CVE-2017-7963
Last modified
CVE-2017-7963 is a vulnerability of currently unknown severity. The GNU Multiple Precision Arithmetic Library (GMP) interfaces for PHP through 7.1.4 allow attackers to cause a denial of service (memory consumption and application crash) via operations on long strings. NOTE: the vendor disputes this, stating "There is no security issue here, because GMP safely aborts in case of an OOM condition. EPSS estimates a 1.74% chance of exploitation in the next 30 days.
Description
The GNU Multiple Precision Arithmetic Library (GMP) interfaces for PHP through 7.1.4 allow attackers to cause a denial of service (memory consumption and application crash) via operations on long strings. NOTE: the vendor disputes this, stating "There is no security issue here, because GMP safely aborts in case of an OOM condition. The only attack vector here is denial of service. However, if you allow attacker-controlled, unbounded allocations you have a DoS vector regardless of GMP's OOM behavior.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Php | Php | <= 7.1.4 |
References
- https://bugs.php.net/bug.php?id=74308Issue Tracking, Vendor Advisory
- https://bugs.php.net/bug.php?id=74308Issue Tracking, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2017-7963?
How severe is CVE-2017-7963?
How do I fix CVE-2017-7963?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2017
- CVE-2017-7952INFOR EAM V11.0 Build 201410 has SQL injection via search fi…
- CVE-2017-7953INFOR EAM V11.0 Build 201410 has XSS via comment fields.
- CVE-2017-7957XStream through 1.4.9, when a certain denyTypes workaround i…7.5
- CVE-2017-7960The cr_input_new_from_uri function in cr-input.c in libcroco…
- CVE-2017-7961The cr_tknzr_parse_rgb function in cr-tknzr.c in libcroco 0.…7.8
- CVE-2017-7962The iwgif_read_image function in imagew-gif.c in libimagewor…
- CVE-2017-7964Zyxel WRE6505 devices have a default TELNET password of 1234…
- CVE-2017-7965A buffer overflow vulnerability exists in Programming Softwa…7.3
- CVE-2017-7966A DLL Hijacking vulnerability in the programming software in…
- CVE-2017-7967All versions of VAMPSET software produced by Schneider Elect…
- CVE-2017-7968An Incorrect Default Permissions issue was discovered in Sch…
- CVE-2017-7969A cross-site request forgery vulnerability exists on the Sec…
Are you affected by CVE-2017-7963?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST