CVE-2017-11147

NameCVE-2017-11147
DescriptionIn PHP before 5.6.30 and 7.x before 7.0.15, the PHAR archive handler could be used by attackers supplying malicious archive files to crash the PHP interpreter or potentially disclose information due to a buffer over-read in the phar_parse_pharfile function in ext/phar/phar.c.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-1034-1

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
php5sourcewheezy5.4.45-0+deb7u9DLA-1034-1
php5sourcejessie5.6.30+dfsg-0+deb8u1
php5source(unstable)(unfixed)
php7.0source(unstable)7.0.15-1
php7.1source(unstable)7.1.1-1

Notes

PHP Bug: https://bugs.php.net/bug.php?id=73773
Fixed in 7.1.1, 7.0.15, 5.6.30
https://git.php.net/?p=php-src.git;a=commitdiff;h=e5246580a85f031e1a3b8064edbaa55c1643a451
http://openwall.com/lists/oss-security/2017/07/10/6

Search for package or bug name: Reporting problems