blogsafe.org My Downloads

BlogSafe.org

PHP CVEs

Vulnerabilities in the PHP language itself, and which PHP versions they affect.

← Back to CVE list

CVE-2017-11144

HIGH 7.5 CVSS 3.0
Published
July 10, 2017
Last modified
June 17, 2026
NVD status
Modified
Reported by
cve@mitre.org
Weakness
CWE-754
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Description

In PHP before 5.6.31, 7.x before 7.0.21, and 7.1.x before 7.1.7, the openssl extension PEM sealing code did not check the return value of the OpenSSL sealing function, which could lead to a crash of the PHP interpreter, related to an interpretation conflict for a negative number in ext/openssl/openssl.c, and an OpenSSL documentation omission.

Affected products and versions

  • PHP — Up to and including 5.6.30
  • PHP versions 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.0.10, 7.0.11, 7.0.12, 7.0.13, 7.0.14, 7.0.15, 7.0.16, 7.0.17, 7.0.18, 7.0.19, 7.0.20, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6

References

  • git.php.net http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=73cabfedf519298e1a11192699f44d53c529315e
  • git.php.net http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=89637c6b41b510c20d262c17483f582f115c66d6
  • git.php.net http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=91826a311dd37f4c4e5d605fa7af331e80ddd4c3
  • openwall.com http://openwall.com/lists/oss-security/2017/07/10/6 Mailing List
  • php.net http://php.net/ChangeLog-5.php Release Notes, Vendor Advisory
  • php.net http://php.net/ChangeLog-7.php Release Notes, Vendor Advisory
  • access.redhat.com https://access.redhat.com/errata/RHSA-2018:1296
  • bugs.php.net https://bugs.php.net/bug.php?id=74651 Third Party Advisory
  • security.netapp.com https://security.netapp.com/advisory/ntap-20180112-0001/
  • www.debian.org https://www.debian.org/security/2018/dsa-4080
  • www.debian.org https://www.debian.org/security/2018/dsa-4081
  • www.tenable.com https://www.tenable.com/security/tns-2017-12
  • nvd.nist.gov Official NVD record