CVE-2017-9120

CRITICAL severity · CVSS 9.8 · Integer overflow

9.8CVSS CRITICAL

Summary

PHP 7.x through 7.1.5 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a long string because of an Integer overflow in mysqli_real_escape_string.

Impact & exploitability

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionNone

Confidentiality impactHigh

Integrity impactHigh

Availability impactHigh

Exploit probability (EPSS)2%

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products we track (1)

PHP

Recommendation

Apply the vendor fix promptly. Open any affected product above for its exact safe version.

Official patch: https://bugs.php.net/bug.php?id=74544 ↗

Additional information

NVD record
https://bugs.php.net/bug.php?id=74544Patch
https://bugs.php.net/bug.php?id=74544Patch
https://access.redhat.com/errata/RHSA-2019:2519Advisory
https://security.netapp.com/advisory/ntap-20181107-0003/Advisory
https://access.redhat.com/errata/RHSA-2019:2519Advisory
https://security.netapp.com/advisory/ntap-20181107-0003/Advisory