CVE-2017-9119

Name	CVE-2017-9119
Description	The i_zval_ptr_dtor function in Zend/zend_variables.h in PHP 7.1.5 allows attackers to cause a denial of service (memory consumption and application crash) or possibly have unspecified other impact by triggering crafted operations on array data structures.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severity	high (attack range: remote)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
php5 (PTS)	jessie	5.6.30+dfsg-0+deb8u1	vulnerable
	jessie (security)	5.6.33+dfsg-0+deb8u1	vulnerable
php7.0 (PTS)	stretch (security), stretch	7.0.27-0+deb9u1	vulnerable
	sid	7.0.29-1	vulnerable
php7.1 (PTS)	buster, sid	7.1.16-1	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency
php5	source	(unstable)	(unfixed)	unimportant
php7.0	source	(unstable)	(unfixed)	unimportant
php7.1	source	(unstable)	(unfixed)	unimportant

PHP Bug: https://bugs.php.net/bug.php?id=74593
Only triggerable by malicious script