**PHP version 7.1.7** (06 Jul 2017)

**Core:**

  - Fixed bug php#74738 (Multiple [PATH=] and [HOST=]     sections not properly parsed). (Manuel Mausz)

  - Fixed bug php#74658 (Undefined constants in array     properties result in broken properties). (Laruence)

  - Fixed misparsing of abstract unix domain socket names.
    (Sara)

  - Fixed bug php#74603 (PHP INI Parsing Stack Buffer     Overflow Vulnerability). (Stas)

  - Fixed bug php#74101, bug php#74614 (Unserialize Heap     Use-After-Free (READ: 1) in zval_get_type). (Nikita)

  - Fixed bug php#74111 (Heap buffer overread (READ: 1)     finish_nested_data from unserialize). (Nikita)

  - Fixed bug php#74819 (wddx_deserialize() heap     out-of-bound read via php_parse_date()). (Derick)

**Date:**

  - Fixed bug php#74639 (implement clone for DatePeriod and     DateInterval). (andrewnester)

**DOM:**

  - Fixed bug php#69373 (References to deleted XPath query     results). (ttoohey)

**Intl:**

  - Fixed bug php#73473 (Stack Buffer Overflow in     msgfmt_parse_message). (libnex)

  - Fixed bug php#74705 (Wrong reflection on     Collator::getSortKey and collator_get_sort_key). (Tyson     Andre, Remi)

**Mbstring:**

  - Add oniguruma upstream fix (CVE-2017-9224,     CVE-2017-9226, CVE-2017-9227, CVE-2017-9228,     CVE-2017-9229) (Remi, Mamoru TASAKA)

**Opcache:**

  - Fixed bug php#74663 (Segfault with     opcache.memory_protect and validate_timestamp).
    (Laruence)

  - Revert opcache.enable_cli to default disabled. (Nikita)

**OpenSSL:**

  - Fixed bug php#74720 (pkcs7_en/decrypt does not work if     \x1a is used in content). (Anatol)

  - Fixed bug php#74651 (negative-size-param (-1) in memcpy     in zif_openssl_seal()). (Stas)

**Reflection:**

  - Fixed bug php#74673 (Segfault when cast Reflection     object to string with undefined constant). (Laruence)

**SPL:**

  - Fixed bug php#74478 (null coalescing operator failing     with SplFixedArray). (jhdxr)

**FTP:**

  - Fixed bug php#74598 (ftp:// wrapper ignores context     arg). (Sara)

**PHAR:**

  - Fixed bug php#74386 (Phar::__construct reflection     incorrect). (villfa)

**SOAP**

  - Fixed bug php#74679 (Incorrect conversion array with     WSDL_CACHE_MEMORY). (Dmitry)

**Streams:**

  - Fixed bug php#74556 (stream_socket_get_name() returns     '\0'). (Sara)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

the PHP project reports :

- A stack out-of-bounds read occurs in match_at() during regular expression searching. A logical error involving order of validation and access in match_at() could result in an out-of-bounds read from a stack buffer (CVE-2017-9224).

- A heap out-of-bounds write or read occurs in next_state_val() during regular expression compilation. Octal numbers larger than 0xff are not handled correctly in fetch_token() and fetch_token_in_cc(). A malformed regular expression containing an octal number in the form of '\700' would produce an invalid code point value larger than 0xff in next_state_val(), resulting in an out-of-bounds write memory corruption (CVE-2017-9226).

- A stack out-of-bounds read occurs in mbc_enc_len() during regular expression searching. Invalid handling of reg->dmin in forward_search_range() could result in an invalid pointer dereference, as an out-of-bounds read from a stack buffer (CVE-2017-9227).

- A heap out-of-bounds write occurs in bitset_set_range() during regular expression compilation due to an uninitialized variable from an incorrect state transition. An incorrect state transition in parse_char_class() could create an execution path that leaves a critical local variable uninitialized until it's used as an index, resulting in an out-of-bounds write memory corruption (CVE-2017-9228).

- A SIGSEGV occurs in left_adjust_char_head() during regular expression compilation. Invalid handling of reg->dmax in forward_search_range() could result in an invalid pointer dereference, normally as an immediate denial-of-service condition (CVE-2017-9228).

This update for php7 fixes the following security issues :

  - CVE-2017-9224: stack out-of-bounds read occurs in     match_at() could lead to Denial of service (bsc#1040891)

  - CVE-2017-9226: heap out-of-bounds write orread occurs in     next_state_val() could lead to Denial of     service(bsc#1040889)

  - CVE-2017-9227: stack out-of-bounds read in mbc_enc_len()     could lead to Denial of service (bsc#1040883)

  - CVE-2017-6441: The _zval_get_long_func_ex in     Zend/zend_operators.c in PHP allowed attackers to cause     a denial of service (NULL pointer dereference and     application crash) via crafted use of 'declare(ticks='     in a PHP script (bsc#1032155).

  - CVE-2016-6294: The locale_accept_from_http function in     ext/intl/locale/locale_methods.c did not properly     restrict calls to the ICU uloc_acceptLanguageFromHTTP     function, which allowed remote attackers to cause a     denial of service (out-of-bounds read) or possibly have     unspecified other impact via a call with a long argument     (bsc#1035111).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its banner, the version of PHP running on the remote web server is 7.0.x prior to 7.0.21. It is, therefore, affected by the following vulnerabilities :

  - An out-of-bounds read error exists in the PCRE library     in the compile_bracket_matchingpath() function within     file pcre_jit_compile.c. An unauthenticated, remote     attacker can exploit this, via a specially crafted     regular expression, to crash a process linked to the     library, resulting in a denial of service condition.
    (CVE-2017-6004)

  - An out-of-bounds read error exists in the GD Graphics     Library (LibGD) in the gdImageCreateFromGifCtx()     function within file gd_gif_in.c when handling a     specially crafted GIF file. An unauthenticated, remote     attacker can exploit this to disclose sensitive memory     contents or crash a process linked to the library.
    (CVE-2017-7890)

  - An out-of-bounds read error exists in Oniguruma in the     match_at() function within file regexec.c. An     unauthenticated, remote attacker can exploit this to     disclose sensitive memory contents or crash a process     linked to the library. (CVE-2017-9224)

  - An out-of-bounds write error exists in Oniguruma in the     next_state_val() function during regular expression     compilation. An unauthenticated, remote attacker can     exploit this to execute arbitrary code. (CVE-2017-9226)

  - An out-of-bounds read error exists in Oniguruma in the     mbc_enc_len() function within file utf8.c. An     unauthenticated, remote attacker can exploit this to     disclose memory contents or crash a process linked to     the library. (CVE-2017-9227)

  - An out-of-bounds write error exists in Oniguruma in the     bitset_set_range() function during regular expression     compilation. An unauthenticated, remote attacker can     exploit this to execute arbitrary code. (CVE-2017-9228)

  - An invalid pointer deference flaw exists in Oniguruma     in the left_adjust_char_head() function within file     regexec.c during regular expression compilation. An     unauthenticated, remote attacker can exploit this to     crash a process linked to the library, resulting in a     denial of service condition. (CVE-2017-9229)

  - A flaw exists in OpenSSL in the EVP_SealInit() function     within file crypto/evp/p_seal.c due to returning an     undocumented value of '-1'. An unauthenticated, remote     attacker can exploit this to cause an unspecified     impact. (CVE-2017-11144)

  - An out-of-bounds read error exists in PHP in the     php_parse_date() function within file     ext/date/lib/parse_date.c. An unauthenticated, remote     attacker can exploit this to disclose memory contents or     cause a denial of service condition. (CVE-2017-11145)

  - A stack-based buffer overflow condition exists in PHP     in the msgfmt_parse_message() function due to improper     validation of user-supplied input when parsing locale.
    An unauthenticated, remote attacker can exploit this to     cause a denial of service condition or the execution of     arbitrary code. (CVE-2017-11362)

  - An off-by-one overflow condition exists in PHP in the     INI parsing API, specifically in the zend_ini_do_op()     function within file Zend/zend_ini_parser.c, due to     improper validation of user-supplied input. An     unauthenticated, remote attacker can exploit this to     cause a denial of service condition or the execution of     arbitrary code. (CVE-2017-11628)

  - An out-of-bounds read error exists in PHP in the     finish_nested_data() function within file     ext/standard/var_unserializer.re. An unauthenticated,     remote attacker can exploit this to disclose memory     contents or cause a denial of service condition.
    (CVE-2017-12933)

  - A use-after-free error exists in PHP in the     zval_get_type() function within file     ext/standard/var_unserializer.c. An unauthenticated,     remote attacker can exploit this to execute arbitrary     code. (CVE-2017-12934)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
101797	Fedora 26 : php (2017-b8bb4b86e2)	Nessus	Fedora Local Security Checks	2017/7/19	2021/1/6	critical
101332	FreeBSD : oniguruma -- multiple vulnerabilities (b396cf6c-62e6-11e7-9def-b499baebfeaf)	Nessus	FreeBSD Local Security Checks	2017/7/10	2021/1/4	critical
120000	SUSE SLES12 Security Update : php7 (SUSE-SU-2017:1717-1)	Nessus	SuSE Local Security Checks	2019/1/2	2024/7/11	critical
101526	PHP 7.0.x < 7.0.21 Multiple Vulnerabilities	Nessus	CGI abuses	2017/7/13	2025/5/26	critical

検出

プラグインの検索

critical

critical

critical

critical