Critical Vulnerability in PHP Packages: CVE-2017-9118
Summary
UBUNTU-CVE-2017-9118: PHP 7.1.5 has an Out of bounds access in php_pcre_replace_impl via a crafted preg_replace call. Affects php5 versions 5.5.3+dfsg-1ubuntu2 – 5.5.9+dfsg-1ubuntu4.9. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PHP is a widely-used open-source scripting language designed for web development but also used as a general-purpose programming language. It is known for its ease of use, flexibility, and ability to integrate with various databases. The vulnerability CVE-2017-9118 affects multiple versions of PHP packages, specifically those related to PHP 5, 7.0, 7.2, 7.4, and 8.1, which are commonly used in web applications. This vulnerability can lead to severe security risks if not addressed promptly.
Vulnerability Detail
CVE-2017-9118 is an out-of-bounds access vulnerability found in PHP 7.1.5, originating from improper handling of crafted preg_replace calls. This flaw allows attackers to exploit the vulnerability, potentially leading to arbitrary code execution or denial of service. The vulnerability has a CVSS score of 7.5, indicating a high severity level, which can have significant ramifications for applications relying on affected PHP versions.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate patching is not feasible, a temporary workaround involves disabling the use of the preg_replace function in your PHP code until the packages can be updated. This can be done by refactoring the code to avoid using this function or by implementing input validation to prevent malicious data from being processed.
Conclusion
CVE-2017-9118 is a critical vulnerability affecting multiple PHP versions, posing significant risks to applications. It is crucial to update to the patched versions to mitigate these risks. Users are encouraged to monitor their applications for vulnerabilities using tools like Vulert.
See every vulnerability recorded for php5 →
FAQ
CVE-2017-9118 is a vulnerability in PHP that allows for out-of-bounds access, potentially leading to arbitrary code execution.
The vulnerability affects PHP versions 5.5.9, 7.0.33, 7.2.24, 7.4.3, and 8.1.2.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without needing to sign up.
If you cannot update immediately, consider disabling the preg_replace function or implementing input validation as a temporary workaround.
The CVSS score of CVE-2017-9118 is 7.5, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for php5.
