Fluid Attacks Database

Description

In PHP versions 7.4.x below 7.4.28, 8.0.x below 8.0.16, and 8.1.x below 8.1.3, when using filter functions with FILTER_VALIDATE_FLOAT filter and min/max limits, if the filter fails, there is a possibility to trigger use of allocated memory after free, which can result it crashes, and potentially in overwrite of other memory chunks and RCE. This issue affects: code that uses FILTER_VALIDATE_FLOAT with min/max limits.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
debian 11	php7.4	=7.4.21-1+deb11u1 \|\| =7.4.25-1+deb11u1 \|\| =7.4.26-1 \|\| >=0 <7.4.28-1+deb11u1	7.4.28-1+deb11u1
rpm rhel8	php	<0:7.4.30-1.module+el8.7.0+15886+8e29b882	0:7.4.30-1.module+el8.7.0+15886+8e29b882
rpm rhel9	php	<0:8.0.20-3.el9	0:8.0.20-3.el9

Aliases

1. CVE-2021-217082. NVD-2021-217083. OSV-DEBIAN-2021-217084. OSV-2021-217085. SECURITY-TRACKER-CVE-2021-21708

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.