{"id":"CVE-2017-11142","aliases":["DSA-4081-1","EUVD-2017-2777","GHSA-54gj-pv8c-2qj3","SUSE-SU-2017:2303-1","UBUNTU-CVE-2017-11142"],"status":"published","title":"In PHP before 5.6.31, 7.x before 7.0.17, and 7.1.x before 7.1.3, remote attackers could cause a...","description":"In PHP before 5.6.31, 7.x before 7.0.17, and 7.1.x before 7.1.3, remote attackers could cause a CPU consumption denial of service attack by injecting long form variables, related to main/php_variables.c.","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.08255,"percentile":0.94939,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-400"],"published":"2017-07-10T14:00:00Z","modified":"2026-10-20T13:14:17Z","affected":[{"source":"osv","ecosystem":"Debian:8","package":"php5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.6.33+dfsg-0+deb8u1"}]}],"versions":["5.6.11+dfsg-1","5.6.12+dfsg-0+deb8u1","5.6.12+dfsg-1","5.6.13+dfsg-0+deb8u1","5.6.13+dfsg-1","5.6.13+dfsg-2","5.6.14+dfsg-0+deb8u1","5.6.14+dfsg-1","5.6.15+dfsg-1","5.6.16+dfsg-1","5.6.16+dfsg-2","5.6.16+dfsg-3","5.6.16+dfsg-4","5.6.17+dfsg-0+deb8u1","5.6.17+dfsg-1","5.6.17+dfsg-3","5.6.18+dfsg-1","5.6.19+dfsg-0+deb8u1","5.6.19+dfsg-1","5.6.19+dfsg-2","5.6.20+dfsg-0+deb8u1","5.6.20+dfsg-1","5.6.21+dfsg-1","5.6.21+dfsg-2","5.6.22+dfsg-0+deb8u1","5.6.22+dfsg-1","5.6.22+dfsg-2","5.6.23+dfsg-0+deb8u1","5.6.23+dfsg-1","5.6.24+dfsg-0+deb8u1","5.6.24+dfsg-1","5.6.26+dfsg-0+deb8u1","5.6.26+dfsg-1","5.6.27+dfsg-0+deb8u1","5.6.28+dfsg-0+deb8u1","5.6.29+dfsg-0+deb8u1","5.6.30+dfsg-0+deb8u1","5.6.7+dfsg-1","5.6.9+dfsg-0+deb8u1","5.6.9+dfsg-1"],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.7-50.9.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP2","package":"php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.7-50.9.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.7-50.9.2"}]}],"bundled":9}],"products":[{"vendor":"php","product":"php"}],"references":[{"url":"https://github.com/php/php-src/commit/0f8cf3b8497dc45c010c44ed9e96518e11e19fc3","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"http://openwall.com/lists/oss-security/2017/07/10/6","tags":["x_refsource_CONFIRM","x_transferred","Mailing List","article","report"]},{"url":"https://www.tenable.com/security/tns-2017-12","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://bugs.php.net/bug.php?id=73807","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory"]},{"url":"https://github.com/php/php-src/commit/a15bffd105ac28fd0dd9b596632dbf035238fda3","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"http://php.net/ChangeLog-5.php","tags":["x_refsource_CONFIRM","x_transferred","Release Notes","Vendor Advisory","advisory","report"]},{"url":"https://security.netapp.com/advisory/ntap-20180112-0001/","tags":["x_refsource_CONFIRM","x_transferred","advisory"]},{"url":"http://www.securityfocus.com/bid/99601","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"https://www.debian.org/security/2018/dsa-4081","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"http://php.net/ChangeLog-7.php","tags":["x_refsource_CONFIRM","x_transferred","Release Notes","Vendor Advisory","advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-11142"},{"url":"https://security.netapp.com/advisory/ntap-20180112-0001"},{"url":"https://github.com/advisories/GHSA-54gj-pv8c-2qj3"},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20172303-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1047454","tags":["report"]},{"url":"https://bugzilla.suse.com/1048094","tags":["report"]},{"url":"https://bugzilla.suse.com/1048096","tags":["report"]},{"url":"https://bugzilla.suse.com/1048100","tags":["report"]},{"url":"https://bugzilla.suse.com/1048111","tags":["report"]},{"url":"https://bugzilla.suse.com/1048112","tags":["report"]},{"url":"https://bugzilla.suse.com/1050241","tags":["report"]},{"url":"https://bugzilla.suse.com/1050726","tags":["report"]},{"url":"https://bugzilla.suse.com/1052389","tags":["report"]},{"url":"https://bugzilla.suse.com/1053645","tags":["report"]},{"url":"https://bugzilla.suse.com/986386","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10397","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5766","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-11142","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-11144","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-11145","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-11146","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-11147","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-11628","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7890","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2017-11142","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-11142","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2017-11142","description":"In PHP before 5.6.31, 7.x before 7.0.17, and 7.1.x before 7.1.3, remote attackers could cause a CPU consumption denial of service attack by injecting long form variables, related to main/php_variables.c.","status":"published","published":"2017-07-10T14:00:00Z","modified":"2024-08-05T17:57:57.668Z","updated_at":"2026-11-02T14:33:19.848632Z"}],"euvd":[{"id":"EUVD-2017-2777","description":"In PHP before 5.6.31, 7.x before 7.0.17, and 7.1.x before 7.1.3, remote attackers could cause a CPU consumption denial of service attack by injecting long form variables, related to main/php_variables.c.","status":"published","published":"2017-07-10T14:00:00Z","modified":"2024-08-05T17:57:57Z","updated_at":"2026-11-03T02:23:24.743229Z"}],"ghsa":[{"id":"GHSA-54gj-pv8c-2qj3","title":"In PHP before 5.6.31, 7.x before 7.0.17, and 7.1.x before 7.1.3, remote attackers could cause a...","description":"In PHP before 5.6.31, 7.x before 7.0.17, and 7.1.x before 7.1.3, remote attackers could cause a CPU consumption denial of service attack by injecting long form variables, related to main/php_variables.c.","status":"published","published":"2022-05-14T03:50:14Z","modified":"2025-04-20T03:41:32Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:01:49.006624Z"}],"nvd":[{"id":"CVE-2017-11142","description":"In PHP before 5.6.31, 7.x before 7.0.17, and 7.1.x before 7.1.3, remote attackers could cause a CPU consumption denial of service attack by injecting long form variables, related to main/php_variables.c.","status":"published","published":"2017-07-10T14:29:00.557Z","modified":"2026-06-17T01:01:17.69Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":7.8,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:03:54.012105Z"}],"osv":[{"id":"CVE-2017-11142","description":"In PHP before 5.6.31, 7.x before 7.0.17, and 7.1.x before 7.1.3, remote attackers could cause a CPU consumption denial of service attack by injecting long form variables, related to main/php_variables.c.","status":"published","published":"2017-07-10T14:29:00.557Z","modified":"2026-10-20T13:14:17.769889742Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:03.851821Z"},{"id":"UBUNTU-CVE-2017-11142","description":"In PHP before 5.6.31, 7.x before 7.0.17, and 7.1.x before 7.1.3, remote attackers could cause a CPU consumption denial of service attack by injecting long form variables, related to main/php_variables.c.","status":"withdrawn","published":"2017-07-10T14:29:00Z","modified":"2025-07-16T08:12:47.524442Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:13.729565Z"},{"id":"DSA-4081-1","title":"php5 - security update","status":"published","published":"2018-01-08T00:00:00Z","modified":"2026-03-09T01:18:30.795399Z","updated_at":"2026-11-02T15:46:16.523846Z"},{"id":"SUSE-SU-2017:2303-1","title":"Security update for php7","description":"This update for php7 fixes the following issues:\n\n- CVE-2016-10397: parse_url() can be bypassed to return fake host. (bsc#1047454)\n- CVE-2017-11142: Remoteattackers could cause a CPU consumption denial of service attack by\n  injectinglong form variables, related to main/php_variables. (bsc#1048100)\n- CVE-2017-11144: The opensslextension PEM sealing code did not check the return value of the\n  OpenSSL sealingfunction, which could lead to a crash. (bsc#1048096)\n- CVE-2017-11145: Lack of bounds checks in timelib_meridian coud lead to information leak.\n  (bsc#1048112)\n- CVE-2017-11146: Lack of bounds checks in timelib_meridian parse code could lead to information\n  leak. (bsc#1048111)\n- CVE-2017-11147: The PHAR archive handler could beused by attackers supplying malicious archive\n  files to crash the PHP interpreteror potentially disclose information. (bsc#1048094)\n- CVE-2017-11628:  Stack-base dbuffer overflow in zend_ini_do_op() could lead to denial of service (bsc#1050726)\n- CVE-2017-7890: Buffer over-read from unitialized data in gdImageCreateFromGifCtx function\ncould lead to denial of service (bsc#1050241)\n- CVE-2016-5766:  Integer Overflow in _gd2GetHeader() resulting in heap overflow could lead to denial of service or code execution (bsc#986386)\n\nOther fixes:\n\n- Soap Request with References (bsc#1053645)\n- php7-pear should explicitly require php7-pear-Archive_Tar\n  otherwise this dependency must be declared in every\n  php7-pear-* package explicitly. [bnc#1052389]\n\n","status":"published","published":"2017-08-30T13:18:53Z","modified":"2026-02-04T03:41:36.37101Z","updated_at":"2026-11-02T15:53:44.209561Z"}]}}