Out-of-bounds read In php5
Description
In PHP through 5.6.33, 7.0.x before 7.0.28, 7.1.x through 7.1.14, and 7.2.x through 7.2.2, there is a stack-based buffer under-read while parsing an HTTP response in the php_stream_url_wrap_http_ex function in ext/standard/http_fopen_wrapper.c. This subsequently results in copying a large string.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Component | Affected version | Patched versions |
|---|---|---|---|
 alpine v3.4 | =5.2.10-r0 || =5.2.10-r2 || =5.2.10-r3 || =5.2.10-r4 || =5.2.11-r0 || =5.2.8-r0 || =5.2.8-r1 || =5.2.9-r0 || =5.3.0-r0 || =5.3.0-r1 || =5.3.0-r2 || =5.3.0-r3 || =5.3.1-r0 || =5.3.1-r1 || =5.3.1-r2 || =5.3.1-r3 || =5.3.1-r4 || =5.3.1-r5 || =5.3.10-r0 || =5.3.10-r1 || =5.3.10-r2 || =5.3.10-r3 || =5.3.10-r4 || =5.3.10-r5 || =5.3.12-r0 || =5.3.12-r1 || =5.3.12-r2 || =5.3.12-r3 || =5.3.15-r3 || =5.3.16-r0 || =5.3.17-r0 || =5.3.18-r0 || =5.3.19-r0 || =5.3.2-r0 || =5.3.2-r1 || =5.3.2-r2 || =5.3.2-r3 || =5.3.2-r4 || =5.3.2-r5 || =5.3.2-r6 || =5.3.2-r7 || =5.3.2-r8 || =5.3.20-r0 || =5.3.20-r1 || =5.3.21-r1 || =5.3.21-r2 || =5.3.23-r0 || =5.3.23-r1 || =5.3.3-r0 || =5.3.3-r1 || =5.3.3-r2 || =5.3.3-r3 || =5.3.3-r4 || =5.3.3-r5 || =5.3.4-r0 || =5.3.4-r1 || =5.3.4-r2 || =5.3.5-r0 || =5.3.5-r1 || =5.3.5-r2 || =5.3.5-r3 || =5.3.5-r4 || =5.3.5-r5 || =5.3.5-r6 || =5.3.5-r7 || =5.3.6-r0 || =5.3.6-r1 || =5.3.6-r10 || =5.3.6-r11 || =5.3.6-r2 || =5.3.6-r3 || =5.3.6-r4 || =5.3.6-r5 || =5.3.6-r6 || =5.3.6-r7 || =5.3.6-r8 || =5.3.6-r9 || =5.3.7-r0 || =5.3.7-r1 || =5.3.8-r0 || =5.3.8-r1 || =5.3.8-r2 || =5.3.9-r0 || =5.3.9-r1 || =5.4.14-r0 || =5.4.14-r1 || =5.4.14-r2 || =5.4.14-r3 || =5.4.15-r0 || =5.4.15-r1 || =5.4.16-r0 || =5.4.17-r0 || =5.4.17-r1 || =5.4.19-r0 || =5.4.20-r0 || =5.5.10-r0 || =5.5.11-r0 || =5.5.11-r1 || =5.5.12-r0 || =5.5.13-r0 || =5.5.13-r1 || =5.5.13-r2 || =5.5.13-r3 || =5.5.13-r4 || =5.5.14-r0 || =5.5.15-r0 || =5.5.15-r1 || =5.5.16-r0 || =5.5.4-r0 || =5.5.4-r1 || =5.5.5-r0 || =5.5.5-r1 || =5.5.5-r2 || =5.5.6-r0 || =5.5.6-r1 || =5.5.7-r0 || =5.5.8-r0 || =5.5.8-r1 || =5.5.9-r0 || =5.6.1-r0 || =5.6.1-r1 || =5.6.1-r2 || =5.6.10-r0 || =5.6.11-r0 || =5.6.12-r0 || =5.6.13-r0 || =5.6.14-r0 || =5.6.15-r0 || =5.6.15-r1 || =5.6.15-r2 || =5.6.15-r3 || =5.6.16-r0 || =5.6.17-r0 || =5.6.18-r0 || =5.6.18-r1 || =5.6.19-r0 || =5.6.19-r1 || =5.6.2-r0 || =5.6.2-r1 || =5.6.20-r0 || =5.6.21-r0 || =5.6.21-r1 || =5.6.21-r2 || =5.6.23-r0 || =5.6.24-r0 || =5.6.25-r0 || =5.6.26-r0 || =5.6.27-r0 || =5.6.28-r0 || =5.6.29-r0 || =5.6.3-r0 || =5.6.30-r0 || =5.6.31-r0 || =5.6.33-r0 || =5.6.4-r0 || =5.6.5-r0 || =5.6.5-r1 || =5.6.6-r0 || =5.6.7-r0 || =5.6.7-r1 || =5.6.8-r0 || =5.6.8-r1 || =5.6.9-r0 || =5.6.9-r1 || >=0 <5.6.34-r0 | 5.6.34-r0 | |
alpine v3.5 | =5.2.10-r0 || =5.2.10-r2 || =5.2.10-r3 || =5.2.10-r4 || =5.2.11-r0 || =5.2.8-r0 || =5.2.8-r1 || =5.2.9-r0 || =5.3.0-r0 || =5.3.0-r1 || =5.3.0-r2 || =5.3.0-r3 || =5.3.1-r0 || =5.3.1-r1 || =5.3.1-r2 || =5.3.1-r3 || =5.3.1-r4 || =5.3.1-r5 || =5.3.10-r0 || =5.3.10-r1 || =5.3.10-r2 || =5.3.10-r3 || =5.3.10-r4 || =5.3.10-r5 || =5.3.12-r0 || =5.3.12-r1 || =5.3.12-r2 || =5.3.12-r3 || =5.3.15-r3 || =5.3.16-r0 || =5.3.17-r0 || =5.3.18-r0 || =5.3.19-r0 || =5.3.2-r0 || =5.3.2-r1 || =5.3.2-r2 || =5.3.2-r3 || =5.3.2-r4 || =5.3.2-r5 || =5.3.2-r6 || =5.3.2-r7 || =5.3.2-r8 || =5.3.20-r0 || =5.3.20-r1 || =5.3.21-r1 || =5.3.21-r2 || =5.3.23-r0 || =5.3.23-r1 || =5.3.3-r0 || =5.3.3-r1 || =5.3.3-r2 || =5.3.3-r3 || =5.3.3-r4 || =5.3.3-r5 || =5.3.4-r0 || =5.3.4-r1 || =5.3.4-r2 || =5.3.5-r0 || =5.3.5-r1 || =5.3.5-r2 || =5.3.5-r3 || =5.3.5-r4 || =5.3.5-r5 || =5.3.5-r6 || =5.3.5-r7 || =5.3.6-r0 || =5.3.6-r1 || =5.3.6-r10 || =5.3.6-r11 || =5.3.6-r2 || =5.3.6-r3 || =5.3.6-r4 || =5.3.6-r5 || =5.3.6-r6 || =5.3.6-r7 || =5.3.6-r8 || =5.3.6-r9 || =5.3.7-r0 || =5.3.7-r1 || =5.3.8-r0 || =5.3.8-r1 || =5.3.8-r2 || =5.3.9-r0 || =5.3.9-r1 || =5.4.14-r0 || =5.4.14-r1 || =5.4.14-r2 || =5.4.14-r3 || =5.4.15-r0 || =5.4.15-r1 || =5.4.16-r0 || =5.4.17-r0 || =5.4.17-r1 || =5.4.19-r0 || =5.4.20-r0 || =5.5.10-r0 || =5.5.11-r0 || =5.5.11-r1 || =5.5.12-r0 || =5.5.13-r0 || =5.5.13-r1 || =5.5.13-r2 || =5.5.13-r3 || =5.5.13-r4 || =5.5.14-r0 || =5.5.15-r0 || =5.5.15-r1 || =5.5.16-r0 || =5.5.4-r0 || =5.5.4-r1 || =5.5.5-r0 || =5.5.5-r1 || =5.5.5-r2 || =5.5.6-r0 || =5.5.6-r1 || =5.5.7-r0 || =5.5.8-r0 || =5.5.8-r1 || =5.5.9-r0 || =5.6.1-r0 || =5.6.1-r1 || =5.6.1-r2 || =5.6.10-r0 || =5.6.11-r0 || =5.6.12-r0 || =5.6.13-r0 || =5.6.14-r0 || =5.6.15-r0 || =5.6.15-r1 || =5.6.15-r2 || =5.6.15-r3 || =5.6.16-r0 || =5.6.17-r0 || =5.6.18-r0 || =5.6.18-r1 || =5.6.19-r0 || =5.6.19-r1 || =5.6.2-r0 || =5.6.2-r1 || =5.6.20-r0 || =5.6.21-r0 || =5.6.21-r1 || =5.6.21-r2 || =5.6.22-r0 || =5.6.23-r0 || =5.6.24-r0 || =5.6.25-r0 || =5.6.25-r1 || =5.6.26-r0 || =5.6.26-r1 || =5.6.27-r0 || =5.6.28-r0 || =5.6.29-r0 || =5.6.29-r1 || =5.6.3-r0 || =5.6.30-r0 || =5.6.31-r0 || =5.6.32-r0 || =5.6.33-r0 || =5.6.4-r0 || =5.6.5-r0 || =5.6.5-r1 || =5.6.6-r0 || =5.6.7-r0 || =5.6.7-r1 || =5.6.8-r0 || =5.6.8-r1 || =5.6.9-r0 || =5.6.9-r1 || >=0 <5.6.34-r0 | 5.6.34-r0 | |
 rpm rhel5 | - | - | |
rpm rhel6 | - | - | |
rpm rhel7 | <0:5.4.16-48.el7 | 0:5.4.16-48.el7 | |
rpm rhel5 | - | - | |
 packagist | >=0 <=5.6.33 || >=7.0.0 <7.0.28 || >=7.1.0 <=7.1.14 || >=7.2.0 <=7.2.2 | 7.0.28 |
Aliases
Does your application use this vulnerable software?
During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.