CVE-2017-9118

PHP 7.1.5 has an Out of bounds access in php_pcre_replace_impl via a crafted preg_replace call.

• SECURITY UPDATE: Denial of service
  • debian/patches/CVE-2015-9253-pre1.patch: include .inc files used in fpm tests in sapi/fpm/tests/ alogin with other .phpt test scripts.
  • debian/patches/CVE-2015-9253-pre2.patch: close the listening socket on sapi/fpm/fpm/fpm_signals.c and added tests in sapi/fpm/tests/bug77934-reload-process-control.phpt.
  • debian/patches/CVE-2015-9253.patch: directly listen on socket, instead of dumping it to STDIN in sapi/fpm/fpm/fpm_children.c, sapi/fpm/fpm_stdio.c, and added tests in sapi/fpm/tests/bug73342-nonblocking-stdio.phpt.
  • CVE-2015-9253
• SECURITY UPDATE: Integer overflow
  • debian/patches/CVE-2017-8923-pre.patch: added ZSTR_MAX_LEN macro in Zend/zend_string.h and make use of it in Zend/zend_operators.c instead of using SIZE_MAX.
  • debian/patches/CVE-2017-8923.patch: added a length check before calling zend_string_realloc method in Zend/zend_vm_def.h and Zend/zend_vm_execute.h.
  • CVE-2017-8923
• SECURITY UPDATE: Integer overflow
  • debian/patches/CVE-2017-9118.patch: added ZSTR_MAX_OVERHEAD macro in Zend/zend_string.h that has the the maximal overhead of a zend_string and uses it in ext/pcre/php_pcre.c to assign a zend_string length value.
  • CVE-2017-9118
• SECURITY UPDATE: Use after free
  • debian/patches/CVE-2017-9119.patch: changed the decrement of refcount to be made once the string allocation has succeeded in Zend/zend_string.h.
  • CVE-2017-9119
• SECURITY UPDATE: Integer overflow
  • debian/patches/CVE-2017-9120.patch: changed the string allocation from zend_string_alloc to zend_string_safe_alloc in ext/mysqli/mysqli_api.c.
  • CVE-2017-9120
• SECURITY UDPATE: Improper handling of special characters
  • debian/patches/CVE-2021-21707.patch: added a string validation to check for improper characters in ext/dom/domimplementation.c and in ext/libxml/libxml.c and added tests in ext/simplexml/tests/bug79971_1.phpt and ext/dom/tests/bug79971_2.phpt.
  • CVE-2021-21707

• SECURITY UPDATE: out-of-bounds access
  • debian/patches/CVE-2017-9118.patch: fix out of bounds access in php_pcre_replace_impl
  • CVE-2017-9118
• SECURITY UPDATE: improper validation of HTTP_REDIRECT_STATUS variable in CGI binary
  • debian/patches/CVE-2024-8927.patch: fix Apache server name check; remove references to redirect.so and Netscape; check configuration override first
  • CVE-2024-8927
• SECURITY UPDATE: buffer overread vulnerability
  • debian/patches/CVE-2024-11233.patch: move bound check upwards to fix single byte overread with convert.quoted-printable-decode filter
  • CVE-2024-11233
• SECURITY UPDATE: URI is not properly sanitized
  • debian/patches/CVE-2024-11234.patch: when using streams with configured proxy and "request_fulluri" option, the URI is not properly sanitized which can lead to HTTP request smuggling and allow the attacker to use the proxy to perform arbitrary HTTP requests originating from the server, thus potentially gaining access to resources not normally available to the external user
  • CVE-2024-11234
• SECURITY UPDATE: incomplete check in escaping functions
  • debian/patches/CVE-2025-1735.patch: pgsql and pdo_pgsql escaping functions do not check if the underlying quoting functions returned errors. This could cause crashes if Postgres server rejects the string as invalid.
  • CVE-2025-1735

Out of bounds in php_pcre_replace_impl (CVE-2017-9118) Multiple bugs fixed. See referenced changelog for details.

This update for php7 fixes the following issues:

• CVE-2017-9118: Fixed an out of bounds access in php_pcre_replace_impl via a crafted preg_replace call (bsc#1105466)

This update for php53 fixes the following issues:

The following security issues were fixed:

• CVE-2018-14851: Fixed an out-of-bound read in exif_process_IFD_in_MAKERNOTE, which could be exploited by an attacker via crafted JPG files, and could result in an application crash. (bsc#1103659)
• CVE-2018-14883: Fixed an integer overflow leading to a heap based buffer over-read in exif_thumbnail_extract of exif.c. (bsc#1103836)
• CVE-2017-9118: Fixed an out of bounds access in php_pcre_replace_impl via a crafted preg_replace call (bsc#1105466)

This update for php5 fixes the following issues:

The following security issues were fixed:

• CVE-2018-10360: Fixed an out-of-bounds read in the do_core_note function in readelf.c in libmagic.a, which allowed remote attackers to cause a denial of service via a crafted ELF file (bsc#1096984)
• CVE-2018-14851: Fixed an out-of-bound read in exif_process_IFD_in_MAKERNOTE, which could be exploited by an attacker via crafted JPG files, and could result in an application crash. (bsc#1103659)
• CVE-2018-12882: Fixed an use-after-free in exif_read_from_impl in ext/exif/exif.c (bsc#1099098)
• CVE-2017-9118: Fixed an out of bounds access in php_pcre_replace_impl via a crafted preg_replace call (bsc#1105466)

It was discovered that PHP incorrectly handled certain scripts. An attacker could possibly use this issue to cause a denial of service. (CVE-2015-9253, CVE-2017-8923, CVE-2017-9118, CVE-2017-9120)

It was discovered that PHP incorrectly handled certain inputs. An attacker could possibly use this issue to cause a denial of service, or possibly obtain sensitive information. (CVE-2017-9119)

It was discovered that PHP incorrectly handled certain scripts with XML parsing functions. An attacker could possibly use this issue to obtain sensitive information. (CVE-2021-21707)

USN-5300-1 fixed vulnerabilities in PHP. This update provides the corresponding updates for Ubuntu 18.04 LTS and Ubuntu 20.04 LTS.

Original advisory details:

It was discovered that PHP incorrectly handled certain scripts. An attacker could possibly use this issue to cause a denial of service. (CVE-2015-9253, CVE-2017-8923, CVE-2017-9118, CVE-2017-9120)

It was discovered that PHP incorrectly handled certain inputs. An attacker could possibly use this issue to cause a denial of service, or possibly obtain sensitive information. (CVE-2017-9119)

It was discovered that PHP incorrectly handled certain scripts with XML parsing functions. An attacker could possibly use this issue to obtain sensitive information. (CVE-2021-21707)