Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

github логотип

GHSA-wrc8-jp87-rq8j

Опубликовано: 14 мая 2022
Источник: github
Github: Не прошло ревью
CVSS3: 9.8

Описание

The zend_string_extend function in Zend/zend_string.h in PHP through 7.1.5 does not prevent changes to string objects that result in a negative length, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact by leveraging a script's use of .= with a long string.

The zend_string_extend function in Zend/zend_string.h in PHP through 7.1.5 does not prevent changes to string objects that result in a negative length, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact by leveraging a script's use of .= with a long string.

EPSS

Процентиль: 89%
0.04586
Низкий

9.8 Critical

CVSS3

Дефекты

CWE-20
CWE-787

Связанные уязвимости

CVSS3: 9.8
ubuntu
больше 8 лет назад

The zend_string_extend function in Zend/zend_string.h in PHP through 7.1.5 does not prevent changes to string objects that result in a negative length, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact by leveraging a script's use of .= with a long string.

CVSS3: 7.5
redhat
больше 8 лет назад

The zend_string_extend function in Zend/zend_string.h in PHP through 7.1.5 does not prevent changes to string objects that result in a negative length, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact by leveraging a script's use of .= with a long string.

CVSS3: 9.8
nvd
больше 8 лет назад

The zend_string_extend function in Zend/zend_string.h in PHP through 7.1.5 does not prevent changes to string objects that result in a negative length, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact by leveraging a script's use of .= with a long string.

CVSS3: 9.8
msrc
около 1 месяца назад

The zend_string_extend function in Zend/zend_string.h in PHP through 7.1.5 does not prevent changes to string objects that result in a negative length, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact by leveraging a script's use of .= with a long string.

CVSS3: 9.8
debian
больше 8 лет назад

The zend_string_extend function in Zend/zend_string.h in PHP through 7 ...

EPSS

Процентиль: 89%
0.04586
Низкий

9.8 Critical

CVSS3

Дефекты

CWE-20
CWE-787