Skip to content

Commit 8c98ace

Browse files
bukkapronskiy
authored andcommitted
Remove incorrect note for CVE-2024-8928
This was a mix up in the description that was copied from OSTIF document which took description from another issue: A memory-related vulnerability in PHP's filter handling system, particularly when processing input with convert.quoted-printable-decode filters, leads to a segmentation fault. This vulnerability is triggered through specific sequences of input data, causing PHP to crash. When exploited, it allows an attacker to extract a single byte of data from the heap or cause a DoS. (CVE-2024-11233) This is taken from ALAS advisory: https://alas.aws.amazon.com/AL2023/ALAS-2025-845.html It clearly shows that it is a mix up with CVE-2024-11233. The CVE-2024-8928 is a different issue though.
1 parent 16f4aa0 commit 8c98ace

File tree

1 file changed

+0
-1
lines changed

1 file changed

+0
-1
lines changed

source/_posts/2025-04-10-php-core-security-audit-results.md

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,6 @@ Notably, four vulnerabilities received CVE identifiers:
4242

4343
* CVE-2024-9026: Log tampering vulnerability in PHP-FPM, allowing potential manipulation or removal of characters from log messages.
4444
* CVE-2024-8925: Flaw in PHP’s multipart form data parsing, potentially leading to data misinterpretation.
45-
* CVE-2024-8928: Memory-related vulnerability in PHP’s filter handling, leading to segmentation faults.
4645
* CVE-2024-8929: Issue where a malicious MySQL server could cause the client to disclose heap content from other SQL requests.
4746

4847
## Recommendations and Resolutions

0 commit comments

Comments
 (0)