PHP has patched three security vulnerabilities in its latest updates, including high-severity flaws that can lead to SQL injection and out-of-bounds memory writes This article explores vulnerability arises phar_get_link_source. . These issues impact optional PHP extensions commonly used by web applications: ext-pgsql, ext-bcmath, and ext-phar.
Organizations are advised to update their PHP installations immediately, particularly if their applications handle untrusted input or process uploaded archive files. When PostgreSQL’s standard_conforming_strings setting is enabled, backslashes are not properly escaped in this context, allowing for potential SQL injection attacks if exploited by an attacker. Depending on the application's conditions and the PHP runtime environment, memory corruption bugs can lead to crashes or create avenues for more serious exploitation.
This vulnerability arises from the phar_get_link_source() function, which recursively follows symbolic links stored in Phar archives without enforcing a depth limit or detecting circular references. A malicious tar-based Phar archive with circular symbolic links could trigger infinite recursion, leading to PHP crashing with a segmentation fault and resulting in a moderate-severity denial-of-service (CVSS 6.5). Administrators of the PHP environment also need to review applications reliant on PostgreSQL helper functions, BCMath operations with externally supplied values, and file-upload workflows that parse Phar or tar archives.
