Critical Denial of Service Vulnerability in PHP Packages
Summary
UBUNTU-CVE-2017-9119: The i_zval_ptr_dtor function in Zend/zend_variables.h in PHP 7.1.5 allows attackers to cause a denial of service (memory consumption and application crash) or possibly have unspecified other impact by triggering crafted... Affects php5 versions 5.5.3+dfsg-1ubuntu2 – 5.5.9+dfsg-1ubuntu4.9. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PHP is a widely-used open-source scripting language designed for web development but also used as a general-purpose programming language. It powers a significant portion of the web, providing dynamic content and server-side scripting capabilities. The affected packages include various PHP modules and libraries, specifically versions 5.5.9, 7.0.33, 7.2.24, and 7.4.3. These packages are integral for running PHP applications and handling web requests efficiently. The vulnerability in question exposes these packages to potential denial of service attacks, which can severely disrupt service availability.
Vulnerability Detail
The vulnerability, identified as CVE-2017-9119, originates from the i_zval_ptr_dtor function in Zend/zend_variables.h in PHP 7.1.5. It allows attackers to exploit crafted operations on array data structures, leading to memory consumption and application crashes. The ramifications of this vulnerability are significant, as it can result in service downtime, degraded performance, and potential data loss. The CVSS score for this vulnerability is 9.8, indicating a critical severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate patching is not feasible, consider disabling the affected PHP modules temporarily to mitigate the risk of exploitation until the packages can be updated.
Conclusion
In summary, CVE-2017-9119 is a critical vulnerability affecting various PHP packages, which can lead to denial of service attacks. It is crucial to update the affected packages to their patched versions to mitigate risks. Users can also utilize Vulert for ongoing vulnerability monitoring.
See every vulnerability recorded for php5 →
FAQ
CVE-2017-9119 is a critical vulnerability in PHP that allows attackers to cause denial of service through crafted operations on array data structures.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The consequences include potential service downtime, application crashes, and degraded performance due to excessive memory consumption.
The best protection is to update your PHP packages to the latest patched versions as soon as possible.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities using just a manifest file like package-lock.json.
Related vulnerabilities
Recent vulnerabilities recorded for php5.
