Re: [BLFS Trac] #23607: php-8.5.8

#23607: php-8.5.8
-------------------------+--------------------------
 Reporter:  Joe Locash   |       Owner:  Bruce Dubbs
     Type:  enhancement  |      Status:  assigned
 Priority:  elevated     |   Milestone:  13.1
Component:  BOOK         |     Version:  git
 Severity:  normal       |  Resolution:
 Keywords:               |
-------------------------+--------------------------
Comment (by Bruce Dubbs):

 In PHP versions 8.2.* before 8.2.32, 8.3.* before 8.3.32, 8.4.* before
 8.4.23, 8.5.* before 8.5.8, the AES-WRAP-PAD algorithm implementation in
 OpenSSL extension contains a buffer allocation flaw. The output buffer for
 the AES key-wrap-with-padding operation is sized from the plaintext length
 without accounting for RFC 5649 expansion. This may cause OpenSSL to write
 beyond allocated memory, corrupting heap metadata and triggering
 application abort.

 NIST CVSS Base Score:  5.3 MEDIUM
-- 
Ticket URL: <https://wiki.linuxfromscratch.org/blfs/ticket/23607#comment:3>
BLFS Trac <https://wiki.linuxfromscratch.org/blfs/>
Beyond Linux From Scratch

-- 
http://lists.linuxfromscratch.org/sympa/info/blfs-book
Unsubscribe: See the above information page