CVE-2017-11147

Name: CVE-2017-11147
Creator: NVD / NIST
Published: 2017-07-10T14:29:00.697+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

CRITICALCVSS 9.1/10EPSS 4.71%

Last modified Jun 17, 2026

CVE-2017-11147 is a critical-severity vulnerability rated 9.1/10 on the CVSS scale. In PHP before 5.6.30 and 7.x before 7.0.15, the PHAR archive handler could be used by attackers supplying malicious archive files to crash the PHP interpreter or potentially disclose information due to a buffer over-read in the phar_parse_pharfile function in ext/phar/phar.c.. EPSS estimates a 4.71% chance of exploitation in the next 30 days.

Description

In PHP before 5.6.30 and 7.x before 7.0.15, the PHAR archive handler could be used by attackers supplying malicious archive files to crash the PHP interpreter or potentially disclose information due to a buffer over-read in the phar_parse_pharfile function in ext/phar/phar.c.

Metrics

CVSS 3.1

9.1/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

EPSS Probability

4.71%

90.7th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-125

Affected Software

Vendor	Product	Versions
Php	Php	< 5.6.30
Php	Php	>= 7.0.0, < 7.0.15
Php	Php	>= 7.1.0, < 7.1.1
Netapp	Clustered Data Ontap	All versions

References

http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=e5246580a85f031e1a3b8064edbaa55c1643a451
http://openwall.com/lists/oss-security/2017/07/10/6Mailing List, Patch, Third Party Advisory
http://php.net/ChangeLog-5.phpRelease Notes, Vendor Advisory
http://php.net/ChangeLog-7.phpRelease Notes, Vendor Advisory
http://www.securityfocus.com/bid/99607Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2018:1296Third Party Advisory
https://bugs.php.net/bug.php?id=73773Exploit, Issue Tracking, Vendor Advisory
https://security.netapp.com/advisory/ntap-20180112-0001/Third Party Advisory
https://www.tenable.com/security/tns-2017-12Third Party Advisory
http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=e5246580a85f031e1a3b8064edbaa55c1643a451
http://openwall.com/lists/oss-security/2017/07/10/6Mailing List, Patch, Third Party Advisory
http://php.net/ChangeLog-5.phpRelease Notes, Vendor Advisory
http://php.net/ChangeLog-7.phpRelease Notes, Vendor Advisory
http://www.securityfocus.com/bid/99607Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2018:1296Third Party Advisory
https://bugs.php.net/bug.php?id=73773Exploit, Issue Tracking, Vendor Advisory
https://security.netapp.com/advisory/ntap-20180112-0001/Third Party Advisory
https://www.tenable.com/security/tns-2017-12Third Party Advisory

Timeline

Published: Jul 10, 2017
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2017-11147?

How severe is CVE-2017-11147?

CVE-2017-11147 has a CVSS score of 9.1/10 (CRITICAL severity). The EPSS model estimates a 4.71% probability of exploitation in the next 30 days.

How do I fix CVE-2017-11147?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2017-11147?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST