Bug 2170770 (CVE-2023-0568) - CVE-2023-0568 php: 1-byte array overrun in common path resolve code
Summary: CVE-2023-0568 php: 1-byte array overrun in common path resolve code
Keywords:
Status: NEW
Alias: CVE-2023-0568
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: Red Hat2174681 2170779 2170780 Red Hat2174679 Red Hat2174680 Red Hat2174682 Red Hat2174683 Red Hat2174684
Blocks: Embargoed2170009
TreeView+ depends on / blocked
 
Reported: 2023-02-17 08:31 UTC by Sandipan Roy
Modified: 2023-05-12 14:24 UTC (History)
3 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
A vulnerability was found in PHP. This security issue occurs because the core path resolution function allocates a buffer one byte small. Resolving paths with lengths close to the system MAXPATHLEN setting may lead to the byte after the allocated buffer being overwritten with a NULL value, which might lead to unauthorized data access or modification.
Clone Of:
Environment:
Last Closed:

Attachments (Terms of Use)

Description Sandipan Roy 2023-02-17 08:31:45 UTC 
In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, core path resolution function allocate buffer one byte too small. When resolving paths with lengths close to system MAXPATHLEN setting, this may lead to the byte after the allocated buffer being overwritten with NUL value, which might lead to unauthorized data access or modification.

https://bugs.php.net/bug.php?id=81746
Comment 1 Sandipan Roy 2023-02-17 08:42:41 UTC 
Created php tracking bugs for this issue:

Affects: fedora-36 [bug 2170779]
Affects: fedora-37 [bug 2170780]
Note You need to log in before you can comment on or make changes to this bug.