CVE-2022-31625

HIGH Year: 2022
CVSS v3 Score
8.1
High
CVSS v2 Score
6.8
Medium
Weakness Type
CWE-590
View all →

Vulnerability Description

In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when using Postgres database extension, supplying invalid parameters to the parametrized query may lead to PHP attempting to free memory using uninitialized data as pointers. This could lead to RCE vulnerability or denial of service.

Related Vulnerabilities

CVE-2021-3939

HIGH
CVSS:7.8(High)

Ubuntu-specific modifications to accountsservice (in patch file debian/patches/0010-set-language.patch) caused the fallback_locale variable, pointing to static storage, to be freed, in the user_change...

CWE-5902021

CVE-2023-22291

HIGH
CVSS:7.8(High)

An invalid free vulnerability exists in the Frame stream parser functionality of Ichitaro 2022 1.0.1.57600. A specially crafted document can lead to an attempt to free a stack pointer, which causes me...

CWE-5902023

CVE-2023-25565

HIGH
CVSS:7.5(High)

GSS-NTLMSSP is a mechglue plugin for the GSSAPI library that implements NTLM authentication. Prior to version 1.2.0, an incorrect free when decoding target information can trigger a denial of service....

CWE-5902023

CVE-2025-32911

CRITICAL
CVSS:9.0(Critical)

A use-after-free type vulnerability was found in libsoup, in the soup_message_headers_get_content_disposition() function. This flaw allows a malicious HTTP client to cause memory corruption in the lib...

CWE-5902025

CVE-2020-6016

CRITICAL
CVSS:9.8(Critical)

Valve's Game Networking Sockets prior to version v1.2.0 improperly handles unreliable segments with negative offsets in function SNP_ReceiveUnreliableSegment(), leading to a Heap-Based Buffer Underflo...

CWE-5902020

CVE-2021-42377

CRITICAL
CVSS:9.8(Critical)

An attacker-controlled pointer free in Busybox's hush applet leads to denial of service and possible code execution when processing a crafted shell command, due to the shell mishandling the &&& string...

CWE-5902021