Bug #80111 [Opn]: PHP SplDoublyLinkedList::offsetUnset UAF Sandbox Escape

Edit report at https://bugs.php.net/bug.php?id=80111&edit=1 ID: 80111 User updated by: noamr at ssd-disclosure dot com Reported by: noamr at ssd-disclosure dot com Summary: PHP SplDoublyLinkedList::offsetUnset UAF Sandbox Escape Status: Open Type: Bug Package: *General Issues Operating System: Debian / Buster PHP Version: 7.4.10 Block user comment: N Private report: N New Comment: Hi, Ok We will publish this information Previous Comments: ------------------------------------------------------------------------ [2020-09-17 11:07:10] cmb@php.net According to our security classification, this is not a security issue[1], because it requires very special exploit code on the server. If an attacker is able to inject code, there may be more serious issues than bypassing disable_functions (note that safe_mode is gone for many years). [1] <https://wiki.php.net/security#not_a_security_issue> ------------------------------------------------------------------------ [2020-09-17 09:56:41] noamr at ssd-disclosure dot com Security ------------------------------------------------------------------------ [2020-09-17 09:56:16] noamr at ssd-disclosure dot com This is a security vulnerability - shouldn't be open ------------------------------------------------------------------------ [2020-09-17 09:55:36] noamr at ssd-disclosure dot com Hi, We also have a working exploit if you require one ------------------------------------------------------------------------ [2020-09-16 16:30:53] cmb@php.net Related To: Bug #80112 ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at https://bugs.php.net/bug.php?id=80111 -- Edit this bug report at https://bugs.php.net/bug.php?id=80111&edit=1