CVE-2017-11628 Memory corruption in n/a
Stack-based buffer overflow in PHP's ini parser allows code execution or denial of service when applications parse untrusted ini strings.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2017-11628?
CVE-2017-11628 is a high-severity memory corruption vulnerability in Php Php, published on 25 Jul 2017. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
In PHP before 5.6.31, 7.x before 7.0.21, and 7.1.x before 7.1.7, a stack-based buffer overflow in the zend_ini_do_op() function in Zend/zend_ini_parser.c could cause a denial of service or potentially allow executing code. NOTE: this is only relevant for PHP applications that accept untrusted input (instead of the system's php.ini file) for the parse_ini_string or parse_ini_file function, e.g., a web application for syntax validation of php.ini directives.
Weakness: CWE-119
Which versions are affected by CVE-2017-11628?
It affects 1 product.
Products include Php Php.
How do I fix CVE-2017-11628?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2017-11628 being exploited?
There is no known exploitation of CVE-2017-11628 in the wild and no public exploit code.
Other vulnerabilities in Php Php
Sources
Also known as DLA-1066-1, GHSA-v28p-49px-6723, UBUNTU-CVE-2017-11628.