Home

CVE-2018-10545

Description

An issue was discovered in PHP before 5.6.35, 7.0.x before 7.0.29, 7.1.x before 7.1.16, and 7.2.x before 7.2.4. Dumpable FPM child processes allow bypassing opcache access controls because fpm_unix.c makes a PR_SET_DUMPABLE prctl call, allowing one user (in a multiuser environment) to obtain sensitive information from the process memory of a second users PHP applications by running gcore on the PID of the PHP-FPM worker process.

Risk Information

Base Score
4.7
MODERATE
Vector
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS Score
Exploitation Probability
0.045

Associated Vulnerability

VulnerabilityOS Platform
HTML-embedded scripting language interpreter (USN-2391-1) php5-xmlrpc_5.5.9+dfsg-1ubuntu4.26_amd64.debLinux
HTML-embedded scripting language interpreter (USN-2391-1) php5-xmlrpc_5.5.9+dfsg-1ubuntu4.26_i386.debLinux
HTML-embedded scripting language interpreter (USN-3646-1) php5-cgi_5.5.9+dfsg-1ubuntu4.25_i386.debLinux
HTML-embedded scripting language interpreter (USN-3646-1) php5-cgi_5.5.9+dfsg-1ubuntu4.25_amd64.debLinux
HTML-embedded scripting language interpreter (USN-3646-1) php5-cli_5.5.9+dfsg-1ubuntu4.25_i386.debLinux
HTML-embedded scripting language interpreter (USN-3646-1) php5-cli_5.5.9+dfsg-1ubuntu4.25_amd64.debLinux
HTML-embedded scripting language interpreter (USN-3646-1) php5-fpm_5.5.9+dfsg-1ubuntu4.25_i386.debLinux
HTML-embedded scripting language interpreter (USN-3646-1) php5-fpm_5.5.9+dfsg-1ubuntu4.25_amd64.debLinux
HTML-embedded scripting language interpreter (USN-3646-1) php7.0-cgi_7.0.30-0ubuntu0.16.04.1_i386.debLinux
HTML-embedded scripting language interpreter (USN-3646-1) php7.0-cgi_7.0.30-0ubuntu0.16.04.1_amd64.debLinux
HTML-embedded scripting language interpreter (USN-3646-1) php7.0-cli_7.0.30-0ubuntu0.16.04.1_i386.debLinux
HTML-embedded scripting language interpreter (USN-3646-1) php7.0-cli_7.0.30-0ubuntu0.16.04.1_amd64.debLinux
HTML-embedded scripting language interpreter (USN-3646-1) php7.0-fpm_7.0.30-0ubuntu0.16.04.1_i386.debLinux
HTML-embedded scripting language interpreter (USN-3646-1) php7.0-fpm_7.0.30-0ubuntu0.16.04.1_amd64.debLinux
HTML-embedded scripting language interpreter (USN-3646-1) php7.1-cgi_7.1.17-0ubuntu0.17.10.1_i386.debLinux
HTML-embedded scripting language interpreter (USN-3646-1) php7.1-cgi_7.1.17-0ubuntu0.17.10.1_amd64.debLinux
HTML-embedded scripting language interpreter (USN-3646-1) php7.1-cli_7.1.17-0ubuntu0.17.10.1_i386.debLinux
HTML-embedded scripting language interpreter (USN-3646-1) php7.1-cli_7.1.17-0ubuntu0.17.10.1_amd64.debLinux
HTML-embedded scripting language interpreter (USN-3646-1) php7.1-fpm_7.1.17-0ubuntu0.17.10.1_i386.debLinux
HTML-embedded scripting language interpreter (USN-3646-1) php7.1-fpm_7.1.17-0ubuntu0.17.10.1_amd64.debLinux
HTML-embedded scripting language interpreter (USN-3646-1) php7.2-cgi_7.2.5-0ubuntu0.18.04.1_i386.debLinux
HTML-embedded scripting language interpreter (USN-3646-1) php7.2-cgi_7.2.5-0ubuntu0.18.04.1_amd64.debLinux
HTML-embedded scripting language interpreter (USN-3646-1) php7.2-cli_7.2.5-0ubuntu0.18.04.1_i386.debLinux
HTML-embedded scripting language interpreter (USN-3646-1) php7.2-cli_7.2.5-0ubuntu0.18.04.1_amd64.debLinux
HTML-embedded scripting language interpreter (USN-3646-1) php7.2-fpm_7.2.5-0ubuntu0.18.04.1_i386.debLinux
HTML-embedded scripting language interpreter (USN-3646-1) php7.2-fpm_7.2.5-0ubuntu0.18.04.1_amd64.debLinux
HTML-embedded scripting language interpreter (USN-3646-1) libapache2-mod-php5_5.5.9+dfsg-1ubuntu4.25_i386.debLinux
HTML-embedded scripting language interpreter (USN-3646-1) libapache2-mod-php5_5.5.9+dfsg-1ubuntu4.25_amd64.debLinux
HTML-embedded scripting language interpreter (USN-3646-1) libapache2-mod-php7.0_7.0.30-0ubuntu0.16.04.1_i386.debLinux
HTML-embedded scripting language interpreter (USN-3646-1) libapache2-mod-php7.0_7.0.30-0ubuntu0.16.04.1_amd64.debLinux
HTML-embedded scripting language interpreter (USN-3646-1) libapache2-mod-php7.1_7.1.17-0ubuntu0.17.10.1_i386.debLinux
HTML-embedded scripting language interpreter (USN-3646-1) libapache2-mod-php7.1_7.1.17-0ubuntu0.17.10.1_amd64.debLinux
HTML-embedded scripting language interpreter (USN-3646-1) libapache2-mod-php7.2_7.2.5-0ubuntu0.18.04.1_i386.debLinux
HTML-embedded scripting language interpreter (USN-3646-1) libapache2-mod-php7.2_7.2.5-0ubuntu0.18.04.1_amd64.debLinux
php7.0 security update(DSA-4240-1) php7.0_7.0.30-0+deb9u1_all.debLinux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234