Cross-user heap disclosure via crafted MySQL field packet

Heap buffer over-read in mysqlnd in The PHP Group PHP allows remote authenticated users to disclose heap data through a hostile MySQL server. php_mysqlnd_rset_field_read trusts an attacker-controlled field length and copies that many bytes from the command buffer without rechecking the remaining input. Exploitation requires control of the MySQL target or script execution in a persistent PHP-FPM worker pool and exposes prior SQL responses or adjacent heap content.