--- title: "CVE-2024-8929\n | Ubuntu" description: Ubuntu is an open source software operating system that runs from the desktop, to the cloud, to all your internet connected things. url: https://ubuntu.com/security/CVE-2024-8929?format=md keywords: index, follow --- # CVE-2024-8929 Publication date 22 November 2024 Last updated 19 August 2025 --- Ubuntu priority **Medium** [Why this priority?](https://ubuntu.com/security/cves/about#priority ) ## Cvss 3 Severity Score **5.8 · Medium** [Score breakdown](https://ubuntu.com/security/CVE-2024-8929?format=md#impact-score) Toggle side navigation ## Description In PHP versions 8.1.\* before 8.1.31, 8.2.\* before 8.2.26, 8.3.\* before 8.3.14, a hostile MySQL server can cause the client to disclose the content of its heap containing data from other SQL requests and possible other data belonging to different users of the same server. [Read the notes from the security team](https://ubuntu.com/security/CVE-2024-8929?format=md#notes) ## Status Show unmaintained releases | Package | Ubuntu Release | Status | | --- | --- | --- | | php5 | 26.04 LTS resolute | Not in release | | 25.10 questing | Not in release | | 25.04 plucky | Not in release | | 24.10 oracular | Not in release | | 24.04 LTS noble | Not in release | | 22.04 LTS jammy | Not in release | | 20.04 LTS focal | Not in release | | 14.04 LTS trusty | Needs evaluation | | php7.0 | 26.04 LTS resolute | Not in release | | 25.10 questing | Not in release | | 25.04 plucky | Not in release | | 24.10 oracular | Not in release | | 24.04 LTS noble | Not in release | | 22.04 LTS jammy | Not in release | | 20.04 LTS focal | Not in release | | 16.04 LTS xenial | Fixed 7.0.33-0ubuntu0.16.04.16+esm14 Ubuntu Pro | | php7.2 | 26.04 LTS resolute | Not in release | | 25.10 questing | Not in release | | 25.04 plucky | Not in release | | 24.10 oracular | Not in release | | 24.04 LTS noble | Not in release | | 22.04 LTS jammy | Not in release | | 20.04 LTS focal | Not in release | | 18.04 LTS bionic | Needs evaluation | | php7.4 | 26.04 LTS resolute | Not in release | | 25.10 questing | Not in release | | 25.04 plucky | Not in release | | 24.10 oracular | Not in release | | 24.04 LTS noble | Not in release | | 22.04 LTS jammy | Not in release | | 20.04 LTS focal | Fixed 7.4.3-4ubuntu2.26 | | php8.1 | 26.04 LTS resolute | Not in release | | 25.10 questing | Not in release | | 25.04 plucky | Not in release | | 24.10 oracular | Not in release | | 24.04 LTS noble | Not in release | | 22.04 LTS jammy | Fixed 8.1.2-1ubuntu2.20 | | 20.04 LTS focal | Not in release | | php8.3 | 26.04 LTS resolute | Not in release | | 25.10 questing | Not in release | | 25.04 plucky | Not in release | | 24.10 oracular | Fixed 8.3.11-0ubuntu0.24.10.4 | | 24.04 LTS noble | Fixed 8.3.6-0ubuntu0.24.04.3 | | 22.04 LTS jammy | Not in release | | 20.04 LTS focal | Not in release | --- * [How can I get the fixes?](https://ubuntu.com/security/cves/about#security) * [What do statuses mean?](https://ubuntu.com/security/cves/about#statuses) ### Get expanded security coverage with Ubuntu Pro Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use. [Get Ubuntu Pro](https://ubuntu.com/pro) [30-day free trial](https://ubuntu.com/pro/free-trial) ## Notes --- ### [sbeattie](https://launchpad.net/~sbeattie) PEAR issues should go against php-pear as of xenial ## Severity score breakdown CVSS version: CVSS v3.0 **Base score** 5.8 · Medium * Base metrics | Parameter | Value | | --- | --- | | Attack vector | Adjacent | | Attack complexity | High | | Privileges required | Low | | User interaction | None | | Scope | Changed | | Confidentiality impact | High | | Integrity impact | None | | Availability impact | None | * Scores | Parameter | Value | | --- | --- | | Base score | 5.8 · Medium | | Exploitability score | - | | Impact score | - | **Vector:** CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N ## References * [MITRE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-8929) * [NVD](https://nvd.nist.gov/vuln/detail/CVE-2024-8929) * [Launchpad](https://launchpad.net/bugs/cve/CVE-2024-8929) * [Debian](https://security-tracker.debian.org/tracker/CVE-2024-8929) ### Related Ubuntu Security Notices (USN) + [USN-7157-1](https://usn.ubuntu.com/USN-7157-1) + PHP vulnerabilities + 13 December 2024 + [USN-7157-3](https://usn.ubuntu.com/USN-7157-3) + PHP vulnerabilities + 29 January 2025 ### Other references * * *