CVE-2017-12934

php: heap use after free in ext/standard/var_unserializer.re

Severity Score

7.5

*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

ext/standard/var_unserializer.re in PHP 7.0.x before 7.0.21 and 7.1.x before 7.1.7 is prone to a heap use after free while unserializing untrusted data, related to the zval_get_type function in Zend/zend_types.h. Exploitation of this issue can have an unspecified impact on the integrity of PHP.

ext/standard/var_unserializer.re en PHP en versiones 7.0.x anteriores a la 7.0.21 y versiones 7.1.x anteriores a la 7.1.7 es propenso a un uso de memoria dinámica antes de liberación (heap use after free) al deserializar datos que no son de confianza. Esto está relacionado con la función zval_get_type en Zend/zend_types.h. La explotación de este problema puede tener un impacto sin especificar en la integridad de PHP.

*Credits: N/A

CVSS Scores

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Attack Vector

Network

Attack Complexity

Low

Authentication

None

Confidentiality

None

Integrity

Partial

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2017-08-17 CVE Reserved
2017-08-18 CVE Published
2023-05-08 EPSS Updated
2024-08-05 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-416: Use After Free

CAPEC

References (7)

URL	Tag	Source
http://www.securityfocus.com/bid/100428	Third Party Advisory
https://bugs.php.net/bug.php?id=74101	Issue Tracking

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
http://php.net/ChangeLog-7.php	2018-05-04
https://access.redhat.com/errata/RHSA-2018:1296	2018-05-04
https://www.debian.org/security/2018/dsa-4080	2018-05-04
https://access.redhat.com/security/cve/CVE-2017-12934	2018-05-03
https://bugzilla.redhat.com/show_bug.cgi?id=1484839	2018-05-03

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Php Search vendor "Php"		Php Search vendor "Php" for product "Php"				7.0.0 Search vendor "Php" for product "Php" and version "7.0.0"		-		Affected
Php Search vendor "Php"		Php Search vendor "Php" for product "Php"				7.0.1 Search vendor "Php" for product "Php" and version "7.0.1"		-		Affected
Php Search vendor "Php"		Php Search vendor "Php" for product "Php"				7.0.2 Search vendor "Php" for product "Php" and version "7.0.2"		-		Affected
Php Search vendor "Php"		Php Search vendor "Php" for product "Php"				7.0.3 Search vendor "Php" for product "Php" and version "7.0.3"		-		Affected
Php Search vendor "Php"		Php Search vendor "Php" for product "Php"				7.0.4 Search vendor "Php" for product "Php" and version "7.0.4"		-		Affected
Php Search vendor "Php"		Php Search vendor "Php" for product "Php"				7.0.5 Search vendor "Php" for product "Php" and version "7.0.5"		-		Affected
Php Search vendor "Php"		Php Search vendor "Php" for product "Php"				7.0.6 Search vendor "Php" for product "Php" and version "7.0.6"		-		Affected
Php Search vendor "Php"		Php Search vendor "Php" for product "Php"				7.0.7 Search vendor "Php" for product "Php" and version "7.0.7"		-		Affected
Php Search vendor "Php"		Php Search vendor "Php" for product "Php"				7.0.8 Search vendor "Php" for product "Php" and version "7.0.8"		-		Affected
Php Search vendor "Php"		Php Search vendor "Php" for product "Php"				7.0.9 Search vendor "Php" for product "Php" and version "7.0.9"		-		Affected
Php Search vendor "Php"		Php Search vendor "Php" for product "Php"				7.0.10 Search vendor "Php" for product "Php" and version "7.0.10"		-		Affected
Php Search vendor "Php"		Php Search vendor "Php" for product "Php"				7.0.11 Search vendor "Php" for product "Php" and version "7.0.11"		-		Affected
Php Search vendor "Php"		Php Search vendor "Php" for product "Php"				7.0.12 Search vendor "Php" for product "Php" and version "7.0.12"		-		Affected
Php Search vendor "Php"		Php Search vendor "Php" for product "Php"				7.0.13 Search vendor "Php" for product "Php" and version "7.0.13"		-		Affected
Php Search vendor "Php"		Php Search vendor "Php" for product "Php"				7.0.14 Search vendor "Php" for product "Php" and version "7.0.14"		-		Affected
Php Search vendor "Php"		Php Search vendor "Php" for product "Php"				7.0.15 Search vendor "Php" for product "Php" and version "7.0.15"		-		Affected
Php Search vendor "Php"		Php Search vendor "Php" for product "Php"				7.0.16 Search vendor "Php" for product "Php" and version "7.0.16"		-		Affected
Php Search vendor "Php"		Php Search vendor "Php" for product "Php"				7.0.17 Search vendor "Php" for product "Php" and version "7.0.17"		-		Affected
Php Search vendor "Php"		Php Search vendor "Php" for product "Php"				7.0.18 Search vendor "Php" for product "Php" and version "7.0.18"		-		Affected
Php Search vendor "Php"		Php Search vendor "Php" for product "Php"				7.0.19 Search vendor "Php" for product "Php" and version "7.0.19"		-		Affected
Php Search vendor "Php"		Php Search vendor "Php" for product "Php"				7.0.20 Search vendor "Php" for product "Php" and version "7.0.20"		-		Affected
Php Search vendor "Php"		Php Search vendor "Php" for product "Php"				7.1.0 Search vendor "Php" for product "Php" and version "7.1.0"		-		Affected
Php Search vendor "Php"		Php Search vendor "Php" for product "Php"				7.1.1 Search vendor "Php" for product "Php" and version "7.1.1"		-		Affected
Php Search vendor "Php"		Php Search vendor "Php" for product "Php"				7.1.2 Search vendor "Php" for product "Php" and version "7.1.2"		-		Affected
Php Search vendor "Php"		Php Search vendor "Php" for product "Php"				7.1.3 Search vendor "Php" for product "Php" and version "7.1.3"		-		Affected
Php Search vendor "Php"		Php Search vendor "Php" for product "Php"				7.1.4 Search vendor "Php" for product "Php" and version "7.1.4"		-		Affected
Php Search vendor "Php"		Php Search vendor "Php" for product "Php"				7.1.5 Search vendor "Php" for product "Php" and version "7.1.5"		-		Affected
Php Search vendor "Php"		Php Search vendor "Php" for product "Php"				7.1.6 Search vendor "Php" for product "Php" and version "7.1.6"		-		Affected