CVE-2017-16642 In PHP before 5.6.32, 7.x before 7.0.25, and 7.1.x before 7.1.11, an error in the date extension's timelib_meridian handling of 'front of' and 'back of' directives could be used by attackers able to s...
HighCVSS 7.5
EPSS 26.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
In PHP before 5.6.32, 7.x before 7.0.25, and 7.1.x before 7.1.11, an error in the date extension's timelib_meridian handling of 'front of' and 'back of' directives could be used by attackers able to supply date strings to leak information from the interpreter, related to ext/date/lib/parse_date.c out-of-bounds reads affecting the php_parse_date function. NOTE: this is a different issue than CVE-2017-11145.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| PHP | < 5.6.32 | 5.6.32 |
| PHP | >= 7.0.0, < 7.0.25 | 7.0.25 |
| PHP | >= 7.1.0, < 7.1.11 | 7.1.11 |
| debian linux | = 8.0 | No fix listed |
| debian linux | = 9.0 | No fix listed |
| Canonical Ubuntu Linux | = 14.04 | No fix listed |
| netapp storage automation store | All versions | No fix listed |
| netapp clustered data ontap | All versions | No fix listed |
References
- php.net issue-tracking release-notes vendor-advisory
- php.net issue-tracking release-notes vendor-advisory
- 101745 third-party-advisory vdb-entry
- RHSA-2018:1296 third-party-advisory vendor-advisory
- RHSA-2019:2519 vendor-advisory
- bugs.php.net issue-tracking vendor-advisory
- github.com issue-tracking patch third-party-advisory
- github.com issue-tracking patch third-party-advisory
- security.netapp.com third-party-advisory
- USN-3566-1 third-party-advisory vendor-advisory
- DSA-4080 third-party-advisory vendor-advisory
- DSA-4081 third-party-advisory vendor-advisory
- 43133 exploit issue-tracking third-party-advisory vdb-entry