Openai

A use-after-free memory corruption issue exists in the PHP interpreter core, specifically within the `session.upload progress` component. The flaw occurs during request parsing when PHP records state as ready before all memory allocations are complete. If an allocation fails due to out-of-memory (OOM) errors, the `longjmp()` function is used to abort the request, but some contexts fail to properly roll back the incomplete state, leaving request memory uninitialized. Subsequent cleanup procedures may read or branch on this uninitialized memory. An unauthenticated remote attacker can exploit this by sending specially crafted HTTP POST requests to achieve remote code execution (RCE). Real-world exploitation has been observed against systems using Apache mod php, where attackers used a four-stage HTTP chain involving memory exhaustion and information disclosure via the `PHPSESSID` header to bypass ASLR and execute shell commands such as `/bin/sh`.

PHP contains a use-after-free flaw where global state, error handling, object, and extension state may not be correctly reset or may be repopulated after being reset. This occurs because some states point to memory owned by a single request; if a fatal error interrupts the cleanup phase or if the process uses `longjmp()` for out-of-memory (OOM) errors to abort request handling, the global state may refer to memory after it has been freed. Subsequent requests may then read or branch on this stale state before it is fully initialized. An unauthenticated remote attacker can exploit this condition, specifically through the `session.upload progress` component or by sending a specially crafted POST request, to achieve remote code execution (RCE). This issue affects mod php and conditionally affects FPM through application-stage paths.

A double free issue exists due to improper memory management. A double free occurs when the system attempts to free the same memory location twice, which can lead to memory corruption. This flaw allows an application to cause unexpected system termination.

A Project Resource Manager may gain broader administrative privileges under specific conditions, leading to privilege escalation.

A holder of a valid integration credential may impersonate other users under specific conditions.