Vulnetix
Try Vulnetix Request Demo
CVE-2017-11362 PUBLISHED

In PHP 7.x before 7.0.21 and 7.1.x before 7.1.7, ext/intl/msgformat/msgformat_parse.c does not restrict the locale length, which allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) or possibly have unspecified other impact within International Components for Unicode (ICU) for C/C++ via a long first argument to the msgfmt_parse_message function.

EPSS 2.08% · 83.9th percentile

Risk Scores

EPSS Score
2.08%
83.9th percentile

Affected Products

VendorProductVersions
Ubuntu:16.04:LTSphp7.00, 7.0.1-5, 7.0.1-6
Ubuntu:14.04:LTSphp55.5.9+dfsg-1ubuntu4.17, 5.5.9+dfsg-1ubuntu4.19, 0

Timeline

References

Open in Interactive Console →