{"id":"CVE-2017-11146","aliases":["EUVD-2017-2781","SUSE-SU-2017:2303-1","SUSE-SU-2017:2317-1","SUSE-SU-2017:2522-1"],"status":"rejected","title":"Security update for php7","description":"DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was withdrawn by its CNA.  Further investigation showed that it was not an independently fixable security issue relative to CVE-2017-11145.  Notes: none","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"published":"2017-07-10T14:00:00Z","modified":"2026-02-04T04:23:16Z","affected":[{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.7-50.9.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP2","package":"php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.7-50.9.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.7-50.9.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"php5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.5.14-109.5.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP2","package":"php5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.5.14-109.5.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"php5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.5.14-109.5.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"php53","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.17-112.5.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"php53","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.17-112.5.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"php53","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.17-112.5.1"}]}],"bundled":10}],"references":[{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20172303-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1047454","tags":["report"]},{"url":"https://bugzilla.suse.com/1048094","tags":["report"]},{"url":"https://bugzilla.suse.com/1048096","tags":["report"]},{"url":"https://bugzilla.suse.com/1048100","tags":["report"]},{"url":"https://bugzilla.suse.com/1048111","tags":["report"]},{"url":"https://bugzilla.suse.com/1048112","tags":["report"]},{"url":"https://bugzilla.suse.com/1050241","tags":["report"]},{"url":"https://bugzilla.suse.com/1050726","tags":["report"]},{"url":"https://bugzilla.suse.com/1052389","tags":["report"]},{"url":"https://bugzilla.suse.com/1053645","tags":["report"]},{"url":"https://bugzilla.suse.com/986386","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10397","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5766","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-11142","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-11144","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-11145","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-11146","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-11147","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-11628","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7890","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20172317-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1048097","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-11143","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20172522-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1054430","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10168","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12933","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2017-11146","description":"DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was withdrawn by its CNA.  Further investigation showed that it was not an independently fixable security issue relative to CVE-2017-11145.  Notes: none","status":"rejected","published":"2017-07-10T14:00:00Z","modified":"2017-07-23T19:57:01Z","updated_at":"2026-11-02T14:33:20.171335Z"}],"euvd":[{"id":"EUVD-2017-2781","description":"DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was withdrawn by its CNA.  Further investigation showed that it was not an independently fixable security issue relative to CVE-2017-11145.  Notes: none","status":"published","published":"2017-07-10T14:00:00Z","modified":"2017-07-23T19:57:01Z","updated_at":"2026-11-03T04:07:48.301361Z"}],"nvd":[{"id":"CVE-2017-11146","description":"Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was withdrawn by its CNA.  Further investigation showed that it was not an independently fixable security issue relative to CVE-2017-11145.  Notes: none","status":"rejected","published":"2017-07-10T14:29:00.667Z","modified":"2023-11-07T02:38:10.717Z","updated_at":"2026-11-02T14:03:54.012105Z"}],"osv":[{"id":"SUSE-SU-2017:2303-1","title":"Security update for php7","description":"This update for php7 fixes the following issues:\n\n- CVE-2016-10397: parse_url() can be bypassed to return fake host. (bsc#1047454)\n- CVE-2017-11142: Remoteattackers could cause a CPU consumption denial of service attack by\n  injectinglong form variables, related to main/php_variables. (bsc#1048100)\n- CVE-2017-11144: The opensslextension PEM sealing code did not check the return value of the\n  OpenSSL sealingfunction, which could lead to a crash. (bsc#1048096)\n- CVE-2017-11145: Lack of bounds checks in timelib_meridian coud lead to information leak.\n  (bsc#1048112)\n- CVE-2017-11146: Lack of bounds checks in timelib_meridian parse code could lead to information\n  leak. (bsc#1048111)\n- CVE-2017-11147: The PHAR archive handler could beused by attackers supplying malicious archive\n  files to crash the PHP interpreteror potentially disclose information. (bsc#1048094)\n- CVE-2017-11628:  Stack-base dbuffer overflow in zend_ini_do_op() could lead to denial of service (bsc#1050726)\n- CVE-2017-7890: Buffer over-read from unitialized data in gdImageCreateFromGifCtx function\ncould lead to denial of service (bsc#1050241)\n- CVE-2016-5766:  Integer Overflow in _gd2GetHeader() resulting in heap overflow could lead to denial of service or code execution (bsc#986386)\n\nOther fixes:\n\n- Soap Request with References (bsc#1053645)\n- php7-pear should explicitly require php7-pear-Archive_Tar\n  otherwise this dependency must be declared in every\n  php7-pear-* package explicitly. [bnc#1052389]\n\n","status":"published","published":"2017-08-30T13:18:53Z","modified":"2026-02-04T03:41:36.37101Z","updated_at":"2026-11-02T15:53:44.209561Z"},{"id":"SUSE-SU-2017:2317-1","title":"Security update for php5","description":"This update for php5 fixes the following issues:\n\n- CVE-2016-10397: parse_url() can be bypassed to return fake host. (bsc#1047454)\n- CVE-2017-11143: An invalid free in the WDDX deserialization of booleanparameters could be used by\n  attackers able to inject XML for deserialization tocrash the PHP interpreter. (bsc#1048097)\n- CVE-2017-11144: The opensslextension PEM sealing code did not check the return value of the\n  OpenSSL sealingfunction, which could lead to a crash. (bsc#1048096)\n- CVE-2017-11145: Lack of bounds checks in timelib_meridian coud lead to information leak.\n  (bsc#1048112)\n- CVE-2017-11146: Lack of bounds checks in timelib_meridian parse code could lead to information\n  leak. (bsc#1048111)\n- CVE-2017-11147: The PHAR archive handler could beused by attackers supplying malicious archive\n  files to crash the PHP interpreteror potentially disclose information. (bsc#1048094)\n- CVE-2016-5766: Integer Overflow in _gd2GetHeader() resulting could lead to heap overflow (bsc#986386)\n- CVE-2017-11628: Stack-base dbuffer overflow in zend_ini_do_op() in Zend/zend_ini_parser.c (bsc#1050726)\n- CVE-2017-7890:  Buffer over-read from unitialized data in gdImageCreateFromGifCtx function could lead to denial of service (bsc#1050241)\n","status":"published","published":"2017-08-31T19:45:03Z","modified":"2025-05-02T04:05:05.77083Z","updated_at":"2026-11-02T15:53:44.209561Z"},{"id":"SUSE-SU-2017:2522-1","title":"Security update for php53","description":"This update for php53 fixes the several issues.\n\nThese security issues were fixed:\n\n- CVE-2017-12933: The finish_nested_data function in ext/standard/var_unserializer.re was prone to a buffer over-read while unserializing untrusted data. Exploitation of this issue could have had an unspecified impact on the integrity of PHP (bsc#1054430).\n- CVE-2017-11628: Stack-based buffer overflow in the zend_ini_do_op() function in Zend/zend_ini_parser.c could have caused a denial of service or potentially allowed executing code (bsc#1050726).\n- CVE-2017-7890: The GIF decoding function gdImageCreateFromGifCtx in the GD Graphics Library did not zero colorMap arrays use. A specially crafted GIF image could use the uninitialized tables to read ~700 bytes from the top of the stack, potentially disclosing sensitive information (bsc#1050241).\n- CVE-2016-5766: Integer overflow in the _gd2GetHeader in the GD Graphics Library (aka libgd) allowed remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via crafted chunk dimensions in an image (bsc#986386).\n- CVE-2017-11145: An error in the date extension's timelib_meridian parsing code could have been used by attackers able to supply date strings to leak information from the interpreter, related to ext/date/lib/parse_date.c out-of-bounds reads affecting the php_parse_date function (bsc#1048112).\n- CVE-2017-11146: Lack of bounds checks in timelib_meridian parse code could have lead to information leak [bsc#1048111]\n- CVE-2016-10397: Incorrect handling of various URI components in the URL parser could have been used by attackers to bypass hostname-specific URL checks (bsc#1047454).\n- CVE-2017-11147: The PHAR archive handler could have been used by attackers supplying malicious archive files to crash the PHP interpreter or potentially disclose information due to a buffer over-read in the phar_parse_pharfile function (bsc#1048094).\n- CVE-2017-11144: The openssl extension PEM sealing code did not check the return value of the OpenSSL sealing function, which could have lead to a crash of the PHP interpreter (bsc#1048096).\n","status":"published","published":"2017-09-18T10:31:12Z","modified":"2026-02-04T04:23:16.333124Z","updated_at":"2026-11-02T15:53:44.209561Z"}]}}