Vulnerability · Published Feb 16, 2023 · Assigned by php

CVE-2023-0568Array overrun in common path resolve code

High 7.5

In plain English

A high-severity security flaw in PHP from PHP Group. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 69% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)1.2%top 30.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, core path resolution function allocate buffer one byte too small. When resolving paths with lengths close to system MAXPATHLEN setting, this may lead to the byte after the allocated buffer being overwritten with NUL value, which might lead to unauthorized data access or modification.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8apcu-panel5.1.20-1.module_el8.6.0+2739+efabdb8fALSA-2023:5927
AlmaLinux:8apcu-panel5.1.18-1.module_el8.6.0+2750+78feabcbALSA-2024:10952
AlmaLinux:9apcu-panel5.1.21-1.module_el9.1.0+15+94ba28e4ALSA-2024:0387
AlmaLinux:8libzip1.7.3-1.module_el8.6.0+2739+efabdb8fALSA-2023:5927
AlmaLinux:8libzip1.7.3-1.module_el8.6.0+3061+6878dd1bALSA-2023:5927
AlmaLinux:8libzip1.6.1-1.module_el8.6.0+3239+bedf0508ALSA-2024:10952
AlmaLinux:8libzip1.6.1-1.module_el8.6.0+2750+78feabcbALSA-2024:10952
AlmaLinux:8libzip1.6.1-1.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:8libzip-devel1.7.3-1.module_el8.6.0+3061+6878dd1bALSA-2023:5927
AlmaLinux:8libzip-devel1.7.3-1.module_el8.6.0+2739+efabdb8fALSA-2023:5927
AlmaLinux:8libzip-devel1.6.1-1.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:8libzip-devel1.6.1-1.module_el8.6.0+3239+bedf0508ALSA-2024:10952
AlmaLinux:8libzip-tools1.6.1-1.module_el8.6.0+2750+78feabcbALSA-2024:10952
AlmaLinux:8libzip-tools1.7.3-1.module_el8.6.0+3061+6878dd1bALSA-2023:5927
AlmaLinux:8libzip-tools1.6.1-1.module_el8.6.0+3239+bedf0508ALSA-2024:10952
AlmaLinux:8libzip-tools1.6.1-1.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:8libzip-tools1.7.3-1.module_el8.6.0+2739+efabdb8fALSA-2023:5927
AlmaLinux:8php7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:8php8.0.30-1.module_el8.8.0+3655+3335cff6ALSA-2023:5927
AlmaLinux:9php8.0.30-1.el9_2ALSA-2023:5926
AlmaLinux:9php8.1.27-1.module_el9.3.0+53+44872dd1ALSA-2024:0387
AlmaLinux:8php-bcmath7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:8php-bcmath8.0.30-1.module_el8.8.0+3655+3335cff6ALSA-2023:5927
AlmaLinux:9php-bcmath8.1.27-1.module_el9.3.0+53+44872dd1ALSA-2024:0387
AlmaLinux:9php-bcmath8.0.30-1.el9_2ALSA-2023:5926
AlmaLinux:8php-cli8.0.30-1.module_el8.8.0+3655+3335cff6ALSA-2023:5927
AlmaLinux:8php-cli7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:9php-cli8.1.27-1.module_el9.3.0+53+44872dd1ALSA-2024:0387
AlmaLinux:9php-cli8.0.30-1.el9_2ALSA-2023:5926
AlmaLinux:8php-common8.0.30-1.module_el8.8.0+3655+3335cff6ALSA-2023:5927
AlmaLinux:8php-common7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:9php-common8.1.27-1.module_el9.3.0+53+44872dd1ALSA-2024:0387
AlmaLinux:9php-common8.0.30-1.el9_2ALSA-2023:5926
AlmaLinux:8php-dba8.0.30-1.module_el8.8.0+3655+3335cff6ALSA-2023:5927
AlmaLinux:8php-dba7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:9php-dba8.0.30-1.el9_2ALSA-2023:5926
AlmaLinux:9php-dba8.1.27-1.module_el9.3.0+53+44872dd1ALSA-2024:0387
AlmaLinux:8php-dbg8.0.30-1.module_el8.8.0+3655+3335cff6ALSA-2023:5927
AlmaLinux:8php-dbg7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:9php-dbg8.0.30-1.el9_2ALSA-2023:5926
AlmaLinux:9php-dbg8.1.27-1.module_el9.3.0+53+44872dd1ALSA-2024:0387
AlmaLinux:8php-devel7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:8php-devel8.0.30-1.module_el8.8.0+3655+3335cff6ALSA-2023:5927
AlmaLinux:9php-devel8.1.27-1.module_el9.3.0+53+44872dd1ALSA-2024:0387
AlmaLinux:9php-devel8.0.30-1.el9_2ALSA-2023:5926
AlmaLinux:8php-embedded7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:8php-embedded8.0.30-1.module_el8.8.0+3655+3335cff6ALSA-2023:5927
AlmaLinux:9php-embedded8.1.27-1.module_el9.3.0+53+44872dd1ALSA-2024:0387
AlmaLinux:9php-embedded8.0.30-1.el9_2ALSA-2023:5926
AlmaLinux:8php-enchant7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:8php-enchant8.0.30-1.module_el8.8.0+3655+3335cff6ALSA-2023:5927
AlmaLinux:9php-enchant8.1.27-1.module_el9.3.0+53+44872dd1ALSA-2024:0387
AlmaLinux:9php-enchant8.0.30-1.el9_2ALSA-2023:5926
AlmaLinux:8php-ffi7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:8php-ffi8.0.30-1.module_el8.8.0+3655+3335cff6ALSA-2023:5927
AlmaLinux:9php-ffi8.0.30-1.el9_2ALSA-2023:5926
AlmaLinux:9php-ffi8.1.27-1.module_el9.3.0+53+44872dd1ALSA-2024:0387
AlmaLinux:8php-fpm8.0.30-1.module_el8.8.0+3655+3335cff6ALSA-2023:5927
AlmaLinux:8php-fpm7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:9php-fpm8.0.30-1.el9_2ALSA-2023:5926
AlmaLinux:9php-fpm8.1.27-1.module_el9.3.0+53+44872dd1ALSA-2024:0387
AlmaLinux:8php-gd8.0.30-1.module_el8.8.0+3655+3335cff6ALSA-2023:5927
AlmaLinux:8php-gd7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:9php-gd8.1.27-1.module_el9.3.0+53+44872dd1ALSA-2024:0387
AlmaLinux:9php-gd8.0.30-1.el9_2ALSA-2023:5926
AlmaLinux:8php-gmp7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:8php-gmp8.0.30-1.module_el8.8.0+3655+3335cff6ALSA-2023:5927
AlmaLinux:9php-gmp8.0.30-1.el9_2ALSA-2023:5926
AlmaLinux:9php-gmp8.1.27-1.module_el9.3.0+53+44872dd1ALSA-2024:0387
AlmaLinux:8php-intl7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:8php-intl8.0.30-1.module_el8.8.0+3655+3335cff6ALSA-2023:5927
AlmaLinux:9php-intl8.0.30-1.el9_2ALSA-2023:5926
AlmaLinux:9php-intl8.1.27-1.module_el9.3.0+53+44872dd1ALSA-2024:0387
AlmaLinux:8php-json7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:8php-ldap7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:8php-ldap8.0.30-1.module_el8.8.0+3655+3335cff6ALSA-2023:5927
AlmaLinux:9php-ldap8.0.30-1.el9_2ALSA-2023:5926
AlmaLinux:9php-ldap8.1.27-1.module_el9.3.0+53+44872dd1ALSA-2024:0387
AlmaLinux:8php-mbstring7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:8php-mbstring8.0.30-1.module_el8.8.0+3655+3335cff6ALSA-2023:5927
AlmaLinux:9php-mbstring8.1.27-1.module_el9.3.0+53+44872dd1ALSA-2024:0387
AlmaLinux:9php-mbstring8.0.30-1.el9_2ALSA-2023:5926
AlmaLinux:8php-mysqlnd7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:8php-mysqlnd8.0.30-1.module_el8.8.0+3655+3335cff6ALSA-2023:5927
AlmaLinux:9php-mysqlnd8.1.27-1.module_el9.3.0+53+44872dd1ALSA-2024:0387
AlmaLinux:9php-mysqlnd8.0.30-1.el9_2ALSA-2023:5926
AlmaLinux:8php-odbc8.0.30-1.module_el8.8.0+3655+3335cff6ALSA-2023:5927
AlmaLinux:8php-odbc7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:9php-odbc8.0.30-1.el9_2ALSA-2023:5926
AlmaLinux:9php-odbc8.1.27-1.module_el9.3.0+53+44872dd1ALSA-2024:0387
AlmaLinux:8php-opcache7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:8php-opcache8.0.30-1.module_el8.8.0+3655+3335cff6ALSA-2023:5927
AlmaLinux:9php-opcache8.1.27-1.module_el9.3.0+53+44872dd1ALSA-2024:0387
AlmaLinux:9php-opcache8.0.30-1.el9_2ALSA-2023:5926
AlmaLinux:8php-pdo8.0.30-1.module_el8.8.0+3655+3335cff6ALSA-2023:5927
AlmaLinux:8php-pdo7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:9php-pdo8.1.27-1.module_el9.3.0+53+44872dd1ALSA-2024:0387
AlmaLinux:9php-pdo8.0.30-1.el9_2ALSA-2023:5926
AlmaLinux:8php-pear1:1.10.13-1.module_el8.6.0+2739+efabdb8fALSA-2023:5927
AlmaLinux:8php-pear1:1.10.13-1.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:8php-pecl-apcu5.1.18-1.module_el8.6.0+2750+78feabcbALSA-2024:10952
AlmaLinux:8php-pecl-apcu5.1.20-1.module_el8.6.0+3061+6878dd1bALSA-2023:5927
AlmaLinux:8php-pecl-apcu5.1.20-1.module_el8.6.0+2739+efabdb8fALSA-2023:5927
AlmaLinux:8php-pecl-apcu5.1.18-1.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:9php-pecl-apcu5.1.21-1.module_el9.1.0+15+94ba28e4ALSA-2024:0387
AlmaLinux:8php-pecl-apcu-devel5.1.18-1.module_el8.6.0+2750+78feabcbALSA-2024:10952
AlmaLinux:8php-pecl-apcu-devel5.1.20-1.module_el8.6.0+3061+6878dd1bALSA-2023:5927
AlmaLinux:8php-pecl-apcu-devel5.1.20-1.module_el8.6.0+2739+efabdb8fALSA-2023:5927
AlmaLinux:8php-pecl-apcu-devel5.1.18-1.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:9php-pecl-apcu-devel5.1.21-1.module_el9.1.0+15+94ba28e4ALSA-2024:0387
AlmaLinux:8php-pecl-rrd2.0.3-1.module_el8.6.0+2739+efabdb8fALSA-2023:5927
AlmaLinux:8php-pecl-rrd2.0.1-1.module_el8.6.0+2750+78feabcbALSA-2024:10952
AlmaLinux:8php-pecl-rrd2.0.1-1.module_el8.4.0+2229+b272fdefALSA-2024:10952
AlmaLinux:8php-pecl-rrd2.0.1-1.module_el8.3.0+2009+b272fdefALSA-2024:10952
AlmaLinux:8php-pecl-rrd2.0.1-1.module_el8.6.0+3059+d65eee13ALSA-2024:10952
AlmaLinux:8php-pecl-rrd2.0.3-1.module_el8.6.0+3061+6878dd1bALSA-2023:5927
AlmaLinux:9php-pecl-rrd2.0.3-4.module_el9.1.0+15+94ba28e4ALSA-2024:0387
AlmaLinux:8php-pecl-xdebug2.9.5-1.module_el8.6.0+2750+78feabcbALSA-2024:10952
AlmaLinux:8php-pecl-xdebug2.9.5-1.module_el8.6.0+3239+bedf0508ALSA-2024:10952
AlmaLinux:8php-pecl-xdebug2.9.5-1.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:8php-pecl-xdebug33.1.2-1.module_el8.6.0+2739+efabdb8fALSA-2023:5927
AlmaLinux:8php-pecl-xdebug33.1.2-1.module_el8.6.0+3061+6878dd1bALSA-2023:5927
AlmaLinux:9php-pecl-xdebug33.1.4-1.module_el9.1.0+15+94ba28e4ALSA-2024:0387
AlmaLinux:8php-pecl-zip1.18.2-1.module_el8.6.0+3239+bedf0508ALSA-2024:10952
AlmaLinux:8php-pecl-zip1.19.2-1.module_el8.6.0+2739+efabdb8fALSA-2023:5927
AlmaLinux:8php-pecl-zip1.19.2-1.module_el8.6.0+3061+6878dd1bALSA-2023:5927
AlmaLinux:8php-pecl-zip1.18.2-1.module_el8.6.0+2750+78feabcbALSA-2024:10952
AlmaLinux:8php-pecl-zip1.18.2-1.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:9php-pecl-zip1.20.1-1.module_el9.1.0+15+94ba28e4ALSA-2024:0387
AlmaLinux:8php-pgsql8.0.30-1.module_el8.8.0+3655+3335cff6ALSA-2023:5927
AlmaLinux:8php-pgsql7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:9php-pgsql8.0.30-1.el9_2ALSA-2023:5926
AlmaLinux:9php-pgsql8.1.27-1.module_el9.3.0+53+44872dd1ALSA-2024:0387
AlmaLinux:8php-process8.0.30-1.module_el8.8.0+3655+3335cff6ALSA-2023:5927
AlmaLinux:8php-process7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:9php-process8.0.30-1.el9_2ALSA-2023:5926
AlmaLinux:9php-process8.1.27-1.module_el9.3.0+53+44872dd1ALSA-2024:0387
AlmaLinux:8php-snmp8.0.30-1.module_el8.8.0+3655+3335cff6ALSA-2023:5927
AlmaLinux:8php-snmp7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:9php-snmp8.1.27-1.module_el9.3.0+53+44872dd1ALSA-2024:0387
AlmaLinux:9php-snmp8.0.30-1.el9_2ALSA-2023:5926
AlmaLinux:8php-soap8.0.30-1.module_el8.8.0+3655+3335cff6ALSA-2023:5927
AlmaLinux:8php-soap7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:9php-soap8.0.30-1.el9_2ALSA-2023:5926
AlmaLinux:9php-soap8.1.27-1.module_el9.3.0+53+44872dd1ALSA-2024:0387
AlmaLinux:8php-xml7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:8php-xml8.0.30-1.module_el8.8.0+3655+3335cff6ALSA-2023:5927
AlmaLinux:9php-xml8.0.30-1.el9_2ALSA-2023:5926
AlmaLinux:9php-xml8.1.27-1.module_el9.3.0+53+44872dd1ALSA-2024:0387
AlmaLinux:8php-xmlrpc7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
Alpine:v3.20php828.2.3-r0ALPINE-CVE-2023-0568
Alpine:v3.21php828.2.3-r0ALPINE-CVE-2023-0568
Alpine:v3.22php828.2.3-r0ALPINE-CVE-2023-0568
Debian:12php8.28.2.4-1DEBIAN-CVE-2023-0568
Rocky Linux:8libzip0:1.6.1-1.module+el8.10.0+1604+6558efc7RLSA-2024:10952
Rocky Linux:8libzip0:1.7.3-1.module+el8.6.0+790+fc63e43fRLSA-2023:5927
Rocky Linux:8php0:8.0.30-1.module+el8.8.0+1550+d8f1b18fRLSA-2023:5927
Rocky Linux:8php0:7.4.33-2.module+el8.10.0+1912+72767185RLSA-2024:10952
Rocky Linux:9php0:8.0.30-1.el9_2RLSA-2023:5926
Rocky Linux:8php-pear1:1.10.13-1.module+el8.10.0+1604+6558efc7RLSA-2024:10952
Rocky Linux:8php-pear1:1.10.13-1.module+el8.7.0+1067+0a7071ccRLSA-2023:5927
Rocky Linux:8php-pecl-apcu0:5.1.20-1.module+el8.6.0+790+fc63e43fRLSA-2023:5927
Rocky Linux:8php-pecl-apcu0:5.1.18-1.module+el8.10.0+1604+6558efc7RLSA-2024:10952
Rocky Linux:9php-pecl-apcu0:5.1.21-1.module+el9.6.0+32040+1f1dedb8RLSA-2024:0387
Rocky Linux:8php-pecl-rrd0:2.0.3-1.module+el8.6.0+790+fc63e43fRLSA-2023:5927
Rocky Linux:8php-pecl-rrd0:2.0.1-1.module+el8.10.0+1604+6558efc7RLSA-2024:10952
Rocky Linux:9php-pecl-rrd0:2.0.3-4.module+el9.6.0+32041+66e66fb7RLSA-2024:0387
Rocky Linux:9php-pecl-rrd0:2.0.3-4.module+el9.6.0+32040+1f1dedb8RLSA-2024:0387
Rocky Linux:9php-pecl-rrd0:2.0.3-4.module+el9.6.0+32042+808943aeRLSA-2024:0387
Rocky Linux:8php-pecl-xdebug0:2.9.5-1.module+el8.10.0+1604+6558efc7RLSA-2024:10952
Rocky Linux:8php-pecl-xdebug30:3.1.2-1.module+el8.6.0+790+fc63e43fRLSA-2023:5927
Rocky Linux:9php-pecl-xdebug30:3.1.4-1.module+el9.6.0+32040+1f1dedb8RLSA-2024:0387
Rocky Linux:8php-pecl-zip0:1.18.2-1.module+el8.10.0+1604+6558efc7RLSA-2024:10952
Rocky Linux:8php-pecl-zip0:1.19.2-1.module+el8.6.0+790+fc63e43fRLSA-2023:5927
Rocky Linux:9php-pecl-zip0:1.20.1-1.module+el9.6.0+32040+1f1dedb8RLSA-2024:0387
Ubuntu:22.04:LTSphp8.18.1.2-1ubuntu2.11USN-5902-1
Ubuntu:22.04:LTSphp8.18.1.2-1ubuntu2.11UBUNTU-CVE-2023-0568

Affected products (as reported)

VendorProductVersions
PHP Group PHP 8.0.x – before 8.0.288.1.x – before 8.1.168.2.x – before 8.2.3

Weakness: CWE-131 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

References