CVE-2024-11233

Name	CVE-2024-11233
Description	In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, due to an error in convert.quoted-printable-decode filter certain data can lead to buffer overread by one byte, which can in certain circumstances lead to crashes or disclose content of other memory areas.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-3986-1, DSA-5819-1
Debian Bugs	1088688

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
php7.4 (PTS)	bullseye	7.4.33-1+deb11u5	vulnerable
	bullseye (security)	7.4.33-1+deb11u9	fixed
php8.2 (PTS)	bookworm, bookworm (security)	8.2.29-1~deb12u1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin	Debian Bugs
php7.4	source	bullseye	7.4.33-1+deb11u7	DLA-3986-1
php7.4	source	(unstable)	(unfixed)
php8.2	source	bookworm	8.2.26-1~deb12u1	DSA-5819-1
php8.2	source	(unstable)	8.2.26-4		1088688

Notes

https://github.com/php/php-src/security/advisories/GHSA-r977-prxv-hc43
https://github.com/php/php-src/commit/a6c84cd7efd7eaaaefd4463412508df570d35358 (php-8.2.26)