CVE catalog

CVE-2024-5585

php8.2: CVE-2024-5585

Severity: Critical · CVSS 9.4CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Published: Jun 6, 2024, 10:00:00 PM UTC
Source: [NVD] · [CVE record]
EPSS: 28.81% · Oct 25, 2026

In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, the fix for CVE-2024-1874 does not work if the command name includes trailing spaces. Original issue: when using proc_open() command with array syntax, due to insufficient escaping, if the arguments of the executed command are controlled by a malicious user, the user can supply arguments that would execute arbitrary commands in Windows shell.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	php8.2	bookworm	`8.2.32-1~deb12u1`	not affected
Debian	php8.2	bookworm-security	`8.2.35-1~deb12u1`	not affected

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	php8.2	source	bookworm	`Not affected`	unimportant	Not reported	Not reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[libapache2-mod-php8.2]Not affected
Source package: [php8.2]
Details (4)
- 8.2.32-1~deb12u1 · amd64 · bookworm
  Not affected
  dsa · php8.2 · debian · bookworm
- 8.2.32-1~deb12u1 · arm64 · bookworm
  Not affected
  dsa · php8.2 · debian · bookworm
- 8.2.33-1~deb12u1 · amd64 · bookworm-security
  Not affected
  dsa · php8.2 · debian · bookworm
- 8.2.33-1~deb12u1 · arm64 · bookworm-security
  Not affected
  dsa · php8.2 · debian · bookworm
[libphp8.2-embed]Not affected
Source package: [php8.2]
Details (4)
- 8.2.32-1~deb12u1 · amd64 · bookworm
  Not affected
  dsa · php8.2 · debian · bookworm
- 8.2.32-1~deb12u1 · arm64 · bookworm
  Not affected
  dsa · php8.2 · debian · bookworm
- 8.2.33-1~deb12u1 · amd64 · bookworm-security
  Not affected
  dsa · php8.2 · debian · bookworm
- 8.2.33-1~deb12u1 · arm64 · bookworm-security
  Not affected
  dsa · php8.2 · debian · bookworm
[php8.2]Not affected
Details (4)
- 8.2.32-1~deb12u1 · all · bookworm
  Not affected
  dsa · php8.2 · debian · bookworm
- 8.2.32-1~deb12u1 · all · bookworm
  Not affected
  dsa · php8.2 · debian · bookworm
- 8.2.33-1~deb12u1 · all · bookworm-security
  Not affected
  dsa · php8.2 · debian · bookworm
- 8.2.33-1~deb12u1 · all · bookworm-security
  Not affected
  dsa · php8.2 · debian · bookworm
[php8.2-bcmath]Not affected
Source package: [php8.2]
Details (4)
- 8.2.32-1~deb12u1 · amd64 · bookworm
  Not affected
  dsa · php8.2 · debian · bookworm
- 8.2.32-1~deb12u1 · arm64 · bookworm
  Not affected
  dsa · php8.2 · debian · bookworm
- 8.2.33-1~deb12u1 · amd64 · bookworm-security
  Not affected
  dsa · php8.2 · debian · bookworm
- 8.2.33-1~deb12u1 · arm64 · bookworm-security
  Not affected
  dsa · php8.2 · debian · bookworm
[php8.2-bz2]Not affected
Source package: [php8.2]
Details (4)
- 8.2.32-1~deb12u1 · amd64 · bookworm
  Not affected
  dsa · php8.2 · debian · bookworm
- 8.2.32-1~deb12u1 · arm64 · bookworm
  Not affected
  dsa · php8.2 · debian · bookworm
- 8.2.33-1~deb12u1 · amd64 · bookworm-security
  Not affected
  dsa · php8.2 · debian · bookworm
- 8.2.33-1~deb12u1 · arm64 · bookworm-security
  Not affected
  dsa · php8.2 · debian · bookworm
[php8.2-cgi]Not affected
Source package: [php8.2]
Details (4)
- 8.2.32-1~deb12u1 · amd64 · bookworm
  Not affected
  dsa · php8.2 · debian · bookworm
- 8.2.32-1~deb12u1 · arm64 · bookworm
  Not affected
  dsa · php8.2 · debian · bookworm
- 8.2.33-1~deb12u1 · amd64 · bookworm-security
  Not affected
  dsa · php8.2 · debian · bookworm
- 8.2.33-1~deb12u1 · arm64 · bookworm-security
  Not affected
  dsa · php8.2 · debian · bookworm
[php8.2-cli]Not affected
Source package: [php8.2]
Details (4)
- 8.2.32-1~deb12u1 · amd64 · bookworm
  Not affected
  dsa · php8.2 · debian · bookworm
- 8.2.32-1~deb12u1 · arm64 · bookworm
  Not affected
  dsa · php8.2 · debian · bookworm
- 8.2.33-1~deb12u1 · amd64 · bookworm-security
  Not affected
  dsa · php8.2 · debian · bookworm
- 8.2.33-1~deb12u1 · arm64 · bookworm-security
  Not affected
  dsa · php8.2 · debian · bookworm
[php8.2-common]Not affected
Source package: [php8.2]
Details (4)
- 8.2.32-1~deb12u1 · amd64 · bookworm
  Not affected
  dsa · php8.2 · debian · bookworm
- 8.2.32-1~deb12u1 · arm64 · bookworm
  Not affected
  dsa · php8.2 · debian · bookworm
- 8.2.33-1~deb12u1 · amd64 · bookworm-security
  Not affected
  dsa · php8.2 · debian · bookworm
- 8.2.33-1~deb12u1 · arm64 · bookworm-security
  Not affected
  dsa · php8.2 · debian · bookworm
[php8.2-curl]Not affected
Source package: [php8.2]
Details (4)
- 8.2.32-1~deb12u1 · amd64 · bookworm
  Not affected
  dsa · php8.2 · debian · bookworm
- 8.2.32-1~deb12u1 · arm64 · bookworm
  Not affected
  dsa · php8.2 · debian · bookworm
- 8.2.33-1~deb12u1 · amd64 · bookworm-security
  Not affected
  dsa · php8.2 · debian · bookworm
- 8.2.33-1~deb12u1 · arm64 · bookworm-security
  Not affected
  dsa · php8.2 · debian · bookworm
[php8.2-dba]Not affected
Source package: [php8.2]
Details (4)
- 8.2.32-1~deb12u1 · amd64 · bookworm
  Not affected
  dsa · php8.2 · debian · bookworm
- 8.2.32-1~deb12u1 · arm64 · bookworm
  Not affected
  dsa · php8.2 · debian · bookworm
- 8.2.33-1~deb12u1 · amd64 · bookworm-security
  Not affected
  dsa · php8.2 · debian · bookworm
- 8.2.33-1~deb12u1 · arm64 · bookworm-security
  Not affected
  dsa · php8.2 · debian · bookworm
[php8.2-dev]Not affected
Source package: [php8.2]
Details (4)
- 8.2.32-1~deb12u1 · amd64 · bookworm
  Not affected
  dsa · php8.2 · debian · bookworm
- 8.2.32-1~deb12u1 · arm64 · bookworm
  Not affected
  dsa · php8.2 · debian · bookworm
- 8.2.33-1~deb12u1 · amd64 · bookworm-security
  Not affected
  dsa · php8.2 · debian · bookworm
- 8.2.33-1~deb12u1 · arm64 · bookworm-security
  Not affected
  dsa · php8.2 · debian · bookworm
[php8.2-enchant]Not affected
Source package: [php8.2]
Details (4)
- 8.2.32-1~deb12u1 · amd64 · bookworm
  Not affected
  dsa · php8.2 · debian · bookworm
- 8.2.32-1~deb12u1 · arm64 · bookworm
  Not affected
  dsa · php8.2 · debian · bookworm
- 8.2.33-1~deb12u1 · amd64 · bookworm-security
  Not affected
  dsa · php8.2 · debian · bookworm
- 8.2.33-1~deb12u1 · arm64 · bookworm-security
  Not affected
  dsa · php8.2 · debian · bookworm
[php8.2-fpm]Not affected
Source package: [php8.2]
Details (4)
- 8.2.32-1~deb12u1 · amd64 · bookworm
  Not affected
  dsa · php8.2 · debian · bookworm
- 8.2.32-1~deb12u1 · arm64 · bookworm
  Not affected
  dsa · php8.2 · debian · bookworm
- 8.2.33-1~deb12u1 · amd64 · bookworm-security
  Not affected
  dsa · php8.2 · debian · bookworm
- 8.2.33-1~deb12u1 · arm64 · bookworm-security
  Not affected
  dsa · php8.2 · debian · bookworm
[php8.2-gd]Not affected
Source package: [php8.2]
Details (4)
- 8.2.32-1~deb12u1 · amd64 · bookworm
  Not affected
  dsa · php8.2 · debian · bookworm
- 8.2.32-1~deb12u1 · arm64 · bookworm
  Not affected
  dsa · php8.2 · debian · bookworm
- 8.2.33-1~deb12u1 · amd64 · bookworm-security
  Not affected
  dsa · php8.2 · debian · bookworm
- 8.2.33-1~deb12u1 · arm64 · bookworm-security
  Not affected
  dsa · php8.2 · debian · bookworm
[php8.2-gmp]Not affected
Source package: [php8.2]
Details (4)
- 8.2.32-1~deb12u1 · amd64 · bookworm
  Not affected
  dsa · php8.2 · debian · bookworm
- 8.2.32-1~deb12u1 · arm64 · bookworm
  Not affected
  dsa · php8.2 · debian · bookworm
- 8.2.33-1~deb12u1 · amd64 · bookworm-security
  Not affected
  dsa · php8.2 · debian · bookworm
- 8.2.33-1~deb12u1 · arm64 · bookworm-security
  Not affected
  dsa · php8.2 · debian · bookworm
[php8.2-imap]Not affected
Source package: [php8.2]
Details (4)
- 8.2.32-1~deb12u1 · amd64 · bookworm
  Not affected
  dsa · php8.2 · debian · bookworm
- 8.2.32-1~deb12u1 · arm64 · bookworm
  Not affected
  dsa · php8.2 · debian · bookworm
- 8.2.33-1~deb12u1 · amd64 · bookworm-security
  Not affected
  dsa · php8.2 · debian · bookworm
- 8.2.33-1~deb12u1 · arm64 · bookworm-security
  Not affected
  dsa · php8.2 · debian · bookworm
[php8.2-interbase]Not affected
Source package: [php8.2]
Details (4)
- 8.2.32-1~deb12u1 · amd64 · bookworm
  Not affected
  dsa · php8.2 · debian · bookworm
- 8.2.32-1~deb12u1 · arm64 · bookworm
  Not affected
  dsa · php8.2 · debian · bookworm
- 8.2.33-1~deb12u1 · amd64 · bookworm-security
  Not affected
  dsa · php8.2 · debian · bookworm
- 8.2.33-1~deb12u1 · arm64 · bookworm-security
  Not affected
  dsa · php8.2 · debian · bookworm
[php8.2-intl]Not affected
Source package: [php8.2]
Details (4)
- 8.2.32-1~deb12u1 · amd64 · bookworm
  Not affected
  dsa · php8.2 · debian · bookworm
- 8.2.32-1~deb12u1 · arm64 · bookworm
  Not affected
  dsa · php8.2 · debian · bookworm
- 8.2.33-1~deb12u1 · amd64 · bookworm-security
  Not affected
  dsa · php8.2 · debian · bookworm
- 8.2.33-1~deb12u1 · arm64 · bookworm-security
  Not affected
  dsa · php8.2 · debian · bookworm
[php8.2-ldap]Not affected
Source package: [php8.2]
Details (4)
- 8.2.32-1~deb12u1 · amd64 · bookworm
  Not affected
  dsa · php8.2 · debian · bookworm
- 8.2.32-1~deb12u1 · arm64 · bookworm
  Not affected
  dsa · php8.2 · debian · bookworm
- 8.2.33-1~deb12u1 · amd64 · bookworm-security
  Not affected
  dsa · php8.2 · debian · bookworm
- 8.2.33-1~deb12u1 · arm64 · bookworm-security
  Not affected
  dsa · php8.2 · debian · bookworm
[php8.2-mbstring]Not affected
Source package: [php8.2]
Details (4)
- 8.2.32-1~deb12u1 · amd64 · bookworm
  Not affected
  dsa · php8.2 · debian · bookworm
- 8.2.32-1~deb12u1 · arm64 · bookworm
  Not affected
  dsa · php8.2 · debian · bookworm
- 8.2.33-1~deb12u1 · amd64 · bookworm-security
  Not affected
  dsa · php8.2 · debian · bookworm
- 8.2.33-1~deb12u1 · arm64 · bookworm-security
  Not affected
  dsa · php8.2 · debian · bookworm

Next results

Observed: Oct 27, 2026, 3:33:13 AM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [SUSE security advisories and VEX]