{"id":"CVE-2024-11236","aliases":["ALPINE-CVE-2024-11236","AZL-53447","AZL-53718","BELL-CVE-2024-11236","BIT-libphp-2024-11236","BIT-php-2024-11236","BIT-php-min-2024-11236","CLSA-2025-1761082274","DEBIAN-CVE-2024-11236","DLA-3986-1","DSA-5819-1","EUVD-2024-33767","GHSA-5hqh-c84r-qjcv","MGASA-2024-0375","OESA-2024-2478","SUSE-SU-2024:4136-1","UBUNTU-CVE-2024-11236","USN-7153-1","USN-7157-1","openSUSE-SU-2024:14521-1"],"status":"published","title":"Integer overflow in the firebird and dblib quoters causing OOB writes","description":"In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, uncontrolled long string inputs to ldap_escape() function on 32-bit systems can cause an integer overflow, resulting in an out-of-bounds write.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.02065,"percentile":0.81516,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-190","CWE-787"],"published":"2024-11-22T12:50:39.463673Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Alpine:v3.19","package":"php81","fixed_in":["8.1.31-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"php83","fixed_in":["8.3.14-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"php83","fixed_in":["8.3.14-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"php83","fixed_in":["8.3.14-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"php83","fixed_in":["8.3.14-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"php83","fixed_in":["8.3.14-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"php","fixed_in":["8.3.14-1"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"php","fixed_in":["8.1.31-1"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"php81","fixed_in":["8.1.31-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"php83","fixed_in":["8.3.14-r0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"libphp","fixed_in":["8.1.31","8.2.26","8.3.14"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"php","fixed_in":["8.1.31","8.2.26","8.3.14"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"php-min","fixed_in":["8.1.31","8.2.26","8.3.14"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"php8.2","fixed_in":["8.2.26-1~deb12u1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"php7.0","fixed_in":["7.0.33-0ubuntu0.16.04.16+esm13"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"php7.2","fixed_in":["7.2.24-0ubuntu0.18.04.17+esm7"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"php7.4","fixed_in":["7.4.3-4ubuntu2.26"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"php8.1","fixed_in":["8.1.2-1ubuntu2.20"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"php8.3","fixed_in":["8.3.6-0ubuntu0.24.04.3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.19","package":"php81","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.1.31-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"php83","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.3.14-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"php83","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.3.14-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"php83","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.3.14-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"php83","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.3.14-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"php83","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.3.14-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"php","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.3.14-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"php","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.1.31-1"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"php81","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.1.19-r0"},{"fixed":"8.1.31-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"php83","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.3.4-r2"},{"fixed":"8.3.14-r0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"libphp","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"8.1.31"},{"introduced":"8.2.0"},{"fixed":"8.2.26"},{"introduced":"8.3.0"},{"fixed":"8.3.14"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"php","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"8.1.31"},{"introduced":"8.2.0"},{"fixed":"8.2.26"},{"introduced":"8.3.0"},{"fixed":"8.3.14"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"php-min","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"8.1.31"},{"introduced":"8.2.0"},{"fixed":"8.2.26"},{"introduced":"8.3.0"},{"fixed":"8.3.14"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libapache2-mod-php7.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.3.31-1~deb10u7+tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libphp7.3-embed","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.3.31-1~deb10u7+tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"php7.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.3.31-1~deb10u7+tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"php7.3-bcmath","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.3.31-1~deb10u7+tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"php7.3-bz2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.3.31-1~deb10u7+tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"php7.3-cgi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.3.31-1~deb10u7+tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"php7.3-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.3.31-1~deb10u7+tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"php7.3-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.3.31-1~deb10u7+tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"php7.3-curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.3.31-1~deb10u7+tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"php7.3-dba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.3.31-1~deb10u7+tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"php7.3-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.3.31-1~deb10u7+tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"php7.3-enchant","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.3.31-1~deb10u7+tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"php7.3-fpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.3.31-1~deb10u7+tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"php7.3-gd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.3.31-1~deb10u7+tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"php7.3-gmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.3.31-1~deb10u7+tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"php7.3-imap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.3.31-1~deb10u7+tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"php7.3-interbase","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.3.31-1~deb10u7+tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"php7.3-intl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.3.31-1~deb10u7+tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"php7.3-json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.3.31-1~deb10u7+tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"php7.3-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.3.31-1~deb10u7+tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"php7.3-mbstring","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.3.31-1~deb10u7+tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"php7.3-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.3.31-1~deb10u7+tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"php7.3-odbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.3.31-1~deb10u7+tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"php7.3-opcache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.3.31-1~deb10u7+tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"php7.3-pgsql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.3.31-1~deb10u7+tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"php7.3-phpdbg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.3.31-1~deb10u7+tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"php7.3-pspell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.3.31-1~deb10u7+tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"php7.3-readline","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.3.31-1~deb10u7+tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"php7.3-recode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.3.31-1~deb10u7+tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"php7.3-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.3.31-1~deb10u7+tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"php7.3-soap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.3.31-1~deb10u7+tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"php7.3-sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.3.31-1~deb10u7+tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"php7.3-sybase","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.3.31-1~deb10u7+tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"php7.3-tidy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.3.31-1~deb10u7+tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"php7.3-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.3.31-1~deb10u7+tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"php7.3-xmlrpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.3.31-1~deb10u7+tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"php7.3-xsl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.3.31-1~deb10u7+tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"php7.3-zip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.3.31-1~deb10u7+tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"Debian:12","package":"php8.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.26-1~deb12u1"}]}],"versions":["8.2.10-1","8.2.10-2","8.2.12-1","8.2.16-1","8.2.16-2","8.2.17-1","8.2.18-1","8.2.18-1~deb12u1","8.2.20-1~deb12u1","8.2.20-2","8.2.20-3","8.2.21-1","8.2.23-1","8.2.24-1","8.2.24-1~deb12u1","8.2.5-2","8.2.7-1","8.2.7-1.1","8.2.7-1.2","8.2.7-1~deb12u1"]},{"source":"osv","ecosystem":"Debian:11","package":"php7.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.33-1+deb11u7"}]}],"versions":["7.4.21-1+deb11u1","7.4.25-1+deb11u1","7.4.26-1","7.4.28-1+deb11u1","7.4.30-1+deb11u1","7.4.33-1+deb11u1","7.4.33-1+deb11u3","7.4.33-1+deb11u4","7.4.33-1+deb11u5","7.4.33-1+deb11u6"],"bundled":5},{"source":"osv","ecosystem":"Debian:12","package":"php8.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.26-1~deb12u1"}]}],"versions":["8.2.10-1","8.2.10-2","8.2.12-1","8.2.16-1","8.2.16-2","8.2.17-1","8.2.18-1","8.2.18-1~deb12u1","8.2.20-1~deb12u1","8.2.20-2","8.2.20-3","8.2.21-1","8.2.23-1","8.2.24-1","8.2.24-1~deb12u1","8.2.5-2","8.2.7-1","8.2.7-1.1","8.2.7-1.2","8.2.7-1~deb12u1"],"bundled":5},{"source":"osv","ecosystem":"Mageia:9","package":"php","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.26-1.mga9"}]}],"bundled":5},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"php","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.30-7.oe2003sp4"}]}],"bundled":5},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"php","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.30-7.oe2203sp1"}]}],"bundled":5},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"php","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.3.14-1.oe2403"}]}],"bundled":5},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"php","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.30-7.oe2203sp4"}]}],"bundled":5},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"php","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.30-7.oe2203sp3"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP6","package":"apache2-mod_php8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.26-150600.3.9.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP6","package":"php8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.26-150600.3.9.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP6","package":"php8-embed","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.26-150600.3.9.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP6","package":"php8-fastcgi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.26-150600.3.9.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP6","package":"php8-fpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.26-150600.3.9.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP6","package":"php8-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.26-150600.3.9.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"apache2-mod_php8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.26-150600.3.9.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"php8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.26-150600.3.9.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"php8-embed","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.26-150600.3.9.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"php8-fastcgi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.26-150600.3.9.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"php8-fpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.26-150600.3.9.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"php8-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.26-150600.3.9.1"}]}],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"php5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.5.3+dfsg-1ubuntu2","5.5.3+dfsg-1ubuntu3","5.5.6+dfsg-1ubuntu1","5.5.6+dfsg-1ubuntu2","5.5.8+dfsg-2ubuntu1","5.5.9+dfsg-1ubuntu1","5.5.9+dfsg-1ubuntu2","5.5.9+dfsg-1ubuntu3","5.5.9+dfsg-1ubuntu4","5.5.9+dfsg-1ubuntu4.1","5.5.9+dfsg-1ubuntu4.2","5.5.9+dfsg-1ubuntu4.3","5.5.9+dfsg-1ubuntu4.4","5.5.9+dfsg-1ubuntu4.5","5.5.9+dfsg-1ubuntu4.6","5.5.9+dfsg-1ubuntu4.7","5.5.9+dfsg-1ubuntu4.9","5.5.9+dfsg-1ubuntu4.11","5.5.9+dfsg-1ubuntu4.12","5.5.9+dfsg-1ubuntu4.13","5.5.9+dfsg-1ubuntu4.14","5.5.9+dfsg-1ubuntu4.16","5.5.9+dfsg-1ubuntu4.17","5.5.9+dfsg-1ubuntu4.19","5.5.9+dfsg-1ubuntu4.20","5.5.9+dfsg-1ubuntu4.21","5.5.9+dfsg-1ubuntu4.22","5.5.9+dfsg-1ubuntu4.23","5.5.9+dfsg-1ubuntu4.24","5.5.9+dfsg-1ubuntu4.25","5.5.9+dfsg-1ubuntu4.26","5.5.9+dfsg-1ubuntu4.27","5.5.9+dfsg-1ubuntu4.29","5.5.9+dfsg-1ubuntu4.29+esm1","5.5.9+dfsg-1ubuntu4.29+esm2","5.5.9+dfsg-1ubuntu4.29+esm3","5.5.9+dfsg-1ubuntu4.29+esm4","5.5.9+dfsg-1ubuntu4.29+esm5","5.5.9+dfsg-1ubuntu4.29+esm6","5.5.9+dfsg-1ubuntu4.29+esm8","5.5.9+dfsg-1ubuntu4.29+esm10","5.5.9+dfsg-1ubuntu4.29+esm11","5.5.9+dfsg-1ubuntu4.29+esm12","5.5.9+dfsg-1ubuntu4.29+esm13","5.5.9+dfsg-1ubuntu4.29+esm14","5.5.9+dfsg-1ubuntu4.29+esm15","5.5.9+dfsg-1ubuntu4.29+esm16","5.5.9+dfsg-1ubuntu4.29+esm17","5.5.9+dfsg-1ubuntu4.29+esm18"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"php7.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.33-0ubuntu0.16.04.16+esm13"}]}],"versions":["7.0.1-5","7.0.1-6","7.0.2-1","7.0.2-3","7.0.2-4","7.0.2-5","7.0.3-2","7.0.3-3","7.0.3-9ubuntu1","7.0.4-5ubuntu1","7.0.4-5ubuntu2","7.0.4-7ubuntu1","7.0.4-7ubuntu2","7.0.4-7ubuntu2.1","7.0.8-0ubuntu0.16.04.1","7.0.8-0ubuntu0.16.04.2","7.0.8-0ubuntu0.16.04.3","7.0.13-0ubuntu0.16.04.1","7.0.15-0ubuntu0.16.04.1","7.0.15-0ubuntu0.16.04.2","7.0.15-0ubuntu0.16.04.4","7.0.18-0ubuntu0.16.04.1","7.0.22-0ubuntu0.16.04.1","7.0.25-0ubuntu0.16.04.1","7.0.28-0ubuntu0.16.04.1","7.0.30-0ubuntu0.16.04.1","7.0.32-0ubuntu0.16.04.1","7.0.33-0ubuntu0.16.04.1","7.0.33-0ubuntu0.16.04.2","7.0.33-0ubuntu0.16.04.3","7.0.33-0ubuntu0.16.04.4","7.0.33-0ubuntu0.16.04.5","7.0.33-0ubuntu0.16.04.6","7.0.33-0ubuntu0.16.04.7","7.0.33-0ubuntu0.16.04.9","7.0.33-0ubuntu0.16.04.11","7.0.33-0ubuntu0.16.04.12","7.0.33-0ubuntu0.16.04.14","7.0.33-0ubuntu0.16.04.15","7.0.33-0ubuntu0.16.04.16","7.0.33-0ubuntu0.16.04.16+esm1","7.0.33-0ubuntu0.16.04.16+esm2","7.0.33-0ubuntu0.16.04.16+esm3","7.0.33-0ubuntu0.16.04.16+esm4","7.0.33-0ubuntu0.16.04.16+esm5","7.0.33-0ubuntu0.16.04.16+esm6","7.0.33-0ubuntu0.16.04.16+esm7","7.0.33-0ubuntu0.16.04.16+esm8","7.0.33-0ubuntu0.16.04.16+esm9","7.0.33-0ubuntu0.16.04.16+esm10","7.0.33-0ubuntu0.16.04.16+esm11","7.0.33-0ubuntu0.16.04.16+esm12"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"php7.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.24-0ubuntu0.18.04.17+esm7"}]}],"versions":["7.2.1-1ubuntu2","7.2.2-1ubuntu1","7.2.2-1ubuntu2","7.2.3-1ubuntu1","7.2.5-0ubuntu0.18.04.1","7.2.7-0ubuntu0.18.04.1","7.2.7-0ubuntu0.18.04.2","7.2.10-0ubuntu0.18.04.1","7.2.15-0ubuntu0.18.04.1","7.2.15-0ubuntu0.18.04.2","7.2.17-0ubuntu0.18.04.1","7.2.19-0ubuntu0.18.04.1","7.2.19-0ubuntu0.18.04.2","7.2.24-0ubuntu0.18.04.1","7.2.24-0ubuntu0.18.04.2","7.2.24-0ubuntu0.18.04.3","7.2.24-0ubuntu0.18.04.4","7.2.24-0ubuntu0.18.04.6","7.2.24-0ubuntu0.18.04.7","7.2.24-0ubuntu0.18.04.8","7.2.24-0ubuntu0.18.04.9","7.2.24-0ubuntu0.18.04.10","7.2.24-0ubuntu0.18.04.11","7.2.24-0ubuntu0.18.04.12","7.2.24-0ubuntu0.18.04.13","7.2.24-0ubuntu0.18.04.15","7.2.24-0ubuntu0.18.04.16","7.2.24-0ubuntu0.18.04.17","7.2.24-0ubuntu0.18.04.17+esm1","7.2.24-0ubuntu0.18.04.17+esm2","7.2.24-0ubuntu0.18.04.17+esm3","7.2.24-0ubuntu0.18.04.17+esm4","7.2.24-0ubuntu0.18.04.17+esm5","7.2.24-0ubuntu0.18.04.17+esm6"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"php7.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.3-4ubuntu2.26"}]}],"versions":["7.4.3-4build1","7.4.3-4build2","7.4.3-4ubuntu1","7.4.3-4ubuntu1.1","7.4.3-4ubuntu2.2","7.4.3-4ubuntu2.4","7.4.3-4ubuntu2.5","7.4.3-4ubuntu2.6","7.4.3-4ubuntu2.7","7.4.3-4ubuntu2.8","7.4.3-4ubuntu2.9","7.4.3-4ubuntu2.10","7.4.3-4ubuntu2.11","7.4.3-4ubuntu2.12","7.4.3-4ubuntu2.13","7.4.3-4ubuntu2.15","7.4.3-4ubuntu2.16","7.4.3-4ubuntu2.17","7.4.3-4ubuntu2.18","7.4.3-4ubuntu2.19","7.4.3-4ubuntu2.20","7.4.3-4ubuntu2.22","7.4.3-4ubuntu2.23","7.4.3-4ubuntu2.24"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"php8.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.1.2-1ubuntu2.20"}]}],"versions":["8.1.0~rc4-1ubuntu2","8.1.0-1","8.1.2-1ubuntu1","8.1.2-1ubuntu2","8.1.2-1ubuntu2.1","8.1.2-1ubuntu2.2","8.1.2-1ubuntu2.3","8.1.2-1ubuntu2.4","8.1.2-1ubuntu2.5","8.1.2-1ubuntu2.6","8.1.2-1ubuntu2.8","8.1.2-1ubuntu2.9","8.1.2-1ubuntu2.10","8.1.2-1ubuntu2.11","8.1.2-1ubuntu2.13","8.1.2-1ubuntu2.14","8.1.2-1ubuntu2.15","8.1.2-1ubuntu2.17","8.1.2-1ubuntu2.18","8.1.2-1ubuntu2.19"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"php8.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.3.6-0ubuntu0.24.04.3"}]}],"versions":["8.3.0-1","8.3.0-1ubuntu1","8.3.4-1","8.3.4-1build1","8.3.6-0maysync1","8.3.6-0ubuntu0.24.04.1","8.3.6-0ubuntu0.24.04.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"php7.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.33-0ubuntu0.16.04.16+esm13"}]}],"versions":["7.0.1-5","7.0.1-6","7.0.2-1","7.0.2-3","7.0.2-4","7.0.2-5","7.0.3-2","7.0.3-3","7.0.3-9ubuntu1","7.0.4-5ubuntu1","7.0.4-5ubuntu2","7.0.4-7ubuntu1","7.0.4-7ubuntu2","7.0.4-7ubuntu2.1","7.0.8-0ubuntu0.16.04.1","7.0.8-0ubuntu0.16.04.2","7.0.8-0ubuntu0.16.04.3","7.0.13-0ubuntu0.16.04.1","7.0.15-0ubuntu0.16.04.1","7.0.15-0ubuntu0.16.04.2","7.0.15-0ubuntu0.16.04.4","7.0.18-0ubuntu0.16.04.1","7.0.22-0ubuntu0.16.04.1","7.0.25-0ubuntu0.16.04.1","7.0.28-0ubuntu0.16.04.1","7.0.30-0ubuntu0.16.04.1","7.0.32-0ubuntu0.16.04.1","7.0.33-0ubuntu0.16.04.1","7.0.33-0ubuntu0.16.04.2","7.0.33-0ubuntu0.16.04.3","7.0.33-0ubuntu0.16.04.4","7.0.33-0ubuntu0.16.04.5","7.0.33-0ubuntu0.16.04.6","7.0.33-0ubuntu0.16.04.7","7.0.33-0ubuntu0.16.04.9","7.0.33-0ubuntu0.16.04.11","7.0.33-0ubuntu0.16.04.12","7.0.33-0ubuntu0.16.04.14","7.0.33-0ubuntu0.16.04.15","7.0.33-0ubuntu0.16.04.16","7.0.33-0ubuntu0.16.04.16+esm1","7.0.33-0ubuntu0.16.04.16+esm2","7.0.33-0ubuntu0.16.04.16+esm3","7.0.33-0ubuntu0.16.04.16+esm4","7.0.33-0ubuntu0.16.04.16+esm5","7.0.33-0ubuntu0.16.04.16+esm6","7.0.33-0ubuntu0.16.04.16+esm7","7.0.33-0ubuntu0.16.04.16+esm8","7.0.33-0ubuntu0.16.04.16+esm9","7.0.33-0ubuntu0.16.04.16+esm10","7.0.33-0ubuntu0.16.04.16+esm11","7.0.33-0ubuntu0.16.04.16+esm12"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"php7.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.24-0ubuntu0.18.04.17+esm7"}]}],"versions":["7.2.1-1ubuntu2","7.2.2-1ubuntu1","7.2.2-1ubuntu2","7.2.3-1ubuntu1","7.2.5-0ubuntu0.18.04.1","7.2.7-0ubuntu0.18.04.1","7.2.7-0ubuntu0.18.04.2","7.2.10-0ubuntu0.18.04.1","7.2.15-0ubuntu0.18.04.1","7.2.15-0ubuntu0.18.04.2","7.2.17-0ubuntu0.18.04.1","7.2.19-0ubuntu0.18.04.1","7.2.19-0ubuntu0.18.04.2","7.2.24-0ubuntu0.18.04.1","7.2.24-0ubuntu0.18.04.2","7.2.24-0ubuntu0.18.04.3","7.2.24-0ubuntu0.18.04.4","7.2.24-0ubuntu0.18.04.6","7.2.24-0ubuntu0.18.04.7","7.2.24-0ubuntu0.18.04.8","7.2.24-0ubuntu0.18.04.9","7.2.24-0ubuntu0.18.04.10","7.2.24-0ubuntu0.18.04.11","7.2.24-0ubuntu0.18.04.12","7.2.24-0ubuntu0.18.04.13","7.2.24-0ubuntu0.18.04.15","7.2.24-0ubuntu0.18.04.16","7.2.24-0ubuntu0.18.04.17","7.2.24-0ubuntu0.18.04.17+esm1","7.2.24-0ubuntu0.18.04.17+esm2","7.2.24-0ubuntu0.18.04.17+esm3","7.2.24-0ubuntu0.18.04.17+esm4","7.2.24-0ubuntu0.18.04.17+esm5","7.2.24-0ubuntu0.18.04.17+esm6"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"php7.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.3-4ubuntu2.26"}]}],"versions":["7.4.3-4build1","7.4.3-4build2","7.4.3-4ubuntu1","7.4.3-4ubuntu1.1","7.4.3-4ubuntu2.2","7.4.3-4ubuntu2.4","7.4.3-4ubuntu2.5","7.4.3-4ubuntu2.6","7.4.3-4ubuntu2.7","7.4.3-4ubuntu2.8","7.4.3-4ubuntu2.9","7.4.3-4ubuntu2.10","7.4.3-4ubuntu2.11","7.4.3-4ubuntu2.12","7.4.3-4ubuntu2.13","7.4.3-4ubuntu2.15","7.4.3-4ubuntu2.16","7.4.3-4ubuntu2.17","7.4.3-4ubuntu2.18","7.4.3-4ubuntu2.19","7.4.3-4ubuntu2.20","7.4.3-4ubuntu2.22","7.4.3-4ubuntu2.23","7.4.3-4ubuntu2.24"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"php8.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.1.2-1ubuntu2.20"}]}],"versions":["8.1.0~rc4-1ubuntu2","8.1.0-1","8.1.2-1ubuntu1","8.1.2-1ubuntu2","8.1.2-1ubuntu2.1","8.1.2-1ubuntu2.2","8.1.2-1ubuntu2.3","8.1.2-1ubuntu2.4","8.1.2-1ubuntu2.5","8.1.2-1ubuntu2.6","8.1.2-1ubuntu2.8","8.1.2-1ubuntu2.9","8.1.2-1ubuntu2.10","8.1.2-1ubuntu2.11","8.1.2-1ubuntu2.13","8.1.2-1ubuntu2.14","8.1.2-1ubuntu2.15","8.1.2-1ubuntu2.17","8.1.2-1ubuntu2.18","8.1.2-1ubuntu2.19"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"php8.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.3.6-0ubuntu0.24.04.3"}]}],"versions":["8.3.0-1","8.3.0-1ubuntu1","8.3.4-1","8.3.4-1build1","8.3.6-0maysync1","8.3.6-0ubuntu0.24.04.1","8.3.6-0ubuntu0.24.04.2"],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"php8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.3.14-1.1"}]}],"bundled":5}],"products":[{"vendor":"php","product":"php"},{"vendor":"php group","product":"php"},{"vendor":"php_group","product":"php"}],"references":[{"url":"https://github.com/php/php-src/security/advisories/GHSA-5hqh-c84r-qjcv","tags":["Exploit","evidence","advisory","report"]},{"url":"https://security.netapp.com/advisory/ntap-20241220-0008/","tags":["web","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/12/msg00007.html","tags":["web"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2024-11236","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-11236","tags":["web","advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2024-11236","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/debian10els/CLSA-2025-1761082274.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/11xxx/CVE-2024-11236.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-11236","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2024-0375.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33793","tags":["report"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2478","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-11233","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-11234","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-8929","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-8932","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20244136-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1233651","tags":["report"]},{"url":"https://bugzilla.suse.com/1233702","tags":["report"]},{"url":"https://bugzilla.suse.com/1233703","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-11233","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-11234","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-11236","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-8929","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-8932","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2024-11236","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-11236","tags":["report"]},{"url":"https://github.com/php/php-src/commit/7742f79a8a9c20522dbf40e1dc1d4ccad71d399c","tags":["report"]},{"url":"https://github.com/php/php-src/commit/2dbe1425c5768faea2aa7bca26081dd208c94ac8","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7153-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-7157-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-8929","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-8932","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-11233","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-11234","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/ROEYTIBLUXYCMCC2T25PTAXMN2GIRPJV/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-11236","title":"Integer overflow in the firebird and dblib quoters causing OOB writes","description":"In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, uncontrolled long string inputs to ldap_escape() function on 32-bit systems can cause an integer overflow, resulting in an out-of-bounds write.","status":"published","published":"2024-11-24T00:44:54.951Z","modified":"2025-11-03T21:51:54.52Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:34:19.615831Z"}],"euvd":[{"id":"EUVD-2024-33767","description":"In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, uncontrolled long string inputs to ldap_escape() function on 32-bit systems can cause an integer overflow, resulting in an out-of-bounds write.","status":"published","published":"2024-11-24T00:44:54Z","modified":"2025-11-03T21:51:54Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T19:49:30.775561Z"}],"nvd":[{"id":"CVE-2024-11236","description":"In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, uncontrolled long string inputs to ldap_escape() function on 32-bit systems can cause an integer overflow, resulting in an out-of-bounds write.","status":"published","published":"2024-11-24T01:15:04.387Z","modified":"2026-06-17T06:57:21.783Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-787","CWE-190"],"updated_at":"2026-11-02T14:10:38.347238Z"}],"osv":[{"id":"ALPINE-CVE-2024-11236","description":"In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, uncontrolled long string inputs to ldap_escape() function on 32-bit systems can cause an integer overflow, resulting in an out-of-bounds write.","status":"published","published":"2024-11-24T01:15:04.387Z","modified":"2026-11-03T06:32:44.867647852Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T07:17:02.90744Z"},{"id":"AZL-53447","title":"CVE-2024-11236 affecting package php for versions less than 8.3.14-1","description":"In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, uncontrolled long string inputs to ldap_escape() function on 32-bit systems can cause an integer overflow, resulting in an out-of-bounds write.","status":"published","published":"2024-11-24T01:15:04Z","modified":"2026-11-05T05:40:51Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-05T16:41:20.828909Z"},{"id":"AZL-53718","title":"CVE-2024-11236 affecting package php for versions less than 8.1.31-1","description":"In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, uncontrolled long string inputs to ldap_escape() function on 32-bit systems can cause an integer overflow, resulting in an out-of-bounds write.","status":"published","published":"2024-11-24T01:15:04Z","modified":"2026-04-21T04:35:20.654927Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:28:06.595149Z"},{"id":"BELL-CVE-2024-11236","status":"published","published":"2024-11-22T12:50:39.463673Z","modified":"2026-01-26T09:42:48.641881Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:28:19.288949Z"},{"id":"CVE-2024-11236","title":"Integer overflow in the firebird and dblib quoters causing OOB writes","description":"In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, uncontrolled long string inputs to ldap_escape() function on 32-bit systems can cause an integer overflow, resulting in an out-of-bounds write.","status":"published","published":"2024-11-24T00:44:54.951Z","modified":"2026-10-28T02:30:22.421147254Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T15:44:37.180532Z"},{"id":"DEBIAN-CVE-2024-11236","description":"In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, uncontrolled long string inputs to ldap_escape() function on 32-bit systems can cause an integer overflow, resulting in an out-of-bounds write.","status":"published","published":"2024-11-24T01:15:04.387Z","modified":"2026-11-02T12:00:53.86210937Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:41.849198Z"},{"id":"OESA-2024-2478","title":"php security update","description":"PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts. %if 1 The php package contains the module (often referred to as mod_php) which adds support for the PHP language to Apache HTTP Server when running in prefork mode. This module is deprecated. %endif\r\n\r\nSecurity Fix(es):\r\n\r\n(CVE-2024-11233)\r\n\r\n(CVE-2024-11234)\r\n\r\n(CVE-2024-11236)\r\n\r\n(CVE-2024-8929)\r\n\r\n(CVE-2024-8932)","status":"published","published":"2024-11-29T11:07:57Z","modified":"2026-08-18T01:18:42.605400619Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"UBUNTU-CVE-2024-11236","description":"In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, uncontrolled long string inputs to ldap_escape() function on 32-bit systems can cause an integer overflow, resulting in an out-of-bounds write.","status":"published","published":"2024-11-24T01:15:00Z","modified":"2026-10-21T23:00:15.008629644Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T16:54:41.555387Z"},{"id":"BIT-libphp-2024-11236","title":"Integer overflow in the firebird and dblib quoters causing OOB writes","description":"In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, uncontrolled long string inputs to ldap_escape() function on 32-bit systems can cause an integer overflow, resulting in an out-of-bounds write.","status":"published","published":"2025-08-11T13:54:06.723Z","modified":"2026-09-08T08:48:08.321981455Z","updated_at":"2026-11-02T15:28:32.162822Z"},{"id":"BIT-php-2024-11236","title":"Integer overflow in the firebird and dblib quoters causing OOB writes","description":"In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, uncontrolled long string inputs to ldap_escape() function on 32-bit systems can cause an integer overflow, resulting in an out-of-bounds write.","status":"published","published":"2024-11-27T19:20:03.987Z","modified":"2026-09-08T08:48:18.243993528Z","updated_at":"2026-11-02T15:28:34.343258Z"},{"id":"BIT-php-min-2024-11236","title":"Integer overflow in the firebird and dblib quoters causing OOB writes","description":"In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, uncontrolled long string inputs to ldap_escape() function on 32-bit systems can cause an integer overflow, resulting in an out-of-bounds write.","status":"published","published":"2025-01-14T19:20:14.001Z","modified":"2026-09-08T08:48:17.958579278Z","updated_at":"2026-11-02T15:28:34.343258Z"},{"id":"CLSA-2025-1761082274","title":"Fix of 5 CVEs","description":"   * SECURITY UPDATE: out-of-bound write\n     - debian/patches/CVE-2024-11236: fix integer overflow causing in an out-of-bounds write\n       ldap_escape()\n     - CVE-2024-11236\n   * SECURITY UPDATE: incorrect URL truncation\n     - debian/patches/CVE-2025-1861: fix possible incorrect URL truncation and\n       redirecting to a wrong location\n     - CVE-2025-1217\n     - CVE-2025-1734\n     - CVE-2025-1861\n   * SECURITY UPDATE: inadequate validation of user-supplied headers may lead to\n     header misinterpretation\n     - debian/patches/CVE-2025-1736.patch: Fix GHSA-hgf5-96fm-v528: Correct http\n       user header CRLF check\n     - CVE-2025-1736","status":"published","published":"2025-10-21T21:31:18Z","modified":"2026-06-04T10:03:20.830602989Z","updated_at":"2026-11-02T15:43:42.427288Z"},{"id":"DLA-3986-1","title":"php7.4 - security update","status":"published","published":"2024-12-08T00:00:00Z","modified":"2026-03-09T01:18:23.4817Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"DSA-5819-1","title":"php8.2 - security update","status":"published","published":"2024-11-26T00:00:00Z","modified":"2026-03-09T02:11:05.388776Z","updated_at":"2026-11-02T15:46:17.892347Z"},{"id":"MGASA-2024-0375","title":"Updated php packages fix security vulnerabilities","description":"Some heap errors, segmentation faults and security vulnerabilities have\nbeen found and corrected. It is advised to install this update.\n","status":"published","published":"2024-11-27T19:59:10Z","modified":"2026-04-16T04:43:44.396687522Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"openSUSE-SU-2024:14521-1","title":"php8-8.3.14-1.1 on GA media","description":"These are all security issues fixed in the php8-8.3.14-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-11-23T00:00:00Z","modified":"2025-05-07T18:15:41.481257Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"SUSE-SU-2024:4136-1","title":"Security update for php8","description":"This update for php8 fixes the following issues:\n\n- CVE-2024-11233: Single byte overread with convert.quoted-printable-decode filter (bsc#1233702).\n- CVE-2024-11234: Configuring a proxy in a stream context might allow for CRLF injection in URIs (bsc#1233703).\n- CVE-2024-8929: Leak partial content of the heap through heap buffer over-read (bsc#1233651).\n","status":"published","published":"2024-12-02T12:26:48Z","modified":"2026-02-04T04:36:23.978311Z","updated_at":"2026-11-02T15:53:56.123059Z"},{"id":"USN-7153-1","title":"php7.0, php7.2 vulnerability","description":"It was discovered that PHP incorrectly handled long string inputs\nin two database drivers. An attacker could possibly use this \nissue to write files in locations they would not normally have\naccess to. (CVE-2024-11236)\n","status":"published","published":"2024-12-12T16:17:13Z","modified":"2026-06-25T13:32:29.990432768Z","updated_at":"2026-11-02T16:58:18.876384Z"},{"id":"USN-7157-1","title":"php7.4, php8.1, php8.3 vulnerabilities","description":"It was discovered that PHP incorrectly handled certain inputs when\nprocessed with convert.quoted-printable decode filters.\nAn attacker could possibly use this issue to expose sensitive\ninformation or cause a crash. (CVE-2024-11233)\n\nIt was discovered that PHP incorrectly handled certain HTTP requests.\nAn attacker could possibly use this issue to performing arbitrary\nHTTP requests originating from the server, thus potentially\ngaining access to resources not normally available to the external\nuser. (CVE-2024-11234)\n\nIt was discovered that PHP incorrectly handled certain inputs.\nAn attacker could possibly use this issue to cause a crash or\nexecute arbitrary code. (CVE-2024-11236, CVE-2024-8932)\n\nIt was discovered that PHP incorrectly handled certain MySQL requests.\nAn attacker could possibly use this issue to cause the client to\ndisclose the content of its heap containing data from other SQL requests\nand possible other data belonging to different users of the same server.\n(CVE-2024-8929)\n","status":"published","published":"2024-12-13T16:59:11Z","modified":"2026-04-27T17:47:18.5670835Z","updated_at":"2026-11-02T16:58:18.876384Z"}]}}