Bug 358975 – dev-lang/php: e-after-free in substr_replace() (CVE-2011-1148)

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Tim Sammut (RETIRED) 2011-03-15 05:04:05 UTC]

Upstream bug at $URL. From http://www.openwall.com/lists/oss-security/2011/03/13/3:

On 03/13/2011 10:00 PM, Felipe Pena wrote:
> Hi,
>
> I just found an use-after-free in PHP's substr_replace() function caused by
> passing the same variable multiple times to the function, which makes the
> PHP to use the same pointer in three variables inside the function, so when
> the pointer is changed by a type conversion inside the function, it invalids
> the other variables.
>
> The PHP security team has seen noticed, and a bug already was filed in the
> bugtracker (http://bugs.php.net/bug.php?id=54238 [private])
>
> $ sapi/cli/php ../bug.php
> array(1) {
> [0]=>
> string(5) "0Ȅ y"
> }
> array(1) {
> [0]=>
> string(1) "0"
> }

[Comment 1 GLSAMaker/CVETool Bot 2011-06-20 11:02:19 UTC]

CVE-2011-1148 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-1148):
  Use-after-free vulnerability in the substr_replace function in PHP 5.3.6 and
  earlier allows context-dependent attackers to cause a denial of service
  (memory corruption) or possibly have unspecified other impact by using the
  same variable for multiple arguments.

[Comment 2 Agostino Sarubbo 2011-09-13 22:12:32 UTC]

Security Enhancements and Fixes in PHP 5.3.7:
[..]
Fixed bug #54238 (use-after-free in substr_replace()). (CVE-2011-1148)


Please add glsa request.

[Comment 3 Tim Sammut (RETIRED) 2011-09-19 19:00:03 UTC]

Thanks, everyone. Added to existing request.

[Comment 4 Tobias Heinlein (RETIRED) 2011-10-10 20:45:18 UTC]

This issue was resolved and addressed in
 GLSA 201110-06 at http://security.gentoo.org/glsa/glsa-201110-06.xml
by GLSA coordinator Tobias Heinlein (keytoaster).