleanup phase or if the process uses `longjmp()` for out-of-memory (OOM) errors to abort request handling, the global state may refer to memory after it has been freed. Subsequent requests may then read or branch on this stale state before it is fully initialized. An unauthenticated remote attacker can exploit this condition, specifically through the `session.upload progress` component or by sending a specially crafted POST request, to achieve remote code execution (RCE). This issue affects mod php and conditionally affects FPM through application-stage paths.

A use-after-free memory corruption issue exists in the PHP interpreter core, specifically within the `session.upload progress` component. The flaw occurs during request parsing when PHP records state as ready before all memory allocations are complete. If an allocation fails due to out-of-memory (OOM) errors, the `longjmp()` function is used to abort the request, but some contexts fail to properly roll back the incomplete state, leaving request memory uninitialized. Subsequent cleanup procedures may read or branch on this uninitialized memory. An unauthenticated remote attacker can exploit this by sending specially crafted HTTP POST requests to achieve remote code execution (RCE). Real-world exploitation has been observed against systems using Apache mod php, where attackers used a four-stage HTTP chain involving memory exhaustion and information disclosure via the `PHPSESSID` header to bypass ASLR and execute shell commands such as `/bin/sh`.

An issue exists in the mbstring extension where passing an encoding name containing an embedded NUL byte to certain functions causes the code to incorrectly assume strings are of equal length when `strncasecmp()` returns 0. This can result in an out-of-bounds read of global memory, which may lead to information disclosure or a system crash. Affected functions include `mb convert encoding()`, `mb detect encoding()`, `mb convert variables()`, and `mb detect order()`. Additionally, the `mbstring.detect order` and `mbstring.http output` INI settings are affected.

The `DOMNode::C14N()` method may process XML data incorrectly, leading to the creation of a circular linked list within the data structure that represents the XML document. This flaw can cause subsequent processing of the document to enter an infinite loop, resulting in a denial of service for the application.

A use-after-free issue exists in the SOAP extension's object deduplication mechanism, specifically within the `soap add xml ref()` function. The mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, the second entry overwrites the first in the temporary result map, freeing the original PHP object while a stale pointer remains. A subsequent href reference to the freed node can copy this dangling pointer into the result. Since PHP string allocations can reclaim the freed memory region, a remote attacker controlling the SOAP request body can exploit this to achieve remote code execution.

When SoapServer is configured with `SOAP PERSISTENCE SESSION`, the handler object is persisted across requests using session storage. If a SOAP request results in an error, the persistence is handled incorrectly, causing the object to be freed while a pointer to it remains. This leads to a use-after-free condition, which is a situation where a program continues to use a pointer after it has been freed, potentially resulting in memory corruption, information disclosure, or process crashes.

A mistake in the decoding process of a SOAP server with a configured typemap causes the system to check the wrong variable when a value element is missing. This results in a NULL pointer dereference, leading to a segmentation fault. A remote unauthenticated attacker can exploit this to crash the PHP SOAP server process, causing a denial of service.

A mismatch between encoding lists in Oniguruma and mbfl leads to a NULL pointer dereference, which results in a segmentation fault and denial of service. This occurs when user-controlled input influences the encoding passed to the `mb regex encoding()` function.

Certain functions, including `urldecode()`, pass signed characters to ctype functions such as `isxdigit()`. On systems utilizing default signed characters and optimized table-lookup ctype functions, such as NetBSD, this behavior can result in accessing an array with a negative offset, potentially triggering a denial of service.

The PDO Firebird driver improperly handles NUL bytes during the preparation of SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied using the `strncat()` function, which terminates at the NUL byte. This action drops the closing quote, causing subsequent SQL tokens to be interpreted as part of the string. This behavior enables SQL injection when attacker-controlled values are processed via the `PDO::quote()` function and embedded in SQL statements.