CVE-2017-11144: High severity php vulnerability
Fixed bug (negative-size-param (-1) in memcpy in zifopensslseal()). (CVE-2017-11144)
Other sources
In PHP before 5.6.31, 7.x before 7.0.21, and 7.1.x before 7.1.7, the openssl extension PEM sealing code did not check the return value of the OpenSSL sealing function, which could lead to a crash of the PHP interpreter, related to an interpretation conflict for a negative number in ext/openssl/openssl.c, and an OpenSSL documentation omission.
Upstream bug:
https://bugs.php.net/bug.php?id=74651
Upstream patch:
http://git.php.net/?p=php-src.git;a=commit;h=89637c6b41b510c20d262c17483f582f115c66d6
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the vulnerability ID for the fixed bug related to negative-size-param in memcpy?
The vulnerability ID for the fixed bug related to negative-size-param in memcpy is CVE-2017-11144.
What is the severity of CVE-2017-11144?
The severity of CVE-2017-11144 is high with a CVSS score of 7.5.
Which versions of PHP are affected by CVE-2017-11144?
PHP versions before 5.6.31, 7.x before 7.0.21, and 7.1.x before 7.1.7 are affected by CVE-2017-11144.
How can I fix CVE-2017-11144?
To fix CVE-2017-11144, ensure you are using PHP versions 5.6.31, 7.0.21, or 7.1.7 or later.
Where can I find more information about CVE-2017-11144?
You can find more information about CVE-2017-11144 at the following references: [Link 1](https://bugs.php.net/bug.php?id=74651), [Link 2](http://git.php.net/?p=php-src.git;a=commit;h=89637c6b41b510c20d262c17483f582f115c66d6), [Link 3](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1471856).