CVE-2022-31627

NameCVE-2022-31627
DescriptionIn PHP versions 8.1.x below 8.1.8, when fileinfo functions, such as finfo_buffer, due to incorrect patch applied to the third party code from libmagic, incorrect function may be used to free allocated memory, which may lead to heap corruption.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub advisories/code/issues, web search, more)
Debian Bugs1016972

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
php7.3 (PTS)buster, buster (security)7.3.31-1~deb10u1fixed
php7.4 (PTS)bullseye7.4.28-1+deb11u1fixed
bullseye (security)7.4.30-1+deb11u1fixed
php8.1 (PTS)bookworm8.1.5-1vulnerable
sid8.1.7-1vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
php7.3source(unstable)(not affected)
php7.4source(unstable)(not affected)
php8.1source(unstable)(unfixed)1016972

Notes

- php7.4 <not-affected> (Only affects 8.1 and later)
- php7.3 <not-affected> (Only affects 8.1 and later)
Fixed in 8.1.8
PHP Bug: https://bugs.php.net/bug.php?id=81723
https://github.com/php/php-src/commit/ca6d511fa54b34d5b75bf120a86482a1b9e1e686

Search for package or bug name: Reporting problems