CVE-2017-7963
** DISPUTED ** The GNU Multiple Precision Arithmetic Library (GMP) interfaces for PHP through 7.1...
CVE-2017-7963 is a high vulnerability (CVSS 7.5) in Php, published April 19, 2017. Its validity is disputed. EPSS puts the chance of exploitation in the next 30 days at 2.00%, the 81st percentile.
- Severity
- 7.5 HighCVSS 3.0, NVD
- Exploit chance
- 2.00%EPSS, 81st percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
- No fix listedNo source names one
Description
The GNU Multiple Precision Arithmetic Library (GMP) interfaces for PHP through 7.1.4 allow attackers to cause a denial of service (memory consumption and application crash) via operations on long strings. NOTE: the vendor disputes this, stating "There is no security issue here, because GMP safely aborts in case of an OOM condition. The only attack vector here is denial of service. However, if you allow attacker-controlled, unbounded allocations you have a DoS vector regardless of GMP's OOM behavior.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
php5Ubuntu:Pro:14.04:LTS | All versions, plus listed versions 5.5.3+dfsg-1ubuntu25.5.3+dfsg-1ubuntu35.5.6+dfsg-1ubuntu15.5.6+dfsg-1ubuntu25.5.8+dfsg-2ubuntu1 Show 44 moreShow less5.5.9+dfsg-1ubuntu15.5.9+dfsg-1ubuntu25.5.9+dfsg-1ubuntu35.5.9+dfsg-1ubuntu45.5.9+dfsg-1ubuntu4.15.5.9+dfsg-1ubuntu4.25.5.9+dfsg-1ubuntu4.35.5.9+dfsg-1ubuntu4.45.5.9+dfsg-1ubuntu4.55.5.9+dfsg-1ubuntu4.65.5.9+dfsg-1ubuntu4.75.5.9+dfsg-1ubuntu4.95.5.9+dfsg-1ubuntu4.115.5.9+dfsg-1ubuntu4.125.5.9+dfsg-1ubuntu4.135.5.9+dfsg-1ubuntu4.145.5.9+dfsg-1ubuntu4.165.5.9+dfsg-1ubuntu4.175.5.9+dfsg-1ubuntu4.195.5.9+dfsg-1ubuntu4.205.5.9+dfsg-1ubuntu4.215.5.9+dfsg-1ubuntu4.225.5.9+dfsg-1ubuntu4.235.5.9+dfsg-1ubuntu4.245.5.9+dfsg-1ubuntu4.255.5.9+dfsg-1ubuntu4.265.5.9+dfsg-1ubuntu4.275.5.9+dfsg-1ubuntu4.295.5.9+dfsg-1ubuntu4.29+esm15.5.9+dfsg-1ubuntu4.29+esm25.5.9+dfsg-1ubuntu4.29+esm35.5.9+dfsg-1ubuntu4.29+esm45.5.9+dfsg-1ubuntu4.29+esm55.5.9+dfsg-1ubuntu4.29+esm65.5.9+dfsg-1ubuntu4.29+esm85.5.9+dfsg-1ubuntu4.29+esm105.5.9+dfsg-1ubuntu4.29+esm115.5.9+dfsg-1ubuntu4.29+esm125.5.9+dfsg-1ubuntu4.29+esm135.5.9+dfsg-1ubuntu4.29+esm145.5.9+dfsg-1ubuntu4.29+esm155.5.9+dfsg-1ubuntu4.29+esm165.5.9+dfsg-1ubuntu4.29+esm175.5.9+dfsg-1ubuntu4.29+esm18 | None known |
What each source reports
NVD Score used
The GNU Multiple Precision Arithmetic Library (GMP) interfaces for PHP through 7.1.4 allow attackers to cause a denial of service (memory consumption and application crash) via operations on long strings. NOTE: the vendor disputes this, stating "There is no security issue here, because GMP safely aborts in case of an OOM condition. The only attack vector here is denial of service. However, if you allow attacker-controlled, unbounded allocations you have a DoS vector regardless of GMP's OOM behavior.
- Record
CVE-2017-7963- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-770
- Updated
- 2026-11-02
CVE ListNo score
The GNU Multiple Precision Arithmetic Library (GMP) interfaces for PHP through 7.1.4 allow attackers to cause a denial of service (memory consumption and application crash) via operations on long strings. NOTE: the vendor disputes this, stating "There is no security issue here, because GMP safely aborts in case of an OOM condition. The only attack vector here is denial of service. However, if you allow attacker-controlled, unbounded allocations you have a DoS vector regardless of GMP's OOM behavior.
- Record
CVE-2017-7963- Updated
- 2026-11-02
EUVDEUVD-2017-16933No score
The GNU Multiple Precision Arithmetic Library (GMP) interfaces for PHP through 7.1.4 allow attackers to cause a denial of service (memory consumption and application crash) via operations on long strings. NOTE: the vendor disputes this, stating "There is no security issue here, because GMP safely aborts in case of an OOM condition. The only attack vector here is denial of service. However, if you allow attacker-controlled, unbounded allocations you have a DoS vector regardless of GMP's OOM behavior.
- Record
EUVD-2017-16933- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-266p-jjrg-gmfx
** DISPUTED ** The GNU Multiple Precision Arithmetic Library (GMP) interfaces for PHP through 7.1...
** DISPUTED ** The GNU Multiple Precision Arithmetic Library (GMP) interfaces for PHP through 7.1.4 allow attackers to cause a denial of service (memory consumption and application crash) via operations on long strings. NOTE: the vendor disputes this, stating "There is no security issue here, because GMP safely aborts in case of an OOM condition. The only attack vector here is denial of service. However, if you allow attacker-controlled, unbounded allocations you have a DoS vector regardless of GMP's OOM behavior."
- Record
GHSA-266p-jjrg-gmfx- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-02
OSVBELL-CVE-2017-7963
CVE-2017-7963 does not affect BellSoft software
- Record
BELL-CVE-2017-7963- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSV
The GNU Multiple Precision Arithmetic Library (GMP) interfaces for PHP through 7.1.4 allow attackers to cause a denial of service (memory consumption and application crash) via operations on long strings. NOTE: the vendor disputes this, stating "There is no security issue here, because GMP safely aborts in case of an OOM condition. The only attack vector here is denial of service. However, if you allow attacker-controlled, unbounded allocations you have a DoS vector regardless of GMP's OOM behavior.
- Record
CVE-2017-7963- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2017-7963
The GNU Multiple Precision Arithmetic Library (GMP) interfaces for PHP through 7.1.4 allow attackers to cause a denial of service (memory consumption and application crash) via operations on long strings. NOTE: the vendor disputes this, stating "There is no security issue here, because GMP safely aborts in case of an OOM condition. The only attack vector here is denial of service. However, if you allow attacker-controlled, unbounded allocations you have a DoS vector regardless of GMP's OOM behavior.
- Record
UBUNTU-CVE-2017-7963- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.