CVE-2022-31631
Published: 5 January 2023
A flaw was found in PHP. This issue occurs due to an uncaught integer overflow in PDO::quote() of PDO_SQLite returning an improperly quoted string. With the implementation of sqlite3_snprintf(), it is possible to force the function to return a single apostrophe if the function is called on user-supplied input without any length restrictions in place.
Notes
Author | Note |
---|---|
sbeattie |
PEAR issues should go against php-pear as of xenial |
Priority
Status
Package | Release | Status |
---|---|---|
php5
Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
focal |
Does not exist
|
|
jammy |
Does not exist
|
|
kinetic |
Does not exist
|
|
trusty |
Needed
|
|
upstream |
Needs triage
|
|
xenial |
Does not exist
|
|
php7.0
Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
focal |
Does not exist
|
|
jammy |
Does not exist
|
|
kinetic |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Needs triage
|
|
xenial |
Released
(7.0.33-0ubuntu0.16.04.16+esm5)
Available with Ubuntu Pro or Ubuntu Pro (Infra-only) |
|
php7.2
Launchpad, Ubuntu, Debian |
bionic |
Released
(7.2.24-0ubuntu0.18.04.16)
|
focal |
Does not exist
|
|
jammy |
Does not exist
|
|
kinetic |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Needs triage
|
|
xenial |
Does not exist
|
|
php7.4
Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
focal |
Released
(7.4.3-4ubuntu2.17)
|
|
jammy |
Does not exist
|
|
kinetic |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Needs triage
|
|
xenial |
Does not exist
|
|
php8.1
Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
focal |
Does not exist
|
|
jammy |
Released
(8.1.2-1ubuntu2.10)
|
|
kinetic |
Released
(8.1.7-1ubuntu3.2)
|
|
lunar |
Released
(8.1.12-1ubuntu3)
|
|
mantic |
Does not exist
|
|
noble |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(8.1.14)
|
|
xenial |
Does not exist
|
References
- https://github.com/php/php-src/commit/921b6813da3237a83e908998483f46ae3d8bacba
- https://github.com/php/php-src/commit/a6a80eefe0413c91acd922bc58590a4db7979af0
- https://ubuntu.com/security/notices/USN-5818-1
- https://ubuntu.com/security/notices/USN-5905-1
- https://www.cve.org/CVERecord?id=CVE-2022-31631
- NVD
- Launchpad
- Debian