CVE-2023-3824

Description

In PHP version 8.0.* before 8.0.30, 8.1.* before 8.1.22, and 8.2.* before 8.2.8, when loading phar file, while reading PHAR directory entries, insufficient length checking may lead to a stack buffer overflow, leading potentially to memory corruption or RCE.

How to fix CVE-2023-3824

To remediate CVE-2023-3824, upgrade the affected package to a fixed version below.

Bitnami/libphp—upgrade to 8.0.30 or later
—upgrade to 8.0.30 or later
—upgrade to 8.0.30 or later
—upgrade to 7.4.33-1+deb11u5 or later
—upgrade to 8.2.18-1~deb12u1 or later

Is CVE-2023-3824 being exploited?

Moderate — EPSS is 31.8%. Track this CVE but it's not at the top of the prioritisation list.

Affected packages (5)

>= 8.0.0, < 8.0.30, >= 8.1.0, < 8.1.22, >= 8.2.0, < 8.2.9
>= 8.0.0, < 8.0.30, >= 8.1.0, < 8.1.22, >= 8.2.0, < 8.2.9
>= 8.0.0, < 8.0.30, >= 8.1.0, < 8.1.22, >= 8.2.0, < 8.2.9
from 0, < 7.4.33-1+deb11u5
from 0, < 8.2.18-1~deb12u1

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	CRITICAL9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H