PT-2017-2597 · Php+3 · Php+3

Whitehat002 · Published 2017-05-21 · Updated 2022-03-03 · CVE-2017-9119

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PHP version 7.1.5

Description The issue is related to the i zval ptr dtor function in Zend/zend variables.h, which allows attackers to cause a denial of service (memory consumption and application crash) or possibly have unspecified other impact by triggering crafted operations on array data structures. This can lead to memory consumption and application crash when specially crafted commands are executed on array data structures.

Recommendations For PHP version 7.1.5, consider updating to a newer version to mitigate the risk, as the current version allows for denial of service and potential other impacts due to the i zval ptr dtor function issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

ALT-PU-2017-1707

BDU:2017-01813

CVE-2017-9119

USN-5300-1

USN-5300-2

Affected Products

Alt Linux

Linuxmint

Php

Ubuntu

References · 38

• 🔥 https://bugs.php.net/bug.php?id=74593 · Exploit
• https://errata.altlinux.org/ALT-PU-2017-1707 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5300-2 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21707 · Security Note
• https://bdu.fstec.ru/vul/2022-02425 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9118 · Security Note
• https://osv.dev/vulnerability/USN-5300-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2017-01814 · Security Note
• https://ubuntu.com/security/CVE-2017-9118 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-9119 · Vendor Advisory
• https://ubuntu.com/security/CVE-2015-9253 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-9119 · Security Note
• https://ubuntu.com/security/notices/USN-5300-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9119 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8923 · Security Note