In PHP before 5.6.31, 7.x before 7.0.21, and 7.1.x before 7.1.7, the openssl extension PEM sealing code did not check the return value of the OpenSSL sealing function, which could lead to a crash of the PHP interpreter, related to an interpretation conflict for a negative number in ext/openssl/openssl.c, and an OpenSSL documentation omission.
| Version | Base score | Base severity | Vector |
|---|
| Hyperlink | Resource Type |
|---|
In PHP before 5.6.31, 7.x before 7.0.21, and 7.1.x before 7.1.7, the openssl extension PEM sealing code did not check the return value of the OpenSSL sealing function, which could lead to a crash of the PHP interpreter, related to an interpretation conflict for a negative number in ext/openssl/openssl.c, and an OpenSSL documentation omission.
| Type | CWE ID | Description |
|---|---|---|
| text | N/A | n/a |
| Version | Base score | Base severity | Vector |
|---|
| CAPEC ID | Description |
|---|
| Event | Date |
|---|
| Hyperlink | Resource |
|---|---|
| http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=89637c6b41b510c20d262c17483f582f115c66d6 | x_refsource_CONFIRM |
| http://openwall.com/lists/oss-security/2017/07/10/6 | x_refsource_CONFIRM |
| https://www.tenable.com/security/tns-2017-12 | x_refsource_CONFIRM |
| http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=91826a311dd37f4c4e5d605fa7af331e80ddd4c3 | x_refsource_CONFIRM |
| http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=73cabfedf519298e1a11192699f44d53c529315e | x_refsource_CONFIRM |
| https://access.redhat.com/errata/RHSA-2018:1296 | vendor-advisory x_refsource_REDHAT |
| http://php.net/ChangeLog-5.php | x_refsource_CONFIRM |
| https://security.netapp.com/advisory/ntap-20180112-0001/ | x_refsource_CONFIRM |
| https://www.debian.org/security/2018/dsa-4081 | vendor-advisory x_refsource_DEBIAN |
| https://www.debian.org/security/2018/dsa-4080 | vendor-advisory x_refsource_DEBIAN |
| http://php.net/ChangeLog-7.php | x_refsource_CONFIRM |
| https://bugs.php.net/bug.php?id=74651 | x_refsource_CONFIRM |
| Version | Base score | Base severity | Vector |
|---|
| CAPEC ID | Description |
|---|
| Event | Date |
|---|
In PHP before 5.6.31, 7.x before 7.0.21, and 7.1.x before 7.1.7, the openssl extension PEM sealing code did not check the return value of the OpenSSL sealing function, which could lead to a crash of the PHP interpreter, related to an interpretation conflict for a negative number in ext/openssl/openssl.c, and an OpenSSL documentation omission.
| Date Added | Due Date | Vulnerability Name | Required Action |
|---|---|---|---|
| N/A |
| Type | Version | Base score | Base severity | Vector |
|---|---|---|---|---|
| Primary | 3.0 | 7.5 | HIGH | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| Primary | 2.0 | 5.0 | MEDIUM | AV:N/AC:L/Au:N/C:N/I:N/A:P |