Gentoo Linux: CVE-2024-5585: PHP: Multiple Vulnerabilities

Gentoo Linux: CVE-2024-5585: PHP: Multiple Vulnerabilities

Severity

9

CVSS

(AV:N/AC:L/Au:S/C:C/I:C/A:C)

Published

06/09/2024

Created

08/14/2024

Added

08/13/2024

Modified

01/28/2025

Description

In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, the fix for CVE-2024-1874 does not work if the command name includes trailing spaces. Original issue: when using proc_open() command with array syntax, due to insufficient escaping, if the arguments of the executed command are controlled by a malicious user, the user can supply arguments that would execute arbitrary commands in Windows shell.

Solution(s)

• gentoo-linux-upgrade-dev-lang-php

References

• https://attackerkb.com/topics/cve-2024-5585
• CVE - 2024-5585
• 202408-32