CVE-2024-11233
High · 8.2CVSS
8.2
EPSS
1.6%
Published
Nov 24, 2024
CISA due date
—
Cloudanix analysis
Monitor only
SSVC: Track
A flaw in PHP can make programs using certain text encoding functions crash or accidentally reveal other data stored in memory.
- Exploitation
- Remote Authenticated
- Attacker needs
- Low Privilege
- Complexity
- Moderate
- Impact
- Data Exposure
- Component
- Library
- Class
- Memory Corruption
- Remediation
- Upgrade
- Effort
- Medium
- Patch risk
- Low
What it actually does
A one-byte buffer overread in the convert.quoted-printable-decode filter can cause process crashes or disclosure of adjacent memory contents.
Why it matters to the business
PHP-based services may experience unexpected downtime or leak sensitive in-memory data, increasing operational costs and regulatory exposure on widely deployed PHP installations.
How an attack unfolds
An attacker supplies crafted input that passes through the quoted-printable decode filter; the off-by-one read occurs during conversion, potentially crashing the worker or exposing heap/stack fragments.
How to fix it
Upgrade PHP to 8.1.31, 8.2.26 or 8.3.14 (or later) as appropriate for the branch. Apply the listed fixed package versions for each affected Ubuntu release.
How to confirm the fix worked
Confirm the running PHP binary reports a fixed version; execute unit tests that exercise quoted-printable decoding at buffer boundaries and verify absence of crashes or leaks.
Typical attack path
- Locate a PHP application or script that invokes convert.quoted-printable-decode on untrusted data
- Craft a minimal payload that triggers the filter boundary condition
- Deliver the payload via HTTP, email, or other input channel accepted by the application
- Observe crash logs or parse any leaked memory for useful artifacts
How to detect it
Review PHP error and crash logs for segmentation faults or warnings during quoted-printable decode operations; correlate with inbound requests containing encoded payloads around the time of the event.
What your security team should do
- Patch PHP installations to the fixed versions immediately given the 681 days since publication
- Inventory all PHP deployments and prioritize those reachable from untrusted networks
- Add crash-monitoring alerts for PHP workers that reference quoted-printable processing
The record
In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, due to an error in convert.quoted-printable-decode filter certain data can lead to buffer overread by one byte, which can in certain circumstances lead to crashes or disclose content of other memory areas.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| AlmaLinux:8 | apcu-panel | 0 | 5.1.23-1.module_el8.10.0+3796+30ed3ef7 |
| AlmaLinux:8 | libzip | 0 | 1.7.3-1.module_el8.10.0+3796+30ed3ef7 |
| AlmaLinux:8 | libzip-devel | 0 | 1.7.3-1.module_el8.10.0+3796+30ed3ef7 |
| AlmaLinux:8 | libzip-tools | 0 | 1.7.3-1.module_el8.10.0+3796+30ed3ef7 |
| AlmaLinux:8 | php | 0 | 8.2.28-1.module_el8.10.0+4046+958a243a |
| AlmaLinux:8 | php-bcmath | 0 | 8.2.28-1.module_el8.10.0+4046+958a243a |
| AlmaLinux:8 | php-cli | 0 | 8.2.28-1.module_el8.10.0+4046+958a243a |
| AlmaLinux:8 | php-common | 0 | 8.2.28-1.module_el8.10.0+4046+958a243a |
| AlmaLinux:8 | php-dba | 0 | 8.2.28-1.module_el8.10.0+4046+958a243a |
| AlmaLinux:8 | php-dbg | 0 | 8.2.28-1.module_el8.10.0+4046+958a243a |
| AlmaLinux:8 | php-devel | 0 | 8.2.28-1.module_el8.10.0+4046+958a243a |
| AlmaLinux:8 | php-embedded | 0 | 8.2.28-1.module_el8.10.0+4046+958a243a |
| AlmaLinux:8 | php-enchant | 0 | 8.2.28-1.module_el8.10.0+4046+958a243a |
| AlmaLinux:8 | php-ffi | 0 | 8.2.28-1.module_el8.10.0+4046+958a243a |
| AlmaLinux:8 | php-fpm | 0 | 8.2.28-1.module_el8.10.0+4046+958a243a |
| AlmaLinux:8 | php-gd | 0 | 8.2.28-1.module_el8.10.0+4046+958a243a |
| AlmaLinux:8 | php-gmp | 0 | 8.2.28-1.module_el8.10.0+4046+958a243a |
| AlmaLinux:8 | php-intl | 0 | 8.2.28-1.module_el8.10.0+4046+958a243a |
| AlmaLinux:8 | php-ldap | 0 | 8.2.28-1.module_el8.10.0+4046+958a243a |
| AlmaLinux:8 | php-mbstring | 0 | 8.2.28-1.module_el8.10.0+4046+958a243a |
| AlmaLinux:8 | php-mysqlnd | 0 | 8.2.28-1.module_el8.10.0+4046+958a243a |
| AlmaLinux:8 | php-odbc | 0 | 8.2.28-1.module_el8.10.0+4046+958a243a |
| AlmaLinux:8 | php-opcache | 0 | 8.2.28-1.module_el8.10.0+4046+958a243a |
| AlmaLinux:8 | php-pdo | 0 | 8.2.28-1.module_el8.10.0+4046+958a243a |
| AlmaLinux:8 | php-pear | 0 | 1:1.10.14-1.module_el8.10.0+3796+30ed3ef7 |
| AlmaLinux:8 | php-pecl-apcu | 0 | 5.1.23-1.module_el8.10.0+3796+30ed3ef7 |
| AlmaLinux:8 | php-pecl-apcu-devel | 0 | 5.1.23-1.module_el8.10.0+3796+30ed3ef7 |
| AlmaLinux:8 | php-pecl-rrd | 0 | 2.0.3-1.module_el8.10.0+3796+30ed3ef7 |
| AlmaLinux:8 | php-pecl-xdebug3 | 0 | 3.2.2-2.module_el8.10.0+3796+30ed3ef7 |
| AlmaLinux:8 | php-pecl-zip | 0 | 1.22.3-1.module_el8.10.0+3796+30ed3ef7 |
| AlmaLinux:8 | php-pgsql | 0 | 8.2.28-1.module_el8.10.0+4046+958a243a |
| AlmaLinux:8 | php-process | 0 | 8.2.28-1.module_el8.10.0+4046+958a243a |
| AlmaLinux:8 | php-snmp | 0 | 8.2.28-1.module_el8.10.0+4046+958a243a |
| AlmaLinux:8 | php-soap | 0 | 8.2.28-1.module_el8.10.0+4046+958a243a |
| AlmaLinux:8 | php-xml | 0 | 8.2.28-1.module_el8.10.0+4046+958a243a |
| AlmaLinux:9 | apcu-panel | 0 | 5.1.21-1.module_el9.1.0+15+94ba28e4 |
| AlmaLinux:9 | apcu-panel | 0 | 5.1.23-1.module_el9.4.0+65+49ff6472 |
| AlmaLinux:9 | php | 0 | 8.1.32-1.module_el9.5.0+156+9f1cd3fd |
| AlmaLinux:9 | php | 0 | 8.2.28-1.module_el9.6.0+165+cf879a7c |
| AlmaLinux:9 | php-bcmath | 0 | 8.1.32-1.module_el9.5.0+156+9f1cd3fd |
| AlmaLinux:9 | php-bcmath | 0 | 8.2.28-1.module_el9.6.0+165+cf879a7c |
| AlmaLinux:9 | php-cli | 0 | 8.1.32-1.module_el9.5.0+156+9f1cd3fd |
| AlmaLinux:9 | php-cli | 0 | 8.2.28-1.module_el9.6.0+165+cf879a7c |
| AlmaLinux:9 | php-common | 0 | 8.1.32-1.module_el9.5.0+156+9f1cd3fd |
| AlmaLinux:9 | php-common | 0 | 8.2.28-1.module_el9.6.0+165+cf879a7c |
| AlmaLinux:9 | php-dba | 0 | 8.1.32-1.module_el9.5.0+156+9f1cd3fd |
| AlmaLinux:9 | php-dba | 0 | 8.2.28-1.module_el9.6.0+165+cf879a7c |
| AlmaLinux:9 | php-dbg | 0 | 8.1.32-1.module_el9.5.0+156+9f1cd3fd |
| AlmaLinux:9 | php-dbg | 0 | 8.2.28-1.module_el9.6.0+165+cf879a7c |
| AlmaLinux:9 | php-devel | 0 | 8.1.32-1.module_el9.5.0+156+9f1cd3fd |
| AlmaLinux:9 | php-devel | 0 | 8.2.28-1.module_el9.6.0+165+cf879a7c |
| AlmaLinux:9 | php-embedded | 0 | 8.1.32-1.module_el9.5.0+156+9f1cd3fd |
| AlmaLinux:9 | php-embedded | 0 | 8.2.28-1.module_el9.6.0+165+cf879a7c |
| AlmaLinux:9 | php-enchant | 0 | 8.1.32-1.module_el9.5.0+156+9f1cd3fd |
| AlmaLinux:9 | php-enchant | 0 | 8.2.28-1.module_el9.6.0+165+cf879a7c |
| AlmaLinux:9 | php-ffi | 0 | 8.1.32-1.module_el9.5.0+156+9f1cd3fd |
| AlmaLinux:9 | php-ffi | 0 | 8.2.28-1.module_el9.6.0+165+cf879a7c |
| AlmaLinux:9 | php-fpm | 0 | 8.1.32-1.module_el9.5.0+156+9f1cd3fd |
| AlmaLinux:9 | php-fpm | 0 | 8.2.28-1.module_el9.6.0+165+cf879a7c |
| AlmaLinux:9 | php-gd | 0 | 8.1.32-1.module_el9.5.0+156+9f1cd3fd |
| AlmaLinux:9 | php-gd | 0 | 8.2.28-1.module_el9.6.0+165+cf879a7c |
| AlmaLinux:9 | php-gmp | 0 | 8.1.32-1.module_el9.5.0+156+9f1cd3fd |
| AlmaLinux:9 | php-gmp | 0 | 8.2.28-1.module_el9.6.0+165+cf879a7c |
| AlmaLinux:9 | php-intl | 0 | 8.1.32-1.module_el9.5.0+156+9f1cd3fd |
| AlmaLinux:9 | php-intl | 0 | 8.2.28-1.module_el9.6.0+165+cf879a7c |
| AlmaLinux:9 | php-ldap | 0 | 8.1.32-1.module_el9.5.0+156+9f1cd3fd |
| AlmaLinux:9 | php-ldap | 0 | 8.2.28-1.module_el9.6.0+165+cf879a7c |
| AlmaLinux:9 | php-mbstring | 0 | 8.1.32-1.module_el9.5.0+156+9f1cd3fd |
| AlmaLinux:9 | php-mbstring | 0 | 8.2.28-1.module_el9.6.0+165+cf879a7c |
| AlmaLinux:9 | php-mysqlnd | 0 | 8.1.32-1.module_el9.5.0+156+9f1cd3fd |
| AlmaLinux:9 | php-mysqlnd | 0 | 8.2.28-1.module_el9.6.0+165+cf879a7c |
| AlmaLinux:9 | php-odbc | 0 | 8.1.32-1.module_el9.5.0+156+9f1cd3fd |
| AlmaLinux:9 | php-odbc | 0 | 8.2.28-1.module_el9.6.0+165+cf879a7c |
| AlmaLinux:9 | php-opcache | 0 | 8.1.32-1.module_el9.5.0+156+9f1cd3fd |
| AlmaLinux:9 | php-opcache | 0 | 8.2.28-1.module_el9.6.0+165+cf879a7c |
| AlmaLinux:9 | php-pdo | 0 | 8.1.32-1.module_el9.5.0+156+9f1cd3fd |
| AlmaLinux:9 | php-pdo | 0 | 8.2.28-1.module_el9.6.0+165+cf879a7c |
| AlmaLinux:9 | php-pecl-apcu | 0 | 5.1.21-1.module_el9.1.0+15+94ba28e4 |
| AlmaLinux:9 | php-pecl-apcu | 0 | 5.1.23-1.module_el9.4.0+65+49ff6472 |
| AlmaLinux:9 | php-pecl-apcu-devel | 0 | 5.1.21-1.module_el9.1.0+15+94ba28e4 |
| AlmaLinux:9 | php-pecl-apcu-devel | 0 | 5.1.23-1.module_el9.4.0+65+49ff6472 |
| AlmaLinux:9 | php-pecl-rrd | 0 | 2.0.3-4.module_el9.1.0+15+94ba28e4 |
| AlmaLinux:9 | php-pecl-rrd | 0 | 2.0.3-4.module_el9.4.0+65+49ff6472 |
| AlmaLinux:9 | php-pecl-xdebug3 | 0 | 3.1.4-1.module_el9.1.0+15+94ba28e4 |
| AlmaLinux:9 | php-pecl-xdebug3 | 0 | 3.2.2-2.module_el9.4.0+65+49ff6472 |
| AlmaLinux:9 | php-pecl-zip | 0 | 1.20.1-1.module_el9.1.0+15+94ba28e4 |
| AlmaLinux:9 | php-pecl-zip | 0 | 1.22.3-1.module_el9.4.0+65+49ff6472 |
| AlmaLinux:9 | php-pgsql | 0 | 8.1.32-1.module_el9.5.0+156+9f1cd3fd |
| AlmaLinux:9 | php-pgsql | 0 | 8.2.28-1.module_el9.6.0+165+cf879a7c |
| AlmaLinux:9 | php-process | 0 | 8.1.32-1.module_el9.5.0+156+9f1cd3fd |
| AlmaLinux:9 | php-process | 0 | 8.2.28-1.module_el9.6.0+165+cf879a7c |
| AlmaLinux:9 | php-snmp | 0 | 8.1.32-1.module_el9.5.0+156+9f1cd3fd |
| AlmaLinux:9 | php-snmp | 0 | 8.2.28-1.module_el9.6.0+165+cf879a7c |
| AlmaLinux:9 | php-soap | 0 | 8.1.32-1.module_el9.5.0+156+9f1cd3fd |
| AlmaLinux:9 | php-soap | 0 | 8.2.28-1.module_el9.6.0+165+cf879a7c |
| AlmaLinux:9 | php-xml | 0 | 8.1.32-1.module_el9.5.0+156+9f1cd3fd |
| AlmaLinux:9 | php-xml | 0 | 8.2.28-1.module_el9.6.0+165+cf879a7c |
| Bitnami | libphp | 0 | 8.1.31 |
| Bitnami | php | 0 | 8.1.31 |
| Bitnami | php | 8.1.0 | 8.1.31 |
| Bitnami | php-min | 0 | 8.1.31 |
| Bitnami | php-min | 8.1.0 | 8.1.31 |
| Chainguard | php-8.1 | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-apache | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-bcmath | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-bcmath-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-bz2 | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-bz2-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-calendar | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-calendar-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-cgi | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-ctype | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-ctype-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-curl | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-curl-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-dbg | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-dev | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-doc | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-dom | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-dom-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-exif | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-exif-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-fileinfo | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-fileinfo-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-fpm | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-fpm-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-ftp | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-ftp-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-gd | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-gd-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-gettext | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-gettext-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-gmp | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-gmp-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-iconv | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-iconv-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-intl | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-intl-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-ldap | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-ldap-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-mbstring | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-mbstring-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-mysqli | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-mysqli-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-mysqlnd | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-mysqlnd-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-odbc | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-odbc-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-opcache | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-opcache-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-openssl | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-openssl-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-pcntl | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-pcntl-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-pdo | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-pdo-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-pdo_dblib | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-pdo_dblib-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-pdo_mysql | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-pdo_mysql-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-pdo_odbc | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-pdo_odbc-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-pdo_pgsql | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-pdo_pgsql-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-pdo_sqlite | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-pdo_sqlite-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-pear | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-pgsql | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-pgsql-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-phar | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-phar-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-posix | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-posix-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-simplexml | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-simplexml-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-soap | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-soap-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-sockets | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-sockets-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-sodium | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-sodium-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-sysvsem | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-sysvsem-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-sysvshm | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-sysvshm-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-xml | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-xml-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-xmlreader | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-xmlreader-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-xmlwriter | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-xmlwriter-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-xsl | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-xsl-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-zip | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-zip-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.2 | 0 | 8.2.26-r0 |
| Chainguard | php-8.2-apache | 0 | 8.2.26-r0 |
| Chainguard | php-8.2-bcmath | 0 | 8.2.26-r0 |
| Chainguard | php-8.2-bcmath-config | 0 | 8.2.26-r0 |
Related vulnerabilities
- CVE-2024-11234 In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, when using… Also affects apcu-panel
- CVE-2024-8929 In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, a hostile… Also affects apcu-panel
- CVE-2024-9026 In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using… Also affects apcu-panel
- CVE-2024-8927 In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12… Also affects apcu-panel
- CVE-2024-8925 In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, erroneous… Also affects apcu-panel
- CVE-2024-2756 Due to an incomplete fix to CVE-2022-31629 https://github.com/advisories/GHSA-c43m-486j-j… Also affects apcu-panel
- CVE-2023-0567 In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, password_verify()… Also affects apcu-panel
- CVE-2022-31631 A flaw was found in PHP. Also affects apcu-panel