CVE-2017-11145

Publication date 10 July 2017

Last updated 24 July 2024

Ubuntu priority

Cvss 3 Severity Score

In PHP before 5.6.31, 7.x before 7.0.21, and 7.1.x before 7.1.7, an error in the date extension's timelib_meridian parsing code could be used by attackers able to supply date strings to leak information from the interpreter, related to ext/date/lib/parse_date.c out-of-bounds reads affecting the php_parse_date function. NOTE: the correct fix is in the e8b7698f5ee757ce2c8bd10a192a491a498f891c commit, not the bd77ac90d3bdf31ce2a5251ad92e9e75 gist.

Status

Show unmaintained releases

Package	Ubuntu Release	Status
php5	17.10 artful	Not in release
	17.04 zesty	Not in release
	16.10 yakkety	Not in release
	16.04 LTS xenial	Not in release
	14.04 LTS trusty	Fixed 5.5.9+dfsg-1ubuntu4.22
php7.0	17.10 artful	Not in release
	17.04 zesty	Fixed 7.0.22-0ubuntu0.17.04.1
	16.10 yakkety	Ignored
	16.04 LTS xenial	Fixed 7.0.22-0ubuntu0.16.04.1
	14.04 LTS trusty	Not in release
php7.1	17.10 artful	Fixed 7.1.8-1ubuntu1
	17.04 zesty	Not in release
	16.10 yakkety	Not in release
	16.04 LTS xenial	Not in release
	14.04 LTS trusty	Not in release

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
php5	Upstream: http://git.php.net/?p=php-src.git;a=commit;h=e8b7698f5ee757ce2c8bd10a192a491a498f891c
php7.0	Upstream: e8b7698 Upstream: 0496f54
php7.1	Upstream: e8b7698 Upstream: 0496f54 Upstream: 0ba04f7

Severity score breakdown

Parameter	Value
Base score	7.5 · High
Attack vector	Network
Attack complexity	Low
Privileges required	None
User interaction	None
Scope	Unchanged
Confidentiality	High
Integrity impact	None
Availability impact	None
Vector	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CVE-2017-11145

Cvss 3 Severity Score

Status

Patch details

Severity score breakdown

References

Related Ubuntu Security Notices (USN)

Other references