CVE-2017-11628: Buffer Overflow
A stack buffer overflow exists in the latest stable release of PHP-7.1.5 and PHP-5.6.30 in PHP INI parsing API, which may accept network / local filesystem input. On malformed inputs, a stack buffer overflow in zendinidoop() could write 1-byte off a fixed size stack buffer. On installations with the stack smashing mitigation, this would cause an immediate DoS; upto optimization levels, build options and stack buffer overflow mitigations, this vulnerability may allow corrupting other local variables or the frame pointer, potentially allows remotely executing code.
Upstream bug:
https://bugs.php.net/bug.php?id=74603
Upstream patch:
http://git.php.net/?p=php-src.git;a=commit;h=5f8380d33e648964d2d5140f329cf2d4c443033c http://git.php.net/?p=php-src.git;a=commit;h=05255749139b3686c8a6a58ee01131ac0047465e http://git.php.net/?p=php-src.git;a=commit;h=88c521d659521f695e0b9e7fcdded0fc1ee1c53b
Other sources
Fixed bug (PHP INI Parsing Stack Buffer Overflow Vulnerability). (CVE-2017-11628)
— PHP
In PHP before 5.6.31, 7.x before 7.0.21, and 7.1.x before 7.1.7, a stack-based buffer overflow in the zendinidoop() function in Zend/zendiniparser.c could cause a denial of service or potentially allow executing code. NOTE: this is only relevant for PHP applications that accept untrusted input (instead of the system's php.ini file) for the parseinistring or parseinifile function, e.g., a web application for syntax validation of php.ini directives.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2017-11628?
CVE-2017-11628 is a vulnerability in PHP that allows for a stack-based buffer overflow, potentially leading to a denial of service or code execution.
What versions of PHP are affected by CVE-2017-11628?
PHP versions before 5.6.31, 7.x before 7.0.21, and 7.1.x before 7.1.7 are affected by CVE-2017-11628.
What is the severity of CVE-2017-11628?
CVE-2017-11628 has a severity rating of 7.8, which is considered high.
How do I fix CVE-2017-11628?
To fix CVE-2017-11628, you should update PHP to version 7.0.21 or 7.1.7, depending on the version you are using.
Where can I find more information about CVE-2017-11628?
You can find more information about CVE-2017-11628 at the following references: [1] [2] [3].