CVE-2022-4900

Description

A vulnerability was found in PHP where setting the environment variable PHP_CLI_SERVER_WORKERS to a large value leads to a heap buffer overflow.

CVSS Metrics

• v3.1•MEDIUM•Score: 6.2CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
• v3.1•MEDIUM•Score: 5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS Trends

Current EPSS score: 0.07%• Percentile: 20%

Techniques & Countermeasures

• CWE-787•Out-of-bounds Write

  The product writes data past the end, or before the beginning, of the intended buffer.

• CWE-119•Improper Restriction of Operations within the Bounds of a Memory Buffer

  The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Affected Systems

• Unknown•PHP

  < 8.0.22

• redhat•enterprise_linux

  6.0 | 7.0 | 8.0 | 9.0

• redhat•software_collections

  na

References (4)

• https://access.redhat.com/security/cve/CVE-2022-4900
• https://bugzilla.redhat.com/show_bug.cgi?id=2179880
• https://security.netapp.com/advisory/ntap-20231130-0008/
• https://lists.debian.org/debian-lts-announce/2024/10/msg00011.html