Affected: Bitnami: libphp

PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).

PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).

php: php: Denial of Service via unbounded recursion in SOAP parser php: OOM bailout during request parsing leads to memory corruption and RCE php: fatal error handling retains stale request state leading to use-after-free

Affected: Ubuntu:Pro:14.04:LTS: php5, Ubuntu:Pro:16.04:LTS: php7.0, Ubuntu:Pro:18.04:LTS: php7.2, Ubuntu:Pro:20.04:LTS: php7.4, Ubuntu:22.04:LTS: php8.1, Ubuntu:24.04:LTS: php8.3, Ubuntu:26.10: php8.5, Ubuntu:26.04:LTS: php8.5

out-of-memory handling can interrupt PHP while internal request data is only partially initialized. Request cleanup may then treat the invalid data as valid.

PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. In some contexts, the code before the allocation does not properly account for a early exit and leaves reachable request memory in an uninitialized or otherwise invalid state. The request shutdown procedure may then read or branch on the uninitialized memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE). Application-independent, complete remote code execution has been validated over HTTP against mod_php with default PHP input and memory limits and normal prefork workers. Fixed in PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. PHP contains error handling, Session, object and extension state that is retained by a worker but points to memory owned by one request. That state must be reset before the request memory is released. Some input, configuration, Session and error handling operations run before normal initialization of the next request. They can trust stale state left by the previous request before initialization has a chance to replace it, causing a use after free. Fixed in PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12.

Ein Angreifer kann mehrere Schwachstellen in PHP ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.