CVE-2023-3824
published 2023-08-11CVE-2023-3824: In PHP version 8.0.* before 8.0.30, 8.1.* before 8.1.22, and 8.2.* before 8.2.8, when loading phar file, while reading PHAR directory entries, insufficient…
PriorityP185critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
ITWVulnCheck KEVRansomware
Exploited in the wild
EPSS
21.79%
97.6th percentile
In PHP version 8.0.* before 8.0.30, 8.1.* before 8.1.22, and 8.2.* before 8.2.8, when loading phar file, while reading PHAR directory entries, insufficient length checking may lead to a stack buffer overflow, leading potentially to memory corruption or RCE.
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | php7.4 | < php7.4 7.4.33-1+deb11u5 (bullseye) | php7.4 7.4.33-1+deb11u5 (bullseye) |
| debian | php8.2 | < php7.4 7.4.33-1+deb11u5 (bullseye) | php7.4 7.4.33-1+deb11u5 (bullseye) |
| fedoraproject | fedora | — | — |
| msrc | azl3_php_8.3.19-1_on_azure_linux_3.0 | — | — |
| msrc | cbl2_php_8.1.22-1_on_cbl_mariner_2.0 | — | — |
| php | php | >= 8.0.0 < 8.0.30 | 8.0.30 |
| php | php | >= 8.1.0 < 8.1.22 | 8.1.22 |
| php | php | >= 8.2.0 < 8.2.9 | 8.2.9 |
| php_group | php | >= 8.0.* < 8.0.30 | 8.0.30 |
| php_group | php | >= 8.1.* < 8.1.22 | 8.1.22 |
| php_group | php | >= 8.2.* < 8.2.8 | 8.2.8 |
Detection & IOCsextracted from sources · hover to see the quote
- →Trigger condition is loading a specially crafted .phar archive that causes a stack buffer overflow in phar_dir_read() due to insufficient length checking on PHAR directory entries ↗
- →Vulnerable function is phar_dir_read(); monitor for crashes or anomalous memory behavior when PHP processes .phar files via this function ↗
- →Attack vector is remote over HTTP (no authentication required); prioritize detection on internet-facing PHP applications that accept or process user-supplied .phar files ↗
- ·Affected PHP versions are 8.0.* before 8.0.30, 8.1.* before 8.1.22, and 8.2.* before 8.2.8; versions outside these ranges (e.g., PHP 7.x) are not affected per Red Hat analysis ↗
- ·Red Hat Enterprise Linux 6, 7, and OpenShift Dev Spaces are confirmed not affected; rh-php73-php (RHSCL) will not be fixed ↗
- ·Ubuntu USN-6305-2 patch for this CVE introduced a regression in XML parsing on Ubuntu 16.04 LTS and 18.04 LTS; USN-6305-3 was issued to correct it — verify the regression fix is also applied ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
osv9.8CRITICAL
vulncheck9.4CRITICAL
vendor_oracle9.8CRITICAL
vendor_debian9.4CRITICAL
vendor_msrc9.4CRITICAL
vendor_redhat9.4CRITICAL
vendor_ubuntu8.6HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
PHP regression
vendor_ubuntu·2024-07-03·CVSS 8.6
CVE-2023-3823 [HIGH] PHP regression
Title: PHP regression
Summary: USN-6305-2 caused a regression in parsing XML.
USN-6305-2 fixed a vulnerability in PHP. The update caused a regression
in Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. This update fix it.
Original advisory details:
It was discovered that PHP incorrectly handled certain XML files.
An attacker could possibly use this issue to expose sensitive information.
(CVE-2023-3823)
It was discovered that PHP incorrectly handled certain PHAR files.
An attacker could possibly use this issue to cause a crash,
expose sensitive information or execute arbitrary code.
(CVE-2023-3824)
Instructions: In general, a standard system update will make all the necessary changes.
Ubuntu
PHP vulnerabilities
vendor_ubuntu·2024-02-27·CVSS 8.6
CVE-2023-3823 [HIGH] PHP vulnerabilities
Title: PHP vulnerabilities
Summary: Several security issues were fixed in PHP.
USN-6305-1 fixed several vulnerabilities in PHP. This update provides
the corresponding update for Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS.
Original advisory details:
It was discovered that PHP incorrectly handled certain XML files.
An attacker could possibly use this issue to expose sensitive information.
(CVE-2023-3823)
It was discovered that PHP incorrectly handled certain PHAR files.
An attacker could possibly use this issue to cause a crash,
expose sensitive information or execute arbitrary code.
(CVE-2023-3824)
Instructions: In general, a standard system update will make all the necessary changes.
Oracle
Oracle Oracle Communications Risk Matrix: Platform (PHP) — CVE-2023-3824
vendor_oracle·2023-10-15·CVSS 9.8
CVE-2023-3824 [CRITICAL] Oracle Oracle Communications Risk Matrix: Platform (PHP) — CVE-2023-3824
Oracle Oracle Communications Risk Matrix: Platform (PHP) vulnerability
CVE: CVE-2023-3824
CVSS: 9.8
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpuoct2023 (OCT 2023)
Ubuntu
PHP vulnerabilities
vendor_ubuntu·2023-08-23·CVSS 8.6
CVE-2023-3824 [HIGH] PHP vulnerabilities
Title: PHP vulnerabilities
Summary: Several security issues were fixed in PHP.
It was discovered that PHP incorrectly handled certain XML files.
An attacker could possibly use this issue to expose sensitive information.
(CVE-2023-3823)
It was discovered that PHP incorrectly handled certain PHAR files.
An attacker could possibly use this issue to cause a crash,
expose sensitive information or execute arbitrary code.
(CVE-2023-3824)
Instructions: In general, a standard system update will make all the necessary changes.
Microsoft
Buffer overflow and overread in phar_dir_read()
vendor_msrc·2023-08-08·CVSS 9.4
CVE-2023-3824 [CRITICAL] CWE-119 Buffer overflow and overread in phar_dir_read()
Buffer overflow and overread in phar_dir_read()
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
php: php
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Reference: https://learn.microsoft.c
Red Hat
php: phar Buffer mismanagement
vendor_redhat·2023-08-03·CVSS 9.4
CVE-2023-3824 [CRITICAL] CWE-119 php: phar Buffer mismanagement
php: phar Buffer mismanagement
In PHP version 8.0.* before 8.0.30, 8.1.* before 8.1.22, and 8.2.* before 8.2.8, when loading phar file, while reading PHAR directory entries, insufficient length checking may lead to a stack buffer overflow, leading potentially to memory corruption or RCE.
A flaw was found in PHP that can lead to a buffer overflow and a stack information leak due to improper bounds checking within the phar_dir_read() function. This issue may allow an attacker to initiate memory corruption by compelling the application to open a specially crafted .phar archive, allowing the attacker to corrupt memory or cause a denial of service condition.
Package: php (Red Hat Enterprise Linux 6) - Not affected
Package: php (Red Hat Enterprise Linux 7) - Not affected
Package: php (Red H
Debian
CVE-2023-3824: php7.4 - In PHP version 8.0.* before 8.0.30, 8.1.* before 8.1.22, and 8.2.* before 8.2.8...
vendor_debian·2023·CVSS 9.4
CVE-2023-3824 [CRITICAL] CVE-2023-3824: php7.4 - In PHP version 8.0.* before 8.0.30, 8.1.* before 8.1.22, and 8.2.* before 8.2.8...
In PHP version 8.0.* before 8.0.30, 8.1.* before 8.1.22, and 8.2.* before 8.2.8, when loading phar file, while reading PHAR directory entries, insufficient length checking may lead to a stack buffer overflow, leading potentially to memory corruption or RCE.
Scope: local
bullseye: resolved (fixed in 7.4.33-1+deb11u5)
OSV
php7.0 and php7.2 regression
osv·2024-07-03·CVSS 7.5
CVE-2023-3823 [HIGH] php7.0 and php7.2 regression
php7.0 and php7.2 regression
USN-6305-2 fixed a vulnerability in PHP. The update caused a regression
in Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. This update fix it.
Original advisory details:
It was discovered that PHP incorrectly handled certain XML files.
An attacker could possibly use this issue to expose sensitive information.
(CVE-2023-3823)
It was discovered that PHP incorrectly handled certain PHAR files.
An attacker could possibly use this issue to cause a crash,
expose sensitive information or execute arbitrary code.
(CVE-2023-3824)
OSV
php7.0, php7.2, php7.4 vulnerabilities
osv·2024-02-27·CVSS 7.5
CVE-2023-3823 [HIGH] php7.0, php7.2, php7.4 vulnerabilities
php7.0, php7.2, php7.4 vulnerabilities
USN-6305-1 fixed several vulnerabilities in PHP. This update provides
the corresponding update for Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS.
Original advisory details:
It was discovered that PHP incorrectly handled certain XML files.
An attacker could possibly use this issue to expose sensitive information.
(CVE-2023-3823)
It was discovered that PHP incorrectly handled certain PHAR files.
An attacker could possibly use this issue to cause a crash,
expose sensitive information or execute arbitrary code.
(CVE-2023-3824)
OSV
php8.1 vulnerabilities
osv·2023-08-23·CVSS 7.5
CVE-2023-3823 [HIGH] php8.1 vulnerabilities
php8.1 vulnerabilities
It was discovered that PHP incorrectly handled certain XML files.
An attacker could possibly use this issue to expose sensitive information.
(CVE-2023-3823)
It was discovered that PHP incorrectly handled certain PHAR files.
An attacker could possibly use this issue to cause a crash,
expose sensitive information or execute arbitrary code.
(CVE-2023-3824)
OSV
CVE-2023-3824: In PHP version 8
osv·2023-08-11·CVSS 9.8
CVE-2023-3824 [CRITICAL] CVE-2023-3824: In PHP version 8
In PHP version 8.0.* before 8.0.30, 8.1.* before 8.1.22, and 8.2.* before 8.2.8, when loading phar file, while reading PHAR directory entries, insufficient length checking may lead to a stack buffer overflow, leading potentially to memory corruption or RCE.
VulnCheck
PHP PHP Improper Restriction of Operations within the Bounds of a Memory Buffer
vulncheck·2023·CVSS 9.4
CVE-2023-3824 [CRITICAL] PHP PHP Improper Restriction of Operations within the Bounds of a Memory Buffer
PHP PHP Improper Restriction of Operations within the Bounds of a Memory Buffer
In PHP version 8.0.* before 8.0.30, 8.1.* before 8.1.22, and 8.2.* before 8.2.8, when loading phar file, while reading PHAR directory entries, insufficient length checking may lead to a stack buffer overflow, leading potentially to memory corruption or RCE.
Affected: PHP PHP
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Known Ransomware Campaign Use: Known
Exploitation References: https://8813571.fs1.hubspotusercontent-na1.net/hubfs/8813571/The%20471%20Cyber%20Threat%20Report%202024.pdf; https://decoded.avast.io/threatresearch/avast-q1-2024-threat-report/; https://intel471.com/blog/assessing-the-di
No detection rules found.
No public exploits indexed.
Bleepingcomputer
LockBit ransomware returns, restores servers after police disruption
blogs_bleepingcomputer·2024-02-25
LockBit ransomware returns, restores servers after police disruption
## LockBit ransomware returns, restores servers after police disruption
## Ionut Ilascu
The LockBit gang is relaunching its ransomware operation on a new infrastructure less than a week after law enforcement hacked their servers, and is threatening to focus more of their attacks on the government sector.
In a message under a mock-up FBI leak - specifically to draw attention, the gang published a lengthy message about their negligence enabling the breach and the plans for the operation going forward.
## LockBit ransomware continues attacks
On February 19, authorities took down LockBit’s infrastructure, which included 34 servers hosting the data leak website and its mirrors, data stolen from the victims, cryptocurrency addresses, decryption keys, and the affiliate panel.
Five days late
Qualys
Oracle Patch Tuesday, October 2023 Security Update Review | Qualys
blogs_qualys·2023-10-18
Oracle Patch Tuesday, October 2023 Security Update Review | Qualys
#### Table of Contents
- Qualys QID Coverage
- Notable Oracle Vulnerabilities Patched
- Discover and Prioritize Vulnerabilities in Vulnerability Management, Detection & Response (VMDR)
- Rapid Response with Patch Management (PM)
Oracle has released its fourth quarterly edition of Critical Patch Update, which contains a group of patches for 387 security vulnerabilities. Some of the vulnerabilities addressed in this update impact more than one product. These patches address vulnerabilities in Oracle code and third-party components included in Oracle products.
During the Q4 2023 Oracle Critical Patch Update, Oracle Financial Services Applications received the highest number of 103 patches, constituting 26% of the total patches released. Oracle Communications and Oracle Fusion Middleware fo
Qualys
Oracle Patch Tuesday, October 2023 Security Update Review
blogs_qualys·2023-10-18
Oracle Patch Tuesday, October 2023 Security Update Review
## Table of Contents
Qualys QID Coverage
Notable Oracle Vulnerabilities Patched
Discover and Prioritize Vulnerabilities in Vulnerability Management, Detection & Response (VMDR)
Rapid Response with Patch Management (PM)
Oracle has released its fourth quarterly edition of Critical Patch Update, which contains a group of patches for 387 security vulnerabilities. Some of the vulnerabilities addressed in this update impact more than one product. These patches address vulnerabilities in Oracle code and third-party components included in Oracle products.
During the Q4 2023 Oracle Critical Patch Update, Oracle Financial Services Applications received the highest number of 103 patches, constituting 26% of the total patches released. Oracle Communications and Oracle Fusion Middleware followed,
https://github.com/php/php-src/security/advisories/GHSA-jqcx-ccgc-xwhvhttps://lists.debian.org/debian-lts-announce/2023/09/msg00002.htmlhttps://lists.fedoraproject.org/archives/list/[email protected]/message/7NBF77WN6DTVTY2RE73IGPYD6M4PIAWA/https://security.netapp.com/advisory/ntap-20230825-0001/https://github.com/php/php-src/security/advisories/GHSA-jqcx-ccgc-xwhvhttps://lists.debian.org/debian-lts-announce/2023/09/msg00002.htmlhttps://lists.fedoraproject.org/archives/list/[email protected]/message/7NBF77WN6DTVTY2RE73IGPYD6M4PIAWA/https://security.netapp.com/advisory/ntap-20230825-0001/
2023-08-11
Published
Exploited in the wild