In PHP versions 7.3.x below 7.3.16 and 7.4.x below 7.4.4, while using mb_strtolower() function with UTF-32LE encoding, certain invalid strings could cause PHP to overwrite stack-allocated buffer. This could lead to memory corruption, crashes and potentially code execution.
A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).
The product writes data past the end, or before the beginning, of the intended buffer.
| Link | Tags |
|---|---|
| https://usn.ubuntu.com/4330-1/ | third party advisory vendor advisory |
| https://usn.ubuntu.com/4330-2/ | third party advisory vendor advisory |
| https://www.debian.org/security/2020/dsa-4719 | third party advisory vendor advisory |
| https://security.netapp.com/advisory/ntap-20200403-0001/ | third party advisory |
| https://www.oracle.com/security-alerts/cpuoct2021.html | third party advisory patch |
| https://bugs.php.net/bug.php?id=79371 | patch exploit vendor advisory issue tracking |
| https://www.php.net/ChangeLog-7.php#7.4.4 | release notes vendor advisory |
| https://www.tenable.com/security/tns-2021-14 | third party advisory |