blogsafe.org My Downloads

BlogSafe.org

PHP CVEs

Vulnerabilities in the PHP language itself, and which PHP versions they affect.

← Back to CVE list

CVE-2017-11628

HIGH 7.8 CVSS 3.0
Published
July 25, 2017
Last modified
June 17, 2026
NVD status
Modified
Reported by
cve@mitre.org
Weakness
CWE-119
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Description

In PHP before 5.6.31, 7.x before 7.0.21, and 7.1.x before 7.1.7, a stack-based buffer overflow in the zend_ini_do_op() function in Zend/zend_ini_parser.c could cause a denial of service or potentially allow executing code. NOTE: this is only relevant for PHP applications that accept untrusted input (instead of the system's php.ini file) for the parse_ini_string or parse_ini_file function, e.g., a web application for syntax validation of php.ini directives.

Affected products and versions

  • PHP — Up to and including 5.6.30
  • PHP versions 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.0.10, 7.0.11, 7.0.12, 7.0.13, 7.0.14, 7.0.15, 7.0.16, 7.0.17, 7.0.18, 7.0.19, 7.0.20, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6

References