Bug 1475522 (CVE-2017-11628) - CVE-2017-11628 php: Stack based 1-byte buffer over-write in zend_ini_do_op() function Zend/zend_ini_parser.c
Summary: CVE-2017-11628 php: Stack based 1-byte buffer over-write in zend_ini_do_op() ...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2017-11628
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1475523 1554537
Blocks:
TreeView+ depends on / blocked
 
Reported: 2017-07-26 20:20 UTC by Pedro Sampaio
Modified: 2019-09-29 14:17 UTC (History)
7 users (show)

Fixed In Version: php 7.0.21, php 7.1.7
Clone Of:
Environment:
Last Closed: 2019-06-08 03:18:52 UTC
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2018:1296 0 None None None 2018-05-03 05:08:12 UTC

Description Pedro Sampaio 2017-07-26 20:20:36 UTC
A stack buffer overflow exists in the latest stable release of PHP-7.1.5 and PHP-5.6.30 in PHP INI parsing API, which may accept network / local filesystem input. On malformed inputs, a stack buffer overflow in zend_ini_do_op() could write 1-byte off a fixed size stack buffer. On installations with the stack smashing mitigation, this would cause an immediate DoS; upto optimization levels, build options and stack buffer overflow mitigations, this vulnerability may allow corrupting other local variables or the frame pointer, potentially allows remotely executing code.

Upstream bug:

https://bugs.php.net/bug.php?id=74603

Upstream patch:

http://git.php.net/?p=php-src.git;a=commit;h=5f8380d33e648964d2d5140f329cf2d4c443033c
http://git.php.net/?p=php-src.git;a=commit;h=05255749139b3686c8a6a58ee01131ac0047465e
http://git.php.net/?p=php-src.git;a=commit;h=88c521d659521f695e0b9e7fcdded0fc1ee1c53b

Comment 1 Pedro Sampaio 2017-07-26 20:21:01 UTC
Created php tracking bugs for this issue:

Affects: fedora-all [bug 1475523]

Comment 3 errata-xmlrpc 2018-05-03 05:08:05 UTC
This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 6
  Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7
  Red Hat Software Collections for Red Hat Enterprise Linux 7.3 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS

Via RHSA-2018:1296 https://access.redhat.com/errata/RHSA-2018:1296


Note You need to log in before you can comment on or make changes to this bug.