CVE-2017-8923 in PHP
Summary
The zend_string_extend function in Zend/zend_string.h in PHP through 7.1.5 does not prevent changes to string objects that result in a negative length, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact by leveraging a script's use of .= with a long string.
Reservation
05/12/2017
Disclosure
05/12/2017
Entries
VulDB provides additional information and datapoints for this CVE:
| ID | Vulnerability | CWE | Exp | Cou | CVE |
|---|---|---|---|---|---|
| 101216 | PHP zend_string.h zend_string_extend out-of-bounds write | 787 | Not defined | Official fix | CVE-2017-8923 |