CVE-2022-31625

Description

In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when using Postgres database extension, supplying invalid parameters to the parametrized query may lead to PHP attempting to free memory using uninitialized data as pointers. This could lead to RCE vulnerability or denial of service.

References

https://www.debian.org/security/2022/dsa-5179

https://security.netapp.com/advisory/ntap-20220722-0005/

https://security.gentoo.org/glsa/202209-20

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZZTZQKRGEYJT5UB4FGG3MOE72SQUHSL4/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3T4MMEEZYYAEHPQMZDFN44PHORJWJFZQ/

https://lists.debian.org/debian-lts-announce/2022/12/msg00030.html

https://bugs.php.net/bug.php?id=81720

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3