blogsafe.org My Downloads

BlogSafe.org

PHP CVEs

Vulnerabilities in the PHP language itself, and which PHP versions they affect.

← Back to CVE list

CVE-2017-11147

CRITICAL 9.1 CVSS 3.1
Published
July 10, 2017
Last modified
June 17, 2026
NVD status
Modified
Reported by
cve@mitre.org
Weakness
CWE-125
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Description

In PHP before 5.6.30 and 7.x before 7.0.15, the PHAR archive handler could be used by attackers supplying malicious archive files to crash the PHP interpreter or potentially disclose information due to a buffer over-read in the phar_parse_pharfile function in ext/phar/phar.c.

Affected products and versions

  • PHP — Before 5.6.30
  • PHP — From 7.0.0 (including) to 7.0.15 (excluding)
  • PHP — From 7.1.0 (including) to 7.1.1 (excluding)

References

  • git.php.net http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=e5246580a85f031e1a3b8064edbaa55c1643a451
  • openwall.com http://openwall.com/lists/oss-security/2017/07/10/6 Mailing List, Patch, Third Party Advisory
  • php.net http://php.net/ChangeLog-5.php Release Notes, Vendor Advisory
  • php.net http://php.net/ChangeLog-7.php Release Notes, Vendor Advisory
  • www.securityfocus.com http://www.securityfocus.com/bid/99607 Third Party Advisory, VDB Entry
  • access.redhat.com https://access.redhat.com/errata/RHSA-2018:1296 Third Party Advisory
  • bugs.php.net https://bugs.php.net/bug.php?id=73773 Exploit, Issue Tracking, Vendor Advisory
  • security.netapp.com https://security.netapp.com/advisory/ntap-20180112-0001/ Third Party Advisory
  • www.tenable.com https://www.tenable.com/security/tns-2017-12 Third Party Advisory
  • nvd.nist.gov Official NVD record