by Kastro
Paper/Archive/CVE-2022-31627

CVE-2022-31627

PHP Group PHP — Heap buffer overflow in finfo_buffer

EPSS 2%CVSS 9.8
critical.is priorityof 100
46
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 82.1.821 × 2016.4No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

In PHP versions 8.1.x below 8.1.8, when fileinfo functions, such as finfo_buffer, due to incorrect patch applied to the third party code from libmagic, incorrect function may be used to free allocated memory, which may lead to heap corruption.

Affected

ProductAffectedFixed inSource
PHP8.1.X – < 8.1.88.1.8CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
php (CNA)7.7CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L

References

refbugs.php.net/bug.php?id=81723refsecurity.netapp.com/advisory/ntap-20220826-0008advisorysecurity.gentoo.org/glsa/202209-20