CVE-2022-31625

Freeing unallocated memory in php_pgsql_free_params()

State: Published
Severity: 8.1 High
Published: Jun 16, 2022
Updated: Sep 16, 2024
Reserved: May 25, 2022

Description

In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when using Postgres database extension, supplying invalid parameters to the parametrized query may lead to PHP attempting to free memory using uninitialized data as pointers. This could lead to RCE vulnerability or denial of service.

Scores

CVSS	Score	Vector	Source
3.1	8.1 High	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H	php

Weaknesses

CWE-590 Free of Memory not on the Heap
CWE-824 Access of Uninitialized Pointer

Affected Products

Product	Versions
PHPPHP Group	7.4.X to before 7.4.30Affected 8.0.X to before 8.0.20Affected 8.1.X to before 8.1.7Affected

References

https://bugs.php.net/bug.php?id=81720
FEDORA-2022-0a96e5b9b1vendor-advisory
FEDORA-2022-f3fc52428evendor-advisory
DSA-5179vendor-advisory
https://security.netapp.com/advisory/ntap-20220722-0005/
GLSA-202209-20vendor-advisory
[debian-lts-announce] 20221215 [SECURITY] [DLA 3243-1] php7.3 security updatemailing-list

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.