CVE-2021-21708
- ULN >
- Oracle Linux CVE repository >
- CVE-2021-21708
CVE Details
| Release Date: | 2022-02-27 |
Description
In PHP versions 7.4.x below 7.4.28, 8.0.x below 8.0.16, and 8.1.x below 8.1.3, when using filter functions with FILTER_VALIDATE_FLOAT filter and min/max limits, if the filter fails, there is a possibility to trigger use of allocated memory after free, which can result it crashes, and potentially in overwrite of other memory chunks and RCE. This issue affects: code that uses FILTER_VALIDATE_FLOAT with min/max limits.
See more information about CVE-2021-21708 from MITRE CVE dictionary and NIST NVD
CVSS v3.0 metrics
NOTE: The following CVSS v3.0 metrics and score provided are preliminary and subject to review.
| Base Score: | 9.8 | Base Metrics: | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| Access Vector: | Network | Attack Complexity: | Low |
| Privileges Required: | None | User Interaction: | None |
| Scope: | Unchanged | Confidentiality Impact: | High |
| Integrity Impact: | High | Availability Impact: | High |
Errata information
| Platform | Errata | Release Date |
| Oracle Linux version 8 (libzip) | ELSA-2022-7624 | 2022-11-15 |
| Oracle Linux version 8 (libzip) | ELSA-2022-7628 | 2022-11-15 |
| Oracle Linux version 8 (php) | ELSA-2022-7624 | 2022-11-15 |
| Oracle Linux version 8 (php) | ELSA-2022-7628 | 2022-11-15 |
| Oracle Linux version 8 (php-pear) | ELSA-2022-7624 | 2022-11-15 |
| Oracle Linux version 8 (php-pear) | ELSA-2022-7628 | 2022-11-15 |
| Oracle Linux version 8 (php-pecl-apcu) | ELSA-2022-7624 | 2022-11-15 |
| Oracle Linux version 8 (php-pecl-apcu) | ELSA-2022-7628 | 2022-11-15 |
| Oracle Linux version 8 (php-pecl-rrd) | ELSA-2022-7624 | 2022-11-15 |
| Oracle Linux version 8 (php-pecl-rrd) | ELSA-2022-7628 | 2022-11-15 |
| Oracle Linux version 8 (php-pecl-xdebug) | ELSA-2022-7628 | 2022-11-15 |
| Oracle Linux version 8 (php-pecl-xdebug3) | ELSA-2022-7624 | 2022-11-15 |
| Oracle Linux version 8 (php-pecl-zip) | ELSA-2022-7624 | 2022-11-15 |
| Oracle Linux version 8 (php-pecl-zip) | ELSA-2022-7628 | 2022-11-15 |
| Oracle Linux version 9 (php) | ELSA-2022-8197 | 2022-11-22 |
This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team
