CVE-2023-0568CWE-131

Array overrun in common path resolve code

High · published February 16, 2023

CVSS v3.1
7.5
EPSS
1%
Percentile
69.0
In the wild
Unconfirmed
What it is

In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, core path resolution function allocate buffer one byte too small. When resolving paths with lengths close to system MAXPATHLEN setting, this may lead to the byte after the allocated buffer being overwritten with NUL value, which might lead to unauthorized data access or modification.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01242 · 69.0th percentile
Weakness
CWE-131 · Incorrect Calculation of Buffer Size
Published
2023-02-16T06:34Z
EPSS history
Timeline
  • 16 FEB 06:34Z
    Array overrun in common path resolve code
    cvelistv5