[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <20250413014142.GA17270@openwall.com>
Date: Sun, 13 Apr 2025 03:41:42 +0200
From: Solar Designer <solar@...nwall.com>
To: oss-security@...ts.openwall.com
Subject: Re: Security audit of PHP
Hi,
Thank you for bringing this in here, Alan!
On Sat, Apr 12, 2025 at 08:58:59AM -0700, Alan Coopersmith wrote:
> https://blog.quarkslab.com/security-audit-of-php-src.html announces the
> completion of a security audit of PHP by Quarkslab, thanks to funding
> provided by Sovereign Tech Fund to The Open Source Technology Improvement
> Fund.
>
> The blog provides details and a link to the audit report for more.
> The summary it provides of the findings is:
>
> > 2 security issues considered as high severity;
> > 6 security issues considered as medium severity;
> > 9 security issues considered as low severity;
> > 10 issues considered informative.
The PHP Foundation's blog post gives slightly different breakdown by
severity, with "3 High-severity" and "5 Medium-severity".
> CVE-2024-8928 is still marked reserved & not yet published, the report
> lists it as "Details to be shared after fixes are applied".
>
> The Quarkslab blog also points to corresponding blogs from the PHP
> Foundation
> and the Open Source Technology Improvement Fund at:
> https://thephp.foundation/blog/2025/04/10/php-core-security-audit-results/
> https://ostif.org/php-audit-complete/
This mystery CVE is listed with a brief description in the PHP
Foundation's blog post above:
CVE-2024-8928: Memory-related vulnerability in PHP's filter handling,
leading to segmentation faults.
Alexander
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
