PHP Integer Overflow Vulnerability in ldap_escape() Function on 32-bit Systems Allowing Out-of-Bounds Write

In PHP versions 8.1 prior to 8.1.31, 8.2 prior to 8.2.26, and 8.3 prior to 8.3.14, an integer overflow vulnerability has been identified in the ldap_escape() function. This issue arises on 32-bit systems, where uncontrolled long string inputs can lead to an overflow, causing an out-of-bounds write. The vulnerability is particularly exploitable in PHP's Firebird and DBLIB drivers, where similar integer overflow issues have been introduced by unquoted string handling, allowing for out-of-bounds writes as well.

Impact

Exploitation of this vulnerability causes an integer overflow, leading to an out-of-bounds write. This type of memory corruption can often be exploited to execute arbitrary code or cause a denial-of-service condition by crashing the application.

Remediation

Users can upgrade to PHP versions 8.1.31, 8.2.26, or 8.3.14 to address this vulnerability.