CVE-2017-11147: Critical severity php vulnerability
Fixed bug (Seg fault when loading hostile phar). (CVE-2017-11147)
Other sources
In PHP before 5.6.30 and 7.x before 7.0.15, the PHAR archive handler could be used by attackers supplying malicious archive files to crash the PHP interpreter or potentially disclose information due to a buffer over-read in the pharparsepharfile function in ext/phar/phar.c.
Upstream bug:
https://bugs.php.net/bug.php?id=73773
Upstream patch:
http://git.php.net/?p=php-src.git;a=commit;h=e5246580a85f031e1a3b8064edbaa55c1643a451
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2017-11147?
CVE-2017-11147 is a vulnerability in PHP that allows attackers to crash the PHP interpreter or potentially disclose information due to a buffer over-read in the PHAR archive handler.
What is the severity of CVE-2017-11147?
The severity of CVE-2017-11147 is critical (9.1).
Which versions of PHP are affected by CVE-2017-11147?
PHP versions before 5.6.30 and 7.x before 7.0.15 are affected by CVE-2017-11147.
How can I fix CVE-2017-11147?
To fix CVE-2017-11147, upgrade your PHP installation to version 5.6.30 or 7.0.15 or later.
Where can I find more information about CVE-2017-11147?
You can find more information about CVE-2017-11147 at the following references: [1] https://bugs.php.net/bug.php?id=73773, [2] http://git.php.net/?p=php-src.git;a=commit;h=e5246580a85f031e1a3b8064edbaa55c1643a451, [3] https://access.redhat.com/security/cve/CVE-2016-10159.