PT-2017-2598 · Php+7 · Php+7
Publicado
2017-05-12
·
Atualizado
2026-02-24
·
CVE-2017-8923
CVSS v3.1
9.8
Crítica
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
PHP versions through 7.1.5
Description
The issue is related to the
zend string extend function in PHP, which does not prevent changes to string objects that result in a negative length. This allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact by leveraging a script's use of .= with a long string. The vulnerability can be exploited by using a specially crafted script that utilizes the .= operation with a long string.Recommendations
For PHP versions through 7.1.5, update to a version that contains a fix for this issue to prevent potential denial of service or other impacts.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
DoS
RCE
Memory Corruption
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Alt Linux
Centos
Linuxmint
Php
Red Hat
Rocky Linux
Suse
Ubuntu