CVE-2017-11147

In PHP before 5.6.30 and 7.x before 7.0.15, the PHAR archive handler could be used by attackers supplying malicious archive files to crash the PHP interpreter or potentially disclose information due to a buffer over-read in the pharparsepharfile function in ext/phar/phar.c.

References

Affected packages

Git / github.com/php/php-src

Affected ranges

Type: GIT
Repo: https://github.com/php/php-src
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

195427c55481d9913ac9dd3fbcedf2f7c637e6de

Introduced

0221e9f827632942225586687a33cfd554860d5e

Fixed

9abbc3cc6d0f448435ca38bef694f671bf7303d8

Introduced

60fffd296abce5fc071f3c173c25a2696cf683c6

Fixed

cc766d7730bdec064e32f8009154fa672b34ef9b

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-11147.json"

vanir_signatures

[
    {
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/php/php-src/commit/9abbc3cc6d0f448435ca38bef694f671bf7303d8",
        "digest": {
            "function_hash": "291942526429879441159894536430346133521",
            "length": 2665.0
        },
        "id": "CVE-2017-11147-12d1fca6",
        "deprecated": false,
        "target": {
            "file": "ext/gd/libgd/gd_gd2.c",
            "function": "_gd2GetHeader"
        }
    },
    {
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/php/php-src/commit/9abbc3cc6d0f448435ca38bef694f671bf7303d8",
        "digest": {
            "line_hashes": [
                "268808390959611610380382661363715926383",
                "332457077737297600470842301867489262455",
                "183820387990733455444215637150999073887",
                "296117839669516092864788658433251533836"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2017-11147-a887e78f",
        "deprecated": false,
        "target": {
            "file": "ext/gd/libgd/gd_gd2.c"
        }
    }
]