Description
In PHP versions 7.3.x below 7.3.16 and 7.4.x below 7.4.4, while using mb_strtolower() function with UTF-32LE encoding, certain invalid strings could cause PHP to overwrite stack-allocated buffer. This could lead to memory corruption, crashes and potentially code execution.
Remediation
References
Related Vulnerabilities
Moodle Insertion of Sensitive Information into Log File Vulnerability (CVE-2018-10889)
LimeSurvey Improper Input Validation Vulnerability (CVE-2019-15640)
MySQL CVE-2024-20967 Vulnerability (CVE-2024-20967)
Drupal Core 7.x Information Disclosure (7.0 - 7.26)
WordPress Plugin Abandoned Cart Lite for WooCommerce SQL Injection (1.8)