PT-2017-4177 · Php+2 · Php+2

Cyoung · Published 2017-07-08 · Updated 2018-05-04 · CVE-2017-12934

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions PHP versions 7.0.x through 7.0.20 PHP versions 7.1.x through 7.1.6

Description The issue is related to a heap use after free while unserializing untrusted data, which can have an unspecified impact on the integrity of PHP. This is due to the zval get type function in Zend/zend types.h. Exploitation of this issue may allow a remote attacker to affect data integrity.

Recommendations For PHP versions 7.0.x through 7.0.20, update to version 7.0.21 or later. For PHP versions 7.1.x through 7.1.6, update to version 7.1.7 or later.

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

ALT-PU-2017-1822

BDU:2022-02420

CVE-2017-12934

DSA-4080-1

RHSA-2018:1296

SUSE-SU-2017:2468-1

Affected Products

Alt Linux

Php

Suse

References · 68

• https://bdu.fstec.ru/vul/2017-01714 · Security Note
• https://bdu.fstec.ru/vul/2017-01841 · Security Note
• https://errata.altlinux.org/ALT-PU-2017-1822 · Vendor Advisory
• https://bdu.fstec.ru/vul/2017-01838 · Security Note
• https://bdu.fstec.ru/vul/2022-02423 · Security Note
• https://bdu.fstec.ru/vul/2017-02023 · Security Note
• http://php.net/ChangeLog-7.php · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9226 · Security Note
• https://ubuntu.com/security/CVE-2017-12934 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11628 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12932 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11144 · Security Note
• https://bdu.fstec.ru/vul/2019-04386 · Security Note
• https://bdu.fstec.ru/vul/2018-00008 · Security Note
• https://access.redhat.com/errata/RHSA-2018:1296 · Vendor Advisory