CVE-2023-3824

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-3824
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-3824.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-3824
Aliases
Downstream
ALPINE (1)
ALSA (4)
AZL (2)
BELL (1)
CLSA (8)
DEBIAN (1)
ECHO (1)
MGASA (1)
OESA (5)
openSUSE (1)
RHSA (4)
RLSA (4)
SUSE (4)
UBUNTU (1)
Related
ALSA (4)
openSUSE (1)
SUSE (4)
Published
2023-08-11T05:48:34Z
Modified
2026-10-28T02:30:25Z
Severity
  • 9.4 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L CVSS Calculator
Summary
Buffer overflow and overread in phar_dir_read()
Details

In PHP version 8.0.* before 8.0.30,  8.1.* before 8.1.22, and 8.2.* before 8.2.8, when loading phar file, while reading PHAR directory entries, insufficient length checking may lead to a stack buffer overflow, leading potentially to memory corruption or RCE.

Database specific 
{
    "cna_assigner": "php",
    "cwe_ids": [
        "CWE-119"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/3xxx/CVE-2023-3824.json"
}
References

Affected packages

Git / github.com/php/php-src

Affected ranges

Type
GIT
Repo
https://github.com/php/php-src
Events
Introduced
5dc92c2117cafc61daaaaa240fd46c3ac33872a4
Fixed
8213daa932be1c2ae04726233e4e56e5df63980e
Introduced
381ba9f5d0edd0c9c8ec1dea7e21d513ad08b115
Fixed
5ffbd1ad43d2a98cd1fd91e2b20672fac30cd4c0
Introduced
70ee6c20ad97e02c2b8098aeea96fefbbc3ac5c2
Fixed
3d832da8f53d2c2f93d4ffbd1c807d9a5d66536b
Database specific
Show details 
{
    "extracted_events": [
        {
            "cpe": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "8.0.0"
                },
                {
                    "fixed": "8.0.30"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "8.1.0"
                },
                {
                    "fixed": "8.1.22"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "8.2.0"
                },
                {
                    "fixed": "8.2.9"
                }
            ],
            "source": "CPE_RANGE"
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-3824.json"