CVE-2017-11144 In PHP before 5.6.31, 7.x before 7.0.21, and 7.1.x before 7.1.7, the openssl extension PEM sealing code did not check the return value of the OpenSSL sealing function, which could lead to a crash of t...
HighCVSS 7.5
EPSS 6.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
In PHP before 5.6.31, 7.x before 7.0.21, and 7.1.x before 7.1.7, the openssl extension PEM sealing code did not check the return value of the OpenSSL sealing function, which could lead to a crash of the PHP interpreter, related to an interpretation conflict for a negative number in ext/openssl/openssl.c, and an OpenSSL documentation omission.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| PHP | <= 5.6.30 | No fix listed |
| PHP | = 7.0.0 | No fix listed |
| PHP | = 7.0.1 | No fix listed |
| PHP | = 7.0.2 | No fix listed |
| PHP | = 7.0.3 | No fix listed |
| PHP | = 7.0.4 | No fix listed |
| PHP | = 7.0.5 | No fix listed |
| PHP | = 7.0.6 | No fix listed |
| PHP | = 7.0.7 | No fix listed |
| PHP | = 7.0.8 | No fix listed |
| PHP | = 7.0.9 | No fix listed |
| PHP | = 7.0.10 | No fix listed |
| PHP | = 7.0.11 | No fix listed |
| PHP | = 7.0.12 | No fix listed |
| PHP | = 7.0.13 | No fix listed |
| PHP | = 7.0.14 | No fix listed |
| PHP | = 7.0.15 | No fix listed |
| PHP | = 7.0.16 | No fix listed |
| PHP | = 7.0.17 | No fix listed |
| PHP | = 7.0.18 | No fix listed |
| PHP | = 7.0.19 | No fix listed |
| PHP | = 7.0.20 | No fix listed |
| PHP | = 7.1.0 | No fix listed |
| PHP | = 7.1.1 | No fix listed |
| PHP | = 7.1.2 | No fix listed |
Show 4 more
| Product | Affected versions | Fixed in |
|---|---|---|
| PHP | = 7.1.3 | No fix listed |
| PHP | = 7.1.4 | No fix listed |
| PHP | = 7.1.5 | No fix listed |
| PHP | = 7.1.6 | No fix listed |
References
- git.php.net
- git.php.net
- git.php.net
- openwall.com mailing-list
- php.net release-notes vendor-advisory
- php.net release-notes vendor-advisory
- RHSA-2018:1296 vendor-advisory
- bugs.php.net third-party-advisory
- security.netapp.com
- DSA-4080 vendor-advisory
- DSA-4081 vendor-advisory
- www.tenable.com