CVE-2017-11142

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

In PHP before 5.6.31, 7.x before 7.0.17, and 7.1.x before 7.1.3, remote attackers could cause a CPU consumption denial of service attack by injecting long form variables, related to main/php_variables.c.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://openwall.com/lists/oss-security/2017/07/10/6Mailing List
http://php.net/ChangeLog-5.phpRelease Notes, Vendor Advisory
http://php.net/ChangeLog-7.phpRelease Notes, Vendor Advisory
http://www.securityfocus.com/bid/99601
https://bugs.php.net/bug.php?id=73807Vendor Advisory
https://github.com/php/php-src/commit/0f8cf3b8497dc45c010c44ed9e96518e11e19fc3Patch, Third Party Advisory
https://github.com/php/php-src/commit/a15bffd105ac28fd0dd9b596632dbf035238fda3Patch, Third Party Advisory
https://security.netapp.com/advisory/ntap-20180112-0001/
https://www.debian.org/security/2018/dsa-4081
https://www.tenable.com/security/tns-2017-12
http://openwall.com/lists/oss-security/2017/07/10/6Mailing List
http://php.net/ChangeLog-5.phpRelease Notes, Vendor Advisory
http://php.net/ChangeLog-7.phpRelease Notes, Vendor Advisory
http://www.securityfocus.com/bid/99601
https://bugs.php.net/bug.php?id=73807Vendor Advisory
https://github.com/php/php-src/commit/0f8cf3b8497dc45c010c44ed9e96518e11e19fc3Patch, Third Party Advisory
https://github.com/php/php-src/commit/a15bffd105ac28fd0dd9b596632dbf035238fda3Patch, Third Party Advisory
https://security.netapp.com/advisory/ntap-20180112-0001/
https://www.debian.org/security/2018/dsa-4081
https://www.tenable.com/security/tns-2017-12

Timeline

Published: Jul 10, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-111437.5In PHP before 5.6.31, an invalid free in the WDDX deserialization of boolean parameters could be used by attackers able to inject XML for de CVE-2017-111447.5In PHP before 5.6.31, 7.x before 7.0.21, and 7.1.x before 7.1.7, the openssl extension PEM sealing code did not check the return value of th CVE-2017-111457.5In PHP before 5.6.31, 7.x before 7.0.21, and 7.1.x before 7.1.7, an error in the date extension's timelib_meridian parsing code could be use CVE-2017-111479.1In PHP before 5.6.30 and 7.x before 7.0.15, the PHAR archive handler could be used by attackers supplying malicious archive files to crash t CVE-2017-111486.5Server-side request forgery (SSRF) vulnerability in link preview in Synology Chat before 1.1.0-0806 allows remote authenticated users to acc CVE-2017-111496.5Server-side request forgery (SSRF) vulnerability in Downloader in Synology Download Station 3.8.x before 3.8.5-3475 and 3.x before 3.5-2984 CVE-2017-11155.4IBM Campaign 9.1, 9.1.2, and 10 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, woul CVE-2017-111507.8Command injection vulnerability in Document.php in Synology Office 2.2.0-1502 and 2.2.1-1506 allows remote authenticated users to execute ar CVE-2017-111519.8A vulnerability in synotheme_upload.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to upload arbitrary CVE-2017-111527.5Directory traversal vulnerability in PixlrEditorHandler.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers CVE-2017-111539.8Deserialization vulnerability in synophoto_csPhotoMisc.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers CVE-2017-111547.2Unrestricted file upload vulnerability in PixlrEditorHandler.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote atta