PT-2017-18030 · Php+1 · Php+1

Whitehat002 · Published 2017-04-19 · Updated 2024-08-05 · CVE-2017-7963

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions PHP versions through 7.1.4

Description The issue allows attackers to cause a denial of service via operations on long strings, resulting in memory consumption and application crash. The vendor disputes this, stating that GMP safely aborts in case of an OOM condition, and the only attack vector is denial of service. However, if attacker-controlled, unbounded allocations are allowed, there is a DoS vector regardless of GMP's OOM behavior.

Recommendations For PHP versions through 7.1.4, consider restricting the length of input strings to prevent unbounded allocations and minimize the risk of denial of service attacks. As a temporary workaround, monitor application memory consumption and implement measures to prevent excessive memory usage. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

ALT-PU-2017-1610

CVE-2017-7963

Affected Products

Alt Linux

Php

References · 11

• https://osv.dev/vulnerability/CVE-2017-7963 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7963 · Security Note
• https://ubuntu.com/security/CVE-2017-7963 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-7963 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-7963 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-7963 · Security Note
• https://bugs.php.net/bug.php?id=74308 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2017-1610 · Vendor Advisory
• https://t.me/cvenotify/89242 · Telegram Post
• https://packages.altlinux.org/ru/vuln/CVE-2017-7963 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7963 · Note