Bug #67857 [Opn->Fbk]: PHP natsort() use-after-free / memory corruption

Edit report at https://bugs.php.net/bug.php?id=67857&edit=1 ID: 67857 Updated by: cmb@php.net Reported by: andrea dot palazzo at truel dot it Summary: PHP natsort() use-after-free / memory corruption -Status: Open +Status: Feedback Type: Bug Package: Arrays related PHP Version: Irrelevant -Assigned To: +Assigned To: cmb Block user comment: N Private report: N New Comment: I cannot reproduce this with any actively supported PHP version[1]. Seems it has been fixed, hasn't it? [1] <http://php.net/supported-versions.php> Previous Comments: ------------------------------------------------------------------------ [2017-03-16 21:15:42] spam2 at rhsoft dot net the point is that memory corruption often opens gates where you don't need to execurte high-level php-code when you can compromise the whole webserver process ------------------------------------------------------------------------ [2017-03-16 21:05:46] nikic@php.net @rhsoft: Please see our security policy at https://wiki.php.net/security. If you still feel that this is a security issue *under the restrictions outlined therein*, please explain in more detail why this is the case. If you disagree with the security policy itself, please start a discussion on the PHP internals mailing list. ------------------------------------------------------------------------ [2017-03-16 20:42:47] spam2 at rhsoft dot net i would be careful with "as there is no remote exploitation vector -- ability to locally execute PHP code is required" in case of memory corruption and qualify something as remote exploitation vector! ------------------------------------------------------------------------ [2017-03-16 20:34:21] nikic@php.net Removing security classification, as there is no remote exploitation vector -- ability to locally execute PHP code is required. ------------------------------------------------------------------------ [2015-07-03 07:13:50] andrea dot palazzo at truel dot it Just spotted the typo in the title ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at https://bugs.php.net/bug.php?id=67857 -- Edit this bug report at https://bugs.php.net/bug.php?id=67857&edit=1