Critical Buffer Overflow Vulnerability in PHP Packages: CVE-2017-9120
Summary
UBUNTU-CVE-2017-9120: PHP 7.x through 7.1.5 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a long string because of an Integer overflow in mysqli_real... Affects php5 versions 5.5.3+dfsg-1ubuntu2 – 5.5.9+dfsg-1ubuntu4.9. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PHP is a widely-used open-source scripting language designed for web development but also used as a general-purpose programming language. It is known for its ease of use, flexibility, and strong community support. The affected packages include various versions of PHP (5, 7.0, 7.2, and 7.4) that are integral to running web applications. This vulnerability allows attackers to exploit a buffer overflow, potentially leading to denial of service or other impacts.
Vulnerability Detail
The vulnerability, identified as CVE-2017-9120, originates from an integer overflow in the mysqli_real_escape_string function in PHP versions 7.x through 7.1.5. This flaw allows remote attackers to send specially crafted long strings that can cause a buffer overflow, leading to application crashes or other unspecified impacts. The severity of this vulnerability is rated high, with a CVSS score of 9.8, indicating a critical risk to systems using the affected PHP versions.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate patching is not possible, consider disabling the affected PHP modules temporarily or restricting access to the web application until the vulnerability can be addressed. Additionally, implement web application firewalls to help mitigate potential attacks.
Conclusion
CVE-2017-9120 represents a significant risk to PHP applications, allowing for potential denial of service attacks through buffer overflow. It is crucial for users to update their PHP installations to the latest patched versions to mitigate this vulnerability effectively.
See every vulnerability recorded for php5 →
FAQ
CVE-2017-9120 is a critical vulnerability in PHP that allows remote attackers to exploit a buffer overflow, potentially leading to application crashes or other impacts.
The vulnerability affects PHP versions 7.x through 7.1.5, as well as various packages in PHP 5, 7.2, and 7.4.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If you cannot update immediately, consider disabling the affected PHP modules or restricting access to your web application until the vulnerability is addressed.
The CVSS score for CVE-2017-9120 is 9.8, indicating a critical risk level.
Related vulnerabilities
Recent vulnerabilities recorded for php5.
