1. CVE-Search
  2. CVE-2017-8923
ID CVE-2017-8923
Summary The zend_string_extend function in Zend/zend_string.h in PHP through 7.1.5 does not prevent changes to string objects that result in a negative length, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact by leveraging a script's use of .= with a long string.
References
Vulnerable Configurations
  • cpe:2.3:a:php:php:8.0.0:-:*:*:*:*:*:*
    cpe:2.3:a:php:php:8.0.0:-:*:*:*:*:*:*
  • cpe:2.3:a:php:php:8.0.0:alpha1:*:*:*:*:*:*
    cpe:2.3:a:php:php:8.0.0:alpha1:*:*:*:*:*:*
  • cpe:2.3:a:php:php:8.0.0:alpha2:*:*:*:*:*:*
    cpe:2.3:a:php:php:8.0.0:alpha2:*:*:*:*:*:*
  • cpe:2.3:a:php:php:8.0.0:alpha3:*:*:*:*:*:*
    cpe:2.3:a:php:php:8.0.0:alpha3:*:*:*:*:*:*
  • cpe:2.3:a:php:php:8.0.0:beta1:*:*:*:*:*:*
    cpe:2.3:a:php:php:8.0.0:beta1:*:*:*:*:*:*
  • cpe:2.3:a:php:php:8.0.0:beta2:*:*:*:*:*:*
    cpe:2.3:a:php:php:8.0.0:beta2:*:*:*:*:*:*
  • cpe:2.3:a:php:php:8.0.0:beta3:*:*:*:*:*:*
    cpe:2.3:a:php:php:8.0.0:beta3:*:*:*:*:*:*
  • cpe:2.3:a:php:php:8.0.0:beta4:*:*:*:*:*:*
    cpe:2.3:a:php:php:8.0.0:beta4:*:*:*:*:*:*
  • cpe:2.3:a:php:php:8.0.0:rc1:*:*:*:*:*:*
    cpe:2.3:a:php:php:8.0.0:rc1:*:*:*:*:*:*
  • cpe:2.3:a:php:php:8.0.0:rc2:*:*:*:*:*:*
    cpe:2.3:a:php:php:8.0.0:rc2:*:*:*:*:*:*
  • cpe:2.3:a:php:php:8.0.0:rc3:*:*:*:*:*:*
    cpe:2.3:a:php:php:8.0.0:rc3:*:*:*:*:*:*
  • cpe:2.3:a:php:php:8.0.0:rc4:*:*:*:*:*:*
    cpe:2.3:a:php:php:8.0.0:rc4:*:*:*:*:*:*
  • cpe:2.3:a:php:php:8.0.0:rc5:*:*:*:*:*:*
    cpe:2.3:a:php:php:8.0.0:rc5:*:*:*:*:*:*
  • cpe:2.3:a:php:php:8.0.1:-:*:*:*:*:*:*
    cpe:2.3:a:php:php:8.0.1:-:*:*:*:*:*:*
  • cpe:2.3:a:php:php:8.0.1:rc1:*:*:*:*:*:*
    cpe:2.3:a:php:php:8.0.1:rc1:*:*:*:*:*:*
  • cpe:2.3:a:php:php:8.0.2:-:*:*:*:*:*:*
    cpe:2.3:a:php:php:8.0.2:-:*:*:*:*:*:*
  • cpe:2.3:a:php:php:8.0.2:rc1:*:*:*:*:*:*
    cpe:2.3:a:php:php:8.0.2:rc1:*:*:*:*:*:*
  • cpe:2.3:a:php:php:8.0.3:-:*:*:*:*:*:*
    cpe:2.3:a:php:php:8.0.3:-:*:*:*:*:*:*
  • cpe:2.3:a:php:php:8.0.3:rc1:*:*:*:*:*:*
    cpe:2.3:a:php:php:8.0.3:rc1:*:*:*:*:*:*
  • cpe:2.3:a:php:php:8.0.4:rc1:*:*:*:*:*:*
    cpe:2.3:a:php:php:8.0.4:rc1:*:*:*:*:*:*
  • cpe:2.3:a:php:php:8.0.5:-:*:*:*:*:*:*
    cpe:2.3:a:php:php:8.0.5:-:*:*:*:*:*:*
  • cpe:2.3:a:php:php:8.0.5:rc1:*:*:*:*:*:*
    cpe:2.3:a:php:php:8.0.5:rc1:*:*:*:*:*:*
  • cpe:2.3:a:php:php:8.0.6:*:*:*:*:*:*:*
    cpe:2.3:a:php:php:8.0.6:*:*:*:*:*:*:*
  • cpe:2.3:a:php:php:8.0.7:-:*:*:*:*:*:*
    cpe:2.3:a:php:php:8.0.7:-:*:*:*:*:*:*
  • cpe:2.3:a:php:php:8.0.7:rc1:*:*:*:*:*:*
    cpe:2.3:a:php:php:8.0.7:rc1:*:*:*:*:*:*
  • cpe:2.3:a:php:php:8.0.8:-:*:*:*:*:*:*
    cpe:2.3:a:php:php:8.0.8:-:*:*:*:*:*:*
  • cpe:2.3:a:php:php:8.0.8:rc1:*:*:*:*:*:*
    cpe:2.3:a:php:php:8.0.8:rc1:*:*:*:*:*:*
  • cpe:2.3:a:php:php:8.0.9:-:*:*:*:*:*:*
    cpe:2.3:a:php:php:8.0.9:-:*:*:*:*:*:*
  • cpe:2.3:a:php:php:8.0.9:rc1:*:*:*:*:*:*
    cpe:2.3:a:php:php:8.0.9:rc1:*:*:*:*:*:*
  • cpe:2.3:a:php:php:8.0.10:-:*:*:*:*:*:*
    cpe:2.3:a:php:php:8.0.10:-:*:*:*:*:*:*
  • cpe:2.3:a:php:php:8.0.10:rc1:*:*:*:*:*:*
    cpe:2.3:a:php:php:8.0.10:rc1:*:*:*:*:*:*
  • cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
    cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
CVSS
Base: 7.5 (as of 20-07-2022 - 16:32)
Impact:
Exploitability:
CWE CWE-787
CAPEC
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL PARTIAL
cvss-vector via4 AV:N/AC:L/Au:N/C:P/I:P/A:P
refmap via4
bid 98518
misc https://bugs.php.net/bug.php?id=74577
Last major update 20-07-2022 - 16:32
Published 12-05-2017 - 20:29
Last modified 20-07-2022 - 16:32
Back to Top