CVE-2024-11235 | THREATINT

Description

In PHP versions 8.3.* before 8.3.19 and 8.4.* before 8.4.5, a code sequence involving __set handler or ??= operator and exceptions can lead to a use-after-free vulnerability. If the third party can control the memory layout leading to this, for example by supplying specially crafted inputs to the script, it could lead to remote code execution.

Reserved 2024-11-15 | Published 2025-04-04 | Updated 2025-04-05 | Assigner php

CRITICAL: 9.2CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/U:Amber

Problem types

CWE-416 Use After Free

Product status

Default status

unaffected

8.4.* before 8.4.5

affected

8.3.* before 8.3.19

affected

Credits

Junwha Hong reporter

References

github.com/...hp-src/security/advisories/GHSA-rwp7-7vc6-8477

cve.org (CVE-2024-11235)

nvd.nist.gov (CVE-2024-11235)

Download JSON