CVE-2017-12933: Critical severity PHP PHP vulnerability
Fixed bug (Heap buffer overread (READ: 1) finishnesteddata from unserialize). (CVE-2017-12933)
Other sources
The finishnesteddata function in ext/standard/varunserializer.re in PHP before 5.6.31, 7.0.x before 7.0.21, and 7.1.x before 7.1.7 is prone to a buffer over-read while unserializing untrusted data. Exploitation of this issue can have an unspecified impact on the integrity of PHP.
Upstream bug:
https://bugs.php.net/bug.php?id=74111
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/phpto a version that resolves this vulnerability.Fixed in 7.0.21 - Upgrade
Upgrade
redhat/phpto a version that resolves this vulnerability.Fixed in 7.1.7 - Upgrade
Upgrade
PHPto a version that resolves this vulnerability.Fixed in 7.0.21 - Upgrade
Upgrade
phpto a version that resolves this vulnerability.Fixed in 5.6.31 - Upgrade
Upgrade
phpto a version that resolves this vulnerability.Fixed in 7.0.21 - Upgrade
Upgrade
phpto a version that resolves this vulnerability.Fixed in 7.1.7
Event History
Frequently Asked Questions
What is CVE-2017-12933?
CVE-2017-12933 is a vulnerability in PHP that allows for a heap buffer over-read while unserializing untrusted data.
What is the severity of CVE-2017-12933?
CVE-2017-12933 has a severity rating of 9.8, which is classified as critical.
How does CVE-2017-12933 affect PHP?
CVE-2017-12933 can have an unspecified impact on the integrity of PHP.
Which versions of PHP are affected by CVE-2017-12933?
PHP versions before 5.6.31, 7.0.x before 7.0.21, and 7.1.x before 7.1.7 are affected by CVE-2017-12933.
How can I fix CVE-2017-12933?
To fix CVE-2017-12933, you should update to PHP version 5.6.31, 7.0.21, or 7.1.7 or later.