Description

In PHP before 5.6.30 and 7.x before 7.0.15, the PHAR archive handler could be used by attackers supplying malicious archive files to crash the PHP interpreter or potentially disclose information due to a buffer over-read in the phar_parse_pharfile function in ext/phar/phar.c.

Remediation

References

CVE-2017-11147

Related Vulnerabilities

Bootstrap Table Access of Resource Using Incompatible Type ('Type Confusion') Vulnerability (CVE-2021-23472)

WordPress Plugin Post Form-Registration Form-Profile Form for User Profiles and Content Forms for User Submissions Security Bypass (2.6.2)

WordPress Plugin Video Conferencing with Zoom Information Disclosure (3.8.16)

WordPress Plugin jQuery Reply to Comment Cross-Site Request Forgery (1.31)

Drupal Files or Directories Accessible to External Parties Vulnerability (CVE-2017-6922)

Severity

Critical

Classification

CVE-2017-11147 CWE-125 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Tags

Missing Update Known Vulnerabilities