CVE-2022-31625CWE-590CWE-824

Freeing unallocated memory in php_pgsql_free_params()

High · published June 16, 2022

CVSS v3.1
8.1
EPSS
4%
Percentile
89.9
In the wild
Unconfirmed
What it is

In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when using Postgres database extension, supplying invalid parameters to the parametrized query may lead to PHP attempting to free memory using uninitialized data as pointers. This could lead to RCE vulnerability or denial of service.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.03790 · 89.9th percentile
Weaknesses
CWE-590 · Free of Memory not on the Heap; CWE-824 · Access of Uninitialized Pointer
Published
2022-06-16T05:45Z
EPSS history
Timeline
  • 16 JUN 05:45Z
    Freeing unallocated memory in php_pgsql_free_params()
    cvelistv5