ByteOS Network

NVD Vulnerability Details :

CVE-2017-11147

Deferred

Source-cve@mitre.org

Published At-10 Jul, 2017 | 14:29

Updated At-20 Apr, 2025 | 01:37

In PHP before 5.6.30 and 7.x before 7.0.15, the PHAR archive handler could be used by attackers supplying malicious archive files to crash the PHP interpreter or potentially disclose information due to a buffer over-read in the phar_parse_pharfile function in ext/phar/phar.c.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	9.1	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Primary	2.0	6.4	MEDIUM	AV:N/AC:L/Au:N/C:P/I:N/A:P

CPE Matches

The PHP Group

>>php>>Versions before 5.6.30(exclusive)

cpe:2.3:a:php:php:*:*:*:*:*:*:*:*

The PHP Group

>>php>>Versions from 7.0.0(inclusive) to 7.0.15(exclusive)

cpe:2.3:a:php:php:*:*:*:*:*:*:*:*

The PHP Group

>>php>>Versions from 7.1.0(inclusive) to 7.1.1(exclusive)

cpe:2.3:a:php:php:*:*:*:*:*:*:*:*

NetApp, Inc.

>>clustered_data_ontap>>-

cpe:2.3:a:netapp:clustered_data_ontap:-:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-125	Primary	nvd@nist.gov

References

Hyperlink	Source	Resource
http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=e5246580a85f031e1a3b8064edbaa55c1643a451	cve@mitre.org	N/A
http://openwall.com/lists/oss-security/2017/07/10/6	cve@mitre.org	Mailing List Patch Third Party Advisory
http://php.net/ChangeLog-5.php	cve@mitre.org	Release Notes Vendor Advisory
http://php.net/ChangeLog-7.php	cve@mitre.org	Release Notes Vendor Advisory
http://www.securityfocus.com/bid/99607	cve@mitre.org	Third Party Advisory VDB Entry
https://access.redhat.com/errata/RHSA-2018:1296	cve@mitre.org	Third Party Advisory
https://bugs.php.net/bug.php?id=73773	cve@mitre.org	Exploit Issue Tracking Vendor Advisory
https://security.netapp.com/advisory/ntap-20180112-0001/	cve@mitre.org	Third Party Advisory
https://www.tenable.com/security/tns-2017-12	cve@mitre.org	Third Party Advisory
http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=e5246580a85f031e1a3b8064edbaa55c1643a451	af854a3a-2127-422b-91ae-364da2661108	N/A
http://openwall.com/lists/oss-security/2017/07/10/6	af854a3a-2127-422b-91ae-364da2661108	Mailing List Patch Third Party Advisory
http://php.net/ChangeLog-5.php	af854a3a-2127-422b-91ae-364da2661108	Release Notes Vendor Advisory
http://php.net/ChangeLog-7.php	af854a3a-2127-422b-91ae-364da2661108	Release Notes Vendor Advisory
http://www.securityfocus.com/bid/99607	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory VDB Entry
https://access.redhat.com/errata/RHSA-2018:1296	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory
https://bugs.php.net/bug.php?id=73773	af854a3a-2127-422b-91ae-364da2661108	Exploit Issue Tracking Vendor Advisory
https://security.netapp.com/advisory/ntap-20180112-0001/	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory
https://www.tenable.com/security/tns-2017-12	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History