CVE-2017-9118 Memory corruption in n/a
Out-of-bounds access in PHP's preg_replace function allows attackers to cause memory corruption, potentially leading to code execution or crashes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-9118?
CVE-2017-9118 is a high-severity memory corruption vulnerability in Netapp Storage Automation Store, published on 2 Aug 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
PHP 7.1.5 has an Out of bounds access in php_pcre_replace_impl via a crafted preg_replace call.
Weakness: CWE-125
Which versions are affected by CVE-2017-9118?
It affects 2 products.
Linux distribution packages (2)
php7 SUSE:Linux Enterprise Module for Web and Scripting 12 | All versions | 7.0.7-50.49.1 |
php7 SUSE:Linux Enterprise Software Development Kit 12 SP3 | All versions | 7.0.7-50.49.1 |
Products include Netapp Storage Automation Store, Php Php.
How do I fix CVE-2017-9118?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2017-9118 being exploited?
There is no known exploitation of CVE-2017-9118 in the wild and no public exploit code.
Other vulnerabilities in Netapp Storage Automation Store
Sources
Also known as GHSA-rhhv-cwx7-v2f7, MGASA-2021-0581, SUSE-SU-2018:2640-1, UBUNTU-CVE-2017-9118.