Skip to content

CVE-2017-12933 The finish_nested_data function in ext/standard/var_unserializer.re in PHP before 5.6.31, 7.0.x before 7.0.21, and 7.1.x before 7.1.7 is prone to a buffer over-read while unserializing untrusted data....

CriticalCVSS 9.8 EPSS 6.9%
Published
Updated
Exploit status
No public exploit known
Sign in for asset impact Search another CVE

Description

The finish_nested_data function in ext/standard/var_unserializer.re in PHP before 5.6.31, 7.0.x before 7.0.21, and 7.1.x before 7.1.7 is prone to a buffer over-read while unserializing untrusted data. Exploitation of this issue can have an unspecified impact on the integrity of PHP.

Affected products

ProductAffected versionsFixed in
PHP <= 5.6.30 No fix listed
PHP = 7.0.0 No fix listed
PHP = 7.0.1 No fix listed
PHP = 7.0.2 No fix listed
PHP = 7.0.3 No fix listed
PHP = 7.0.4 No fix listed
PHP = 7.0.5 No fix listed
PHP = 7.0.6 No fix listed
PHP = 7.0.7 No fix listed
PHP = 7.0.8 No fix listed
PHP = 7.0.9 No fix listed
PHP = 7.0.10 No fix listed
PHP = 7.0.11 No fix listed
PHP = 7.0.12 No fix listed
PHP = 7.0.13 No fix listed
PHP = 7.0.14 No fix listed
PHP = 7.0.15 No fix listed
PHP = 7.0.16 No fix listed
PHP = 7.0.17 No fix listed
PHP = 7.0.18 No fix listed
PHP = 7.0.19 No fix listed
PHP = 7.0.20 No fix listed
PHP = 7.1.0 No fix listed
PHP = 7.1.1 No fix listed
PHP = 7.1.2 No fix listed
Show 4 more
ProductAffected versionsFixed in
PHP = 7.1.3 No fix listed
PHP = 7.1.4 No fix listed
PHP = 7.1.5 No fix listed
PHP = 7.1.6 No fix listed

References