CVE-2017-9118: High severity PHP PHP vulnerability
Last updated 24 July 2024
Other sources
PHP 7.1.5 has an Out of bounds access in phppcrereplaceimpl via a crafted pregreplace call.
PHP through is vulnerable to an out of bounds access in the phppcre.c:phppcrereplaceimpl() function. An attacker could exploit this by calling pregreplace() with crafted arguments.
Upstream Bug:
https://bugs.php.net/bug.php?id=74604
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2017-9118?
CVE-2017-9118 is a vulnerability in PHP 7.1.5 that allows for an Out of bounds access in php_pcre_replace_impl via a crafted preg_replace call.
What software is affected by CVE-2017-9118?
PHP 7.1.5 and potentially other versions of PHP are affected.
What is the severity of CVE-2017-9118?
CVE-2017-9118 has a severity score of 7.5, which is considered high.
How can I fix CVE-2017-9118?
Update your PHP version to a secure and patched release, such as PHP 7.1.30-1.el7 or a later version.
Where can I find more information about CVE-2017-9118?
You can find more information about CVE-2017-9118 on the PHP bug tracker (https://bugs.php.net/bug.php?id=74604), Red Hat bugzilla (https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1611891), and PHP security wiki (https://wiki.php.net/security).