CVE-2018-7584

In PHP through 5.6.33, 7.0.x before 7.0.28, 7.1.x through 7.1.14, and 7.2.x through 7.2.2, there is a stack-based buffer under-read while parsing an HTTP response in the php_stream_url_wrap_http_ex function in ext/standard/http_fopen_wrapper.c. This subsequently results in copying a large string.

• CWE-119

• http://php.net/ChangeLog-7.phpRelease Notes
• http://www.securityfocus.com/bid/103204Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1041607Third Party Advisory, VDB Entry
• https://access.redhat.com/errata/RHSA-2019:2519
• https://bugs.php.net/bug.php?id=75981Issue Tracking
• https://github.com/php/php-src/commit/523f230c831d7b33353203fa34aee4e92ac12bbaPatch
• https://lists.debian.org/debian-lts-announce/2018/03/msg00030.htmlMailing List, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2018/06/msg00005.htmlMailing List, Third Party Advisory
• https://usn.ubuntu.com/3600-1/Third Party Advisory
• https://usn.ubuntu.com/3600-2/Third Party Advisory
• https://www.debian.org/security/2018/dsa-4240Third Party Advisory
• https://www.exploit-db.com/exploits/44846/Exploit, Third Party Advisory, VDB Entry
• https://www.tenable.com/security/tns-2018-03Third Party Advisory
• https://www.tenable.com/security/tns-2018-12Third Party Advisory
• http://php.net/ChangeLog-7.phpRelease Notes
• http://www.securityfocus.com/bid/103204Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1041607Third Party Advisory, VDB Entry
• https://access.redhat.com/errata/RHSA-2019:2519
• https://bugs.php.net/bug.php?id=75981Issue Tracking
• https://github.com/php/php-src/commit/523f230c831d7b33353203fa34aee4e92ac12bbaPatch
• https://lists.debian.org/debian-lts-announce/2018/03/msg00030.htmlMailing List, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2018/06/msg00005.htmlMailing List, Third Party Advisory
• https://usn.ubuntu.com/3600-1/Third Party Advisory
• https://usn.ubuntu.com/3600-2/Third Party Advisory
• https://www.debian.org/security/2018/dsa-4240Third Party Advisory
• https://www.exploit-db.com/exploits/44846/Exploit, Third Party Advisory, VDB Entry
• https://www.tenable.com/security/tns-2018-03Third Party Advisory
• https://www.tenable.com/security/tns-2018-12Third Party Advisory

Published

Mar 1, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-7577Memcpy parameter overlap in Google Snappy library 1.1.4, as …
• CVE-2018-7579\application\admin\controller\update_urls.class.php in YzmCM…
• CVE-2018-7580Philips Hue is vulnerable to a Denial of Service attack. Sen…7.5
• CVE-2018-7581\ProgramData\WebLog Expert\WebServer\WebServer.cfg in WebLog…
• CVE-2018-7582WebLog Expert Web Server Enterprise 9.4 allows Remote Denial…
• CVE-2018-7583Proxy.exe in DualDesk 20 allows Remote Denial Of Service (da…
• CVE-2018-7586In the nextgen-gallery plugin before 2.2.50 for WordPress, g…
• CVE-2018-7587An issue was discovered in CImg v.220. DoS occurs when loadi…
• CVE-2018-7588An issue was discovered in CImg v.220. A heap-based buffer o…
• CVE-2018-7589An issue was discovered in CImg v.220. A double free in load…
• CVE-2018-7590CSRF exists in Hoosk 1.7.0 via /admin/users/new/add, resulti…
• CVE-2018-7600Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, an…9.8