CVE-2017-9120: Integer Overflow
Last updated 24 July 2024
Other sources
PHP 7.x through 7.1.5 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a long string because of an Integer overflow in mysqlirealescapestring.
PHP is vulnerable to an integer overflow in the mysqliapi.c:mysqlirealescapestring() function. An attacker could exploit this by performing a crafted query to cause a crash.
Upstream Bug:
https://bugs.php.net/bug.php?id=74544
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/rh-php71-phpto a version that resolves this vulnerability.Fixed in 0:7.1.30-1.el7 - Upgrade
Upgrade
ubuntu/php7.0to a version that resolves this vulnerability.Fixed in 7.0.33-0ubuntu0.16.04.16+esm3 - Upgrade
Upgrade
ubuntu/php7.2to a version that resolves this vulnerability.Fixed in 7.2.24-0ubuntu0.18.04.11 - Upgrade
Upgrade
ubuntu/php7.4to a version that resolves this vulnerability.Fixed in 7.4.3-4ubuntu2.10
Event History
Frequently Asked Questions
What is CVE-2017-9120?
CVE-2017-9120 is a vulnerability in PHP 7.x through 7.1.5 that allows remote attackers to cause a denial of service or possibly have unspecified other impact via a long string.
What is the severity of CVE-2017-9120?
The severity of CVE-2017-9120 is critical with a severity score of 9.8.
Which software versions are affected by CVE-2017-9120?
PHP versions 7.x through 7.1.5 are affected by CVE-2017-9120.
How can I fix CVE-2017-9120?
To fix CVE-2017-9120, update PHP to a version higher than 7.1.5.
Where can I find more information about CVE-2017-9120?
You can find more information about CVE-2017-9120 at the following references: [link1](https://bugs.php.net/bug.php?id=74544), [link2](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1614880), [link3](https://bugs.php.net/patch-display.php?bug_id=74544&patch=bug74544.diff&revision=1500891082&download=1)