CVE-2017-11147

NameCVE-2017-11147
DescriptionIn PHP before 5.6.30 and 7.x before 7.0.15, the PHAR archive handler could be used by attackers supplying malicious archive files to crash the PHP interpreter or potentially disclose information due to a buffer over-read in the phar_parse_pharfile function in ext/phar/phar.c.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
ReferencesDLA-1034-1
NVD severitymedium

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
php5 (PTS)jessie5.6.33+dfsg-0+deb8u1fixed
jessie (security)5.6.40+dfsg-0+deb8u7fixed
php7.0 (PTS)stretch7.0.33-0+deb9u3fixed
stretch (security)7.0.33-0+deb9u6fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
php5source(unstable)(unfixed)
php5sourcejessie5.6.30+dfsg-0+deb8u1
php5sourcewheezy5.4.45-0+deb7u9DLA-1034-1
php7.0source(unstable)7.0.15-1
php7.1source(unstable)7.1.1-1

Notes

PHP Bug: https://bugs.php.net/bug.php?id=73773
Fixed in 7.1.1, 7.0.15, 5.6.30
http://git.php.net/?p=php-src.git;a=commitdiff;h=e5246580a85f031e1a3b8064edbaa55c1643a451
http://openwall.com/lists/oss-security/2017/07/10/6

Search for package or bug name: Reporting problems