CVE-2024-11236 Integer overflow in the firebird and dblib quoters causing OOB writes
An integer overflow in PHP's ldap_escape function on 32-bit systems allows out-of-bounds writes, potentially leading to code execution or crashes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-11236?
CVE-2024-11236 is a critical vulnerability in Php Php, published on 24 Nov 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, uncontrolled long string inputs to ldap_escape() function on 32-bit systems can cause an integer overflow, resulting in an out-of-bounds write.
Which versions are affected by CVE-2024-11236?
3 open source packages ship an affected version, including libphp, php and php-min. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
libphp Bitnami | All versions | 8.1.31, 8.2.26, 8.3.14 |
php Bitnami | All versions | 8.1.31, 8.2.26, 8.3.14 |
php-min Bitnami | All versions | 8.1.31, 8.2.26, 8.3.14 |
Products include Php Php.
How do I fix CVE-2024-11236?
Upgrade libphp to a fixed version for your release line: 8.1.31, 8.2.26 or 8.3.14.
Is CVE-2024-11236 being exploited?
There is no known exploitation of CVE-2024-11236 in the wild and no public exploit code.
Other vulnerabilities in Php Php
Sources
Also known as AZL-53447, AZL-53718, BELL-CVE-2024-11236, BIT-libphp-2024-11236, BIT-php-2024-11236, BIT-php-min-2024-11236 and 8 more.