Strix
26.1K

CVE-2017-11628

UnknownEPSS 3.36%

Last modified

CVE-2017-11628 is a vulnerability of currently unknown severity. In PHP before 5.6.31, 7.x before 7.0.21, and 7.1.x before 7.1.7, a stack-based buffer overflow in the zend_ini_do_op() function in Zend/zend_ini_parser.c could cause a denial of service or potentially allow executing code. NOTE: this is only relevant for PHP applications that accept untrusted input (instead of the system's php.ini file) for the parse_ini_string or parse_ini_file function, e.g., a web application for syntax validation of php.ini directives.. EPSS estimates a 3.36% chance of exploitation in the next 30 days.

Description

In PHP before 5.6.31, 7.x before 7.0.21, and 7.1.x before 7.1.7, a stack-based buffer overflow in the zend_ini_do_op() function in Zend/zend_ini_parser.c could cause a denial of service or potentially allow executing code. NOTE: this is only relevant for PHP applications that accept untrusted input (instead of the system's php.ini file) for the parse_ini_string or parse_ini_file function, e.g., a web application for syntax validation of php.ini directives.

Metrics

EPSS Probability
3.36%

87.2th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
PhpPhp<= 5.6.30
PhpPhp7.0.0
PhpPhp7.0.1
PhpPhp7.0.2
PhpPhp7.0.3
PhpPhp7.0.4
PhpPhp7.0.5
PhpPhp7.0.6
PhpPhp7.0.7
PhpPhp7.0.8
PhpPhp7.0.9
PhpPhp7.0.10
PhpPhp7.0.11
PhpPhp7.0.12
PhpPhp7.0.13
PhpPhp7.0.14
PhpPhp7.0.15
PhpPhp7.0.16
PhpPhp7.0.17
PhpPhp7.0.18
PhpPhp7.0.19
PhpPhp7.0.20
PhpPhp7.1.0
PhpPhp7.1.1
PhpPhp7.1.2
PhpPhp7.1.3
PhpPhp7.1.4
PhpPhp7.1.5
PhpPhp7.1.6

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2017-11628?
In PHP before 5.6.31, 7.x before 7.0.21, and 7.1.x before 7.1.7, a stack-based buffer overflow in the zend_ini_do_op() function in Zend/zend_ini_parser.c could cause a denial of service or potentially allow executing code. NOTE: this is only relevant for PHP applications that accept untrusted input (instead of the system's php.ini file) for the parse_ini_string or parse_ini_file function, e.g., a web application for syntax validation of php.ini directives.
How severe is CVE-2017-11628?
Severity scoring for CVE-2017-11628 is pending analysis. The EPSS model estimates a 3.36% probability of exploitation in the next 30 days.
How do I fix CVE-2017-11628?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2017-11628?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST