What’s Vulnerable › Vulnerabilities
CVE-2023-3824: Buffer overflow and overread in phar_dir_read()
- Severity: critical (CVSS 9.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 21.8% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2023-08-11 · updated 2026-06-17
- Weakness: CWE-119
Description
In PHP version 8.0.* before 8.0.30, 8.1.* before 8.1.22, and 8.2.* before 8.2.8, when loading phar file, while reading PHAR directory entries, insufficient length checking may lead to a stack buffer overflow, leading potentially to memory corruption or RCE.
Affected products
- Debian Linux: 10.0
- Fedoraproject Fedora: 38
- PHP: from 8.0.0 before 8.0.30; from 8.1.0 before 8.1.22; from 8.2.0 before 8.2.9 — fixed in 8.0.30, 8.1.22, 8.2.9
How to fix
Upgrade to a fixed version: PHP 8.0.30, 8.1.22, 8.2.9. Check the vendor advisory for mitigations.
References
- https://github.com/php/php-src/security/advisories/GHSA-jqcx-ccgc-xwhv
- https://lists.debian.org/debian-lts-announce/2023/09/msg00002.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7NBF77WN6DTVTY2RE73IGPYD6M4PIAWA/
- https://security.netapp.com/advisory/ntap-20230825-0001/
- https://github.com/php/php-src/security/advisories/GHSA-jqcx-ccgc-xwhv
- https://lists.debian.org/debian-lts-announce/2023/09/msg00002.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7NBF77WN6DTVTY2RE73IGPYD6M4PIAWA/
- https://security.netapp.com/advisory/ntap-20230825-0001/
Get alerted when CVE-2023-3824 or the next vulnerability affects your stack