Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2017-11147

Date: July 10, 2017

In PHP before 5.6.30 and 7.x before 7.0.15, the PHAR archive handler could be used by attackers supplying malicious archive files to crash the PHP interpreter or potentially disclose information due to a buffer over-read in the phar_parse_pharfile function in ext/phar/phar.c.

Language: C

Severity Score

Related Resources (13)

http://www.securityfocus.com/bid/99607
https://www.tenable.com/security/tns-2017-12
https://security.netapp.com/advisory/ntap-20180112-0001/
http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=e5246580a85f031e1a3b8064edbaa55c1643a451
https://nvd.nist.gov/vuln/detail/CVE-2017-11147
https://people.canonical.com/~ubuntu-security/cve/CVE-2017-11147
http://openwall.com/lists/oss-security/2017/07/10/6
http://php.net/ChangeLog-5.php
https://access.redhat.com/security/cve/CVE-2017-11147
https://bugs.php.net/bug.php?id=73773
http://php.net/ChangeLog-7.php
https://access.redhat.com/errata/RHSA-2018:1296
https://www.mend.io/vulnerability-database/CVE-2017-11147

Severity Score

Weakness Type (CWE)

Improper Restriction of Operations within the Bounds of a Memory Buffer

CWE-119

Out-of-bounds Read

CWE-125

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): HIGH
Integrity (I): NONE
Availability (A): HIGH

CVSS v2

Base Score:
Access Vector (AV): NETWORK
Access Complexity (AC): LOW
Authentication (AU): NONE
Confidentiality (C): PARTIAL
Integrity (I): NONE
Availability (A): PARTIAL
Additional information:

Do you need more information?

Contact Us