CVE-2023-3823
published 2023-08-11CVE-2023-3823: In PHP versions 8.0.* before 8.0.30, 8.1.* before 8.1.22, and 8.2.* before 8.2.8 various XML functions rely on libxml global state to track configuration…
PriorityP344high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EPSS
1.21%
65.0th percentile
In PHP versions 8.0.* before 8.0.30, 8.1.* before 8.1.22, and 8.2.* before 8.2.8 various XML functions rely on libxml global state to track configuration variables, like whether external entities are loaded. This state is assumed to be unchanged unless the user explicitly changes it by calling appropriate function. However, since the state is process-global, other modules - such as ImageMagick - may also use this library within the same process, and change that global state for their internal purposes, and leave it in a state where external entities loading is enabled. This can lead to the situation where external XML is parsed with external entities loaded, which can lead to disclosure of any local files accessible to PHP. This vulnerable state may persist in the same process across many requests, until the process is shut down.
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | php7.4 | < php7.4 7.4.33-1+deb11u5 (bullseye) | php7.4 7.4.33-1+deb11u5 (bullseye) |
| debian | php8.2 | < php7.4 7.4.33-1+deb11u5 (bullseye) | php7.4 7.4.33-1+deb11u5 (bullseye) |
| fedoraproject | fedora | — | — |
| msrc | azl3_php_8.3.19-1_on_azure_linux_3.0 | — | — |
| msrc | cbl2_php_8.1.22-1_on_cbl_mariner_2.0 | — | — |
| php | php | >= 8.0.0 < 8.0.30 | 8.0.30 |
| php | php | >= 8.1.0 < 8.1.22 | 8.1.22 |
| php | php | >= 8.2.0 < 8.2.9 | 8.2.9 |
| php_group | php | >= 8.0.* < 8.0.30 | 8.0.30 |
| php_group | php | >= 8.1.* < 8.1.22 | 8.1.22 |
| php_group | php | >= 8.2.* < 8.2.8 | 8.2.8 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
osv7.5HIGH
vendor_debian8.6HIGH
vendor_msrc8.6HIGH
vendor_redhat8.6HIGH
vendor_ubuntu8.6HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
PHP regression
vendor_ubuntu·2024-07-03·CVSS 8.6
CVE-2023-3823 [HIGH] PHP regression
Title: PHP regression
Summary: USN-6305-2 caused a regression in parsing XML.
USN-6305-2 fixed a vulnerability in PHP. The update caused a regression
in Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. This update fix it.
Original advisory details:
It was discovered that PHP incorrectly handled certain XML files.
An attacker could possibly use this issue to expose sensitive information.
(CVE-2023-3823)
It was discovered that PHP incorrectly handled certain PHAR files.
An attacker could possibly use this issue to cause a crash,
expose sensitive information or execute arbitrary code.
(CVE-2023-3824)
Instructions: In general, a standard system update will make all the necessary changes.
Ubuntu
PHP vulnerabilities
vendor_ubuntu·2024-02-27·CVSS 8.6
CVE-2023-3823 [HIGH] PHP vulnerabilities
Title: PHP vulnerabilities
Summary: Several security issues were fixed in PHP.
USN-6305-1 fixed several vulnerabilities in PHP. This update provides
the corresponding update for Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS.
Original advisory details:
It was discovered that PHP incorrectly handled certain XML files.
An attacker could possibly use this issue to expose sensitive information.
(CVE-2023-3823)
It was discovered that PHP incorrectly handled certain PHAR files.
An attacker could possibly use this issue to cause a crash,
expose sensitive information or execute arbitrary code.
(CVE-2023-3824)
Instructions: In general, a standard system update will make all the necessary changes.
Ubuntu
PHP vulnerabilities
vendor_ubuntu·2023-08-23·CVSS 8.6
CVE-2023-3824 [HIGH] PHP vulnerabilities
Title: PHP vulnerabilities
Summary: Several security issues were fixed in PHP.
It was discovered that PHP incorrectly handled certain XML files.
An attacker could possibly use this issue to expose sensitive information.
(CVE-2023-3823)
It was discovered that PHP incorrectly handled certain PHAR files.
An attacker could possibly use this issue to cause a crash,
expose sensitive information or execute arbitrary code.
(CVE-2023-3824)
Instructions: In general, a standard system update will make all the necessary changes.
Microsoft
Security issue with external entity loading in XML without enabling it
vendor_msrc·2023-08-08·CVSS 8.6
CVE-2023-3823 [HIGH] CWE-611 Security issue with external entity loading in XML without enabling it
Security issue with external entity loading in XML without enabling it
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
php: php
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Reference: ht
Red Hat
php: XML loading external entity without being enabled
vendor_redhat·2023-08-03·CVSS 8.6
CVE-2023-3823 [HIGH] CWE-611 php: XML loading external entity without being enabled
php: XML loading external entity without being enabled
In PHP versions 8.0.* before 8.0.30, 8.1.* before 8.1.22, and 8.2.* before 8.2.8 various XML functions rely on libxml global state to track configuration variables, like whether external entities are loaded. This state is assumed to be unchanged unless the user explicitly changes it by calling appropriate function. However, since the state is process-global, other modules - such as ImageMagick - may also use this library within the same process, and change that global state for their internal purposes, and leave it in a state where external entities loading is enabled. This can lead to the situation where external XML is parsed with external entities loaded, which can lead to disclosure of any local files accessible to PHP. This vulne
Debian
CVE-2023-3823: php7.4 - In PHP versions 8.0.* before 8.0.30, 8.1.* before 8.1.22, and 8.2.* before 8.2.8...
vendor_debian·2023·CVSS 8.6
CVE-2023-3823 [HIGH] CVE-2023-3823: php7.4 - In PHP versions 8.0.* before 8.0.30, 8.1.* before 8.1.22, and 8.2.* before 8.2.8...
In PHP versions 8.0.* before 8.0.30, 8.1.* before 8.1.22, and 8.2.* before 8.2.8 various XML functions rely on libxml global state to track configuration variables, like whether external entities are loaded. This state is assumed to be unchanged unless the user explicitly changes it by calling appropriate function. However, since the state is process-global, other modules - such as ImageMagick - may also use this library within the same process, and change that global state for their internal purposes, and leave it in a state where external entities loading is enabled. This can lead to the situation where external XML is parsed with external entities loaded, which can lead to disclosure of any local files accessible to PHP. This vulnerable state may persist in the same process across many
OSV
php7.0 and php7.2 regression
osv·2024-07-03·CVSS 7.5
CVE-2023-3823 [HIGH] php7.0 and php7.2 regression
php7.0 and php7.2 regression
USN-6305-2 fixed a vulnerability in PHP. The update caused a regression
in Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. This update fix it.
Original advisory details:
It was discovered that PHP incorrectly handled certain XML files.
An attacker could possibly use this issue to expose sensitive information.
(CVE-2023-3823)
It was discovered that PHP incorrectly handled certain PHAR files.
An attacker could possibly use this issue to cause a crash,
expose sensitive information or execute arbitrary code.
(CVE-2023-3824)
OSV
php7.0, php7.2, php7.4 vulnerabilities
osv·2024-02-27·CVSS 7.5
CVE-2023-3823 [HIGH] php7.0, php7.2, php7.4 vulnerabilities
php7.0, php7.2, php7.4 vulnerabilities
USN-6305-1 fixed several vulnerabilities in PHP. This update provides
the corresponding update for Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS.
Original advisory details:
It was discovered that PHP incorrectly handled certain XML files.
An attacker could possibly use this issue to expose sensitive information.
(CVE-2023-3823)
It was discovered that PHP incorrectly handled certain PHAR files.
An attacker could possibly use this issue to cause a crash,
expose sensitive information or execute arbitrary code.
(CVE-2023-3824)
OSV
php8.1 vulnerabilities
osv·2023-08-23·CVSS 7.5
CVE-2023-3823 [HIGH] php8.1 vulnerabilities
php8.1 vulnerabilities
It was discovered that PHP incorrectly handled certain XML files.
An attacker could possibly use this issue to expose sensitive information.
(CVE-2023-3823)
It was discovered that PHP incorrectly handled certain PHAR files.
An attacker could possibly use this issue to cause a crash,
expose sensitive information or execute arbitrary code.
(CVE-2023-3824)
OSV
CVE-2023-3823: In PHP versions 8
osv·2023-08-11·CVSS 7.5
CVE-2023-3823 [HIGH] CVE-2023-3823: In PHP versions 8
In PHP versions 8.0.* before 8.0.30, 8.1.* before 8.1.22, and 8.2.* before 8.2.8 various XML functions rely on libxml global state to track configuration variables, like whether external entities are loaded. This state is assumed to be unchanged unless the user explicitly changes it by calling appropriate function. However, since the state is process-global, other modules - such as ImageMagick - may also use this library within the same process, and change that global state for their internal purposes, and leave it in a state where external entities loading is enabled. This can lead to the situation where external XML is parsed with external entities loaded, which can lead to disclosure of any local files accessible to PHP. This vulnerable state may persist in the same process across many
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/php/php-src/security/advisories/GHSA-3qrf-m4j2-pcrrhttps://lists.debian.org/debian-lts-announce/2023/09/msg00002.htmlhttps://lists.fedoraproject.org/archives/list/[email protected]/message/7NBF77WN6DTVTY2RE73IGPYD6M4PIAWA/https://security.netapp.com/advisory/ntap-20230825-0001/https://github.com/php/php-src/security/advisories/GHSA-3qrf-m4j2-pcrrhttps://lists.debian.org/debian-lts-announce/2023/09/msg00002.htmlhttps://lists.fedoraproject.org/archives/list/[email protected]/message/7NBF77WN6DTVTY2RE73IGPYD6M4PIAWA/https://security.netapp.com/advisory/ntap-20230825-0001/
2023-08-11
Published