CVE-2017-11147 In PHP before 5.6.30 and 7.x before 7.0.15, the PHAR archive handler could be used by attackers supplying malicious archive files to crash the PHP interpreter or potentially disclose information due t...
CriticalCVSS 9.1
EPSS 4.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
In PHP before 5.6.30 and 7.x before 7.0.15, the PHAR archive handler could be used by attackers supplying malicious archive files to crash the PHP interpreter or potentially disclose information due to a buffer over-read in the phar_parse_pharfile function in ext/phar/phar.c.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| PHP | < 5.6.30 | 5.6.30 |
| PHP | >= 7.0.0, < 7.0.15 | 7.0.15 |
| PHP | >= 7.1.0, < 7.1.1 | 7.1.1 |
| netapp clustered data ontap | All versions | No fix listed |
References
- git.php.net
- openwall.com mailing-list patch third-party-advisory
- php.net release-notes vendor-advisory
- php.net release-notes vendor-advisory
- 99607 third-party-advisory vdb-entry
- RHSA-2018:1296 third-party-advisory vendor-advisory
- bugs.php.net exploit issue-tracking vendor-advisory
- security.netapp.com third-party-advisory
- www.tenable.com third-party-advisory