high7.5Public exploit code

CVE-2017-16642

In PHP before 5.6.32, 7.x before 7.0.25, and 7.1.x before 7.1.11, an error in the date extension's timelib_meridian handling of 'front of' and 'back of' direct…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

PHP 7.1.8 - Heap Buffer Overflow2017-11-09 · dos · multiple · Verified

Impact

In PHP before 5.6.32, 7.x before 7.0.25, and 7.1.x before 7.1.11, an error in the date extension's timelib_meridian handling of 'front of' and 'back of' directives could be used by attackers able to supply date strings to leak information from the interpreter, related to ext/date/lib/parse_date.c out-of-bounds reads affecting the php_parse_date function. NOTE: this is a different issue than CVE-2017-11145.

Affected products

Vendor	Product	Affected versions
Php	Php	before 5.6.32 from 7.0.0 before 7.0.25 from 7.1.0 before 7.1.11
Debian	Debian Linux	Versions 8.0, 9.0
Canonical	Ubuntu Linux	Version 14.04
Netapp	Storage Automation Store	All versions
Netapp	Clustered Data Ontap	All versions

Weakness classification

CWE-125

Public exploit code

Impact

Affected products

Weakness classification

References