Skip to content
OpenAdvisories
Critical USN-7153-1 1 CVE

php7.0, php7.2 vulnerability

Published Dec 12, 2024 · Updated Jun 25, 2026

Ecosystem: Ubuntu

Summary

It was discovered that PHP incorrectly handled long string inputs
in two database drivers. An attacker could possibly use this
issue to write files in locations they would not normally have
access to. (CVE-2024-11236)

Fixed packages 2

ReleasePackageFixed in
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS php7.0 7.0.33-0ubuntu0.16.04.16+esm13
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS php7.2 7.2.24-0ubuntu0.18.04.17+esm7

Vulnerabilities 1

  • Critical 9.8
    CVE-2024-11236

    Integer overflow in the firebird and dblib quoters causing OOB writes

    In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, uncontrolled long string inputs to ldap_escape() function on 32-bit systems can cause an integer overflow, resulting in an out-of-bounds write.

    PHP Group PHP php5 php7.0 Debian Ubuntu Azure Linux Alpine Wolfi

References

  • report
    https://ubuntu.com/security/CVE-2024-11236