CVE-2017-8923: Critical severity PHP PHP vulnerability
The zendstringextend function in Zend/zendstring.h in PHP through 7.1.5 does not prevent changes to string objects that result in a negative length, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact by leveraging a script's use of .= with a long string.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/php7.0to a version that resolves this vulnerability.Fixed in 7.0.33-0ubuntu0.16.04.16+esm3 - Upgrade
Upgrade
ubuntu/php7.2to a version that resolves this vulnerability.Fixed in 7.2.24-0ubuntu0.18.04.11 - Upgrade
Upgrade
ubuntu/php7.4to a version that resolves this vulnerability.Fixed in 7.4.3-4ubuntu2.10 - Upgrade
Upgrade
redhat/phpto a version that resolves this vulnerability.Fixed in 7.4.24 - Upgrade
Upgrade
redhat/phpto a version that resolves this vulnerability.Fixed in 8.0.11
Event History
Frequently Asked Questions
What is CVE-2017-8923?
CVE-2017-8923 is a vulnerability in PHP through 7.1.5 that allows remote attackers to cause a denial of service or possibly have unspecified other impact.
What is the severity of CVE-2017-8923?
The severity of CVE-2017-8923 is critical with a CVSS score of 9.8.
Which versions of PHP are affected by CVE-2017-8923?
PHP versions up to 7.1.5 are affected by CVE-2017-8923.
How can I fix CVE-2017-8923?
To fix CVE-2017-8923, update PHP to version 7.2.24-0ubuntu0.18.04.11 or higher.
Where can I find more information about CVE-2017-8923?
You can find more information about CVE-2017-8923 at the following references: https://bugs.php.net/bug.php?id=74577, http://www.securityfocus.com/bid/98518, https://launchpad.net/bugs/cve/CVE-2017-8923.