CVE catalog

CVE-2021-21708

php8-8.1.3-1.1 on GA media

[CVE catalog]

Severity
Critical · CVSS 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published
Updated
Source
[NVD] · [CVE record]
EPSS
3.00% · Oct 25, 2026

In PHP versions 7.4.x below 7.4.28, 8.0.x below 8.0.16, and 8.1.x below 8.1.3, when using filter functions with FILTER_VALIDATE_FLOAT filter and min/max limits, if the filter fails, there is a possibility to trigger use of allocated memory after free, which can result it crashes, and potentially in overwrite of other memory chunks and RCE. This issue affects: code that uses FILTER_VALIDATE_FLOAT with min/max limits.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianphp7.4117.4.21-1+deb11u1vulnerable
Debianphp7.4117.4.25-1+deb11u1vulnerable
Debianphp7.4117.4.26-1vulnerable
Debianphp7.4117.4.28-1+deb11u1fixed
Ubuntuphp7.420.047.4.3-4build1vulnerable
Ubuntuphp7.420.047.4.3-4build2vulnerable
Ubuntuphp7.420.047.4.3-4ubuntu1vulnerable
Ubuntuphp7.420.047.4.3-4ubuntu1.1vulnerable
Ubuntuphp7.420.047.4.3-4ubuntu2.2vulnerable
Ubuntuphp7.420.047.4.3-4ubuntu2.4vulnerable
Ubuntuphp7.420.047.4.3-4ubuntu2.5vulnerable
Ubuntuphp7.420.047.4.3-4ubuntu2.6vulnerable
Ubuntuphp7.420.047.4.3-4ubuntu2.7vulnerable
Ubuntuphp7.420.047.4.3-4ubuntu2.8vulnerable
Ubuntuphp7.420.047.4.3-4ubuntu2.9fixed
Ubuntuphp8.122.048.1.0~rc4-1ubuntu2vulnerable
Ubuntuphp8.122.048.1.0-1vulnerable
Ubuntuphp8.122.048.1.2-1ubuntu1fixed
Ubuntuphp7.420.047.4.3-4build1vulnerable
Ubuntuphp7.420.047.4.3-4build2vulnerable
Ubuntuphp7.420.047.4.3-4ubuntu1vulnerable
Ubuntuphp7.420.047.4.3-4ubuntu1.1vulnerable
Ubuntuphp7.420.047.4.3-4ubuntu2.2vulnerable
Ubuntuphp7.420.047.4.3-4ubuntu2.4vulnerable
Ubuntuphp7.420.047.4.3-4ubuntu2.5vulnerable
Ubuntuphp7.420.047.4.3-4ubuntu2.6vulnerable
Ubuntuphp7.420.047.4.3-4ubuntu2.7vulnerable
Ubuntuphp7.420.047.4.3-4ubuntu2.8vulnerable
Ubuntuphp7.420.047.4.3-4ubuntu2.9fixed
Susephp74linux enterprise module for web and scripting 127.4.6-1.36.1fixed
Susephp74linux enterprise software development kit 12 sp57.4.6-1.36.1fixed
Opensusephp7leap 15.37.4.6-3.35.1fixed
Opensusephp7-testleap 15.37.4.6-3.35.1fixed
Susephp7linux enterprise module for package hub 15 sp37.4.6-3.35.1fixed
Susephp7linux enterprise module for web and scripting 15 sp37.4.6-3.35.1fixed
Susephp7linux enterprise high performance computing 15 sp2-espos7.4.6-3.35.1fixed
Susephp7linux enterprise high performance computing 15 sp2-ltss7.4.6-3.35.1fixed
Susephp7linux enterprise server 15 sp2-bcl7.4.6-3.35.1fixed
Susephp7linux enterprise server 15 sp2-ltss7.4.6-3.35.1fixed
Susephp7linux enterprise server for sap applications 15 sp27.4.6-3.35.1fixed
Susephp7manager proxy 4.17.4.6-3.35.1fixed
Susephp7manager retail branch server 4.17.4.6-3.35.1fixed
Susephp7manager server 4.17.4.6-3.35.1fixed
Susephp7enterprise storage 77.4.6-3.35.1fixed
Opensusephp7tumbleweed7.4.28-1.1fixed
Opensusephp8tumbleweed8.1.3-1.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianphp7.4deb117.4.28-1+deb11u1Not reportedDEBIAN-CVE-2021-21708Not reported
Ubuntuphp7.4deb20.047.4.3-4ubuntu2.9Not reportedUBUNTU-CVE-2021-21708Not reported
Ubuntuphp8.1deb22.048.1.2-1ubuntu1Not reportedUBUNTU-CVE-2021-21708Not reported
Ubuntuphp7.4deb20.047.4.3-4ubuntu2.9Not reportedUSN-5303-1Not reported
Susephp74rpmlinux enterprise module for web and scripting 127.4.6-1.36.1Not reportedSUSE-SU-2022:0654-1Not reported
Susephp74rpmlinux enterprise software development kit 12 sp57.4.6-1.36.1Not reportedSUSE-SU-2022:0654-1Not reported
Opensusephp7rpmleap 15.37.4.6-3.35.1Not reportedOPENSUSE-SU-2022:0847-1Not reported
Opensusephp7-testrpmleap 15.37.4.6-3.35.1Not reportedOPENSUSE-SU-2022:0847-1Not reported
Susephp7rpmlinux enterprise module for package hub 15 sp37.4.6-3.35.1Not reportedSUSE-SU-2022:0847-1Not reported
Susephp7rpmlinux enterprise module for web and scripting 15 sp37.4.6-3.35.1Not reportedSUSE-SU-2022:0847-1Not reported
Susephp7rpmlinux enterprise high performance computing 15 sp2-espos7.4.6-3.35.1Not reportedSUSE-SU-2022:0847-1Not reported
Susephp7rpmlinux enterprise high performance computing 15 sp2-ltss7.4.6-3.35.1Not reportedSUSE-SU-2022:0847-1Not reported
Susephp7rpmlinux enterprise server 15 sp2-bcl7.4.6-3.35.1Not reportedSUSE-SU-2022:0847-1Not reported
Susephp7rpmlinux enterprise server 15 sp2-ltss7.4.6-3.35.1Not reportedSUSE-SU-2022:0847-1Not reported
Susephp7rpmlinux enterprise server for sap applications 15 sp27.4.6-3.35.1Not reportedSUSE-SU-2022:0847-1Not reported
Susephp7rpmmanager proxy 4.17.4.6-3.35.1Not reportedSUSE-SU-2022:0847-1Not reported
Susephp7rpmmanager retail branch server 4.17.4.6-3.35.1Not reportedSUSE-SU-2022:0847-1Not reported
Susephp7rpmmanager server 4.17.4.6-3.35.1Not reportedSUSE-SU-2022:0847-1Not reported
Susephp7rpmenterprise storage 77.4.6-3.35.1Not reportedSUSE-SU-2022:0847-1Not reported
Opensusephp7rpmtumbleweed7.4.28-1.1Not reportedOPENSUSE-SU-2024:11861-1Not reported
Opensusephp8rpmtumbleweed8.1.3-1.1Not reportedOPENSUSE-SU-2024:11854-1Not reported

OpenFactory catalog packages

[openSUSE Tumbleweed]

  • [php8-bcmath]Unknown

    Source package: [php8]

    Details (1)

    • 8.5.9-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 8.1.3-1.1

      Version impact unknown

      pypi · php8 · opensuse · tumbleweed

  • [php8-bz2]Unknown

    Source package: [php8]

    Details (1)

    • 8.5.9-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 8.1.3-1.1

      Version impact unknown

      pypi · php8 · opensuse · tumbleweed

  • [php8-calendar]Unknown

    Source package: [php8]

    Details (1)

    • 8.5.9-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 8.1.3-1.1

      Version impact unknown

      pypi · php8 · opensuse · tumbleweed

  • [php8-cli]Unknown

    Source package: [php8]

    Details (1)

    • 8.5.9-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 8.1.3-1.1

      Version impact unknown

      pypi · php8 · opensuse · tumbleweed

  • [php8-ctype]Unknown

    Source package: [php8]

    Details (1)

    • 8.5.9-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 8.1.3-1.1

      Version impact unknown

      pypi · php8 · opensuse · tumbleweed

  • [php8-curl]Unknown

    Source package: [php8]

    Details (1)

    • 8.5.9-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 8.1.3-1.1

      Version impact unknown

      pypi · php8 · opensuse · tumbleweed

  • [php8-dba]Unknown

    Source package: [php8]

    Details (1)

    • 8.5.9-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 8.1.3-1.1

      Version impact unknown

      pypi · php8 · opensuse · tumbleweed

  • [php8-devel]Unknown

    Source package: [php8]

    Details (1)

    • 8.5.9-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 8.1.3-1.1

      Version impact unknown

      pypi · php8 · opensuse · tumbleweed

  • [php8-dom]Unknown

    Source package: [php8]

    Details (1)

    • 8.5.9-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 8.1.3-1.1

      Version impact unknown

      pypi · php8 · opensuse · tumbleweed

  • [php8-enchant]Unknown

    Source package: [php8]

    Details (1)

    • 8.5.9-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 8.1.3-1.1

      Version impact unknown

      pypi · php8 · opensuse · tumbleweed

  • [php8-exif]Unknown

    Source package: [php8]

    Details (1)

    • 8.5.9-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 8.1.3-1.1

      Version impact unknown

      pypi · php8 · opensuse · tumbleweed

  • [php8-ffi]Unknown

    Source package: [php8]

    Details (1)

    • 8.5.9-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 8.1.3-1.1

      Version impact unknown

      pypi · php8 · opensuse · tumbleweed

  • [php8-fileinfo]Unknown

    Source package: [php8]

    Details (1)

    • 8.5.9-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 8.1.3-1.1

      Version impact unknown

      pypi · php8 · opensuse · tumbleweed

  • [php8-ftp]Unknown

    Source package: [php8]

    Details (1)

    • 8.5.9-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 8.1.3-1.1

      Version impact unknown

      pypi · php8 · opensuse · tumbleweed

  • [php8-gd]Unknown

    Source package: [php8]

    Details (1)

    • 8.5.9-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 8.1.3-1.1

      Version impact unknown

      pypi · php8 · opensuse · tumbleweed

  • [php8-gettext]Unknown

    Source package: [php8]

    Details (1)

    • 8.5.9-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 8.1.3-1.1

      Version impact unknown

      pypi · php8 · opensuse · tumbleweed

  • [php8-gmp]Unknown

    Source package: [php8]

    Details (1)

    • 8.5.9-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 8.1.3-1.1

      Version impact unknown

      pypi · php8 · opensuse · tumbleweed

  • [php8-iconv]Unknown

    Source package: [php8]

    Details (1)

    • 8.5.9-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 8.1.3-1.1

      Version impact unknown

      pypi · php8 · opensuse · tumbleweed

  • [php8-intl]Unknown

    Source package: [php8]

    Details (1)

    • 8.5.9-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 8.1.3-1.1

      Version impact unknown

      pypi · php8 · opensuse · tumbleweed

  • [php8-ldap]Unknown

    Source package: [php8]

    Details (1)

    • 8.5.9-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 8.1.3-1.1

      Version impact unknown

      pypi · php8 · opensuse · tumbleweed

Next results

Observed:

References

[FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]