{"id":"CVE-2017-6441","aliases":["BELL-CVE-2017-6441","EUVD-2017-15498","GHSA-cmfj-hp6v-cm88","SUSE-SU-2017:1717-1","UBUNTU-CVE-2017-6441"],"status":"disputed","title":"** DISPUTED ** The _zval_get_long_func_ex in Zend/zend_operators.c in PHP 7.1.2 allows attackers...","description":"The _zval_get_long_func_ex in Zend/zend_operators.c in PHP 7.1.2 allows attackers to cause a denial of service (NULL pointer dereference and application crash) via crafted use of \"declare(ticks=\" in a PHP script. NOTE: the vendor disputes the classification of this as a vulnerability, stating \"Please do not request CVEs for ordinary bugs. CVEs are relevant for security issues only.","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01832,"percentile":0.79036,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-476"],"published":"2017-04-03T05:44:00Z","modified":"2026-10-21T23:00:11Z","affected":[{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.7-49.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP2","package":"php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.7-49.1"}]}],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"php5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.5.3+dfsg-1ubuntu2","5.5.3+dfsg-1ubuntu3","5.5.6+dfsg-1ubuntu1","5.5.6+dfsg-1ubuntu2","5.5.8+dfsg-2ubuntu1","5.5.9+dfsg-1ubuntu1","5.5.9+dfsg-1ubuntu2","5.5.9+dfsg-1ubuntu3","5.5.9+dfsg-1ubuntu4","5.5.9+dfsg-1ubuntu4.1","5.5.9+dfsg-1ubuntu4.2","5.5.9+dfsg-1ubuntu4.3","5.5.9+dfsg-1ubuntu4.4","5.5.9+dfsg-1ubuntu4.5","5.5.9+dfsg-1ubuntu4.6","5.5.9+dfsg-1ubuntu4.7","5.5.9+dfsg-1ubuntu4.9","5.5.9+dfsg-1ubuntu4.11","5.5.9+dfsg-1ubuntu4.12","5.5.9+dfsg-1ubuntu4.13","5.5.9+dfsg-1ubuntu4.14","5.5.9+dfsg-1ubuntu4.16","5.5.9+dfsg-1ubuntu4.17","5.5.9+dfsg-1ubuntu4.19","5.5.9+dfsg-1ubuntu4.20","5.5.9+dfsg-1ubuntu4.21","5.5.9+dfsg-1ubuntu4.22","5.5.9+dfsg-1ubuntu4.23","5.5.9+dfsg-1ubuntu4.24","5.5.9+dfsg-1ubuntu4.25","5.5.9+dfsg-1ubuntu4.26","5.5.9+dfsg-1ubuntu4.27","5.5.9+dfsg-1ubuntu4.29","5.5.9+dfsg-1ubuntu4.29+esm1","5.5.9+dfsg-1ubuntu4.29+esm2","5.5.9+dfsg-1ubuntu4.29+esm3","5.5.9+dfsg-1ubuntu4.29+esm4","5.5.9+dfsg-1ubuntu4.29+esm5","5.5.9+dfsg-1ubuntu4.29+esm6","5.5.9+dfsg-1ubuntu4.29+esm8","5.5.9+dfsg-1ubuntu4.29+esm10","5.5.9+dfsg-1ubuntu4.29+esm11","5.5.9+dfsg-1ubuntu4.29+esm12","5.5.9+dfsg-1ubuntu4.29+esm13","5.5.9+dfsg-1ubuntu4.29+esm14","5.5.9+dfsg-1ubuntu4.29+esm15","5.5.9+dfsg-1ubuntu4.29+esm16","5.5.9+dfsg-1ubuntu4.29+esm17","5.5.9+dfsg-1ubuntu4.29+esm18"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"php7.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.0.1-5","7.0.1-6","7.0.2-1","7.0.2-3","7.0.2-4","7.0.2-5","7.0.3-2","7.0.3-3","7.0.3-9ubuntu1","7.0.4-5ubuntu1","7.0.4-5ubuntu2","7.0.4-7ubuntu1","7.0.4-7ubuntu2","7.0.4-7ubuntu2.1","7.0.8-0ubuntu0.16.04.1","7.0.8-0ubuntu0.16.04.2","7.0.8-0ubuntu0.16.04.3","7.0.13-0ubuntu0.16.04.1","7.0.15-0ubuntu0.16.04.1","7.0.15-0ubuntu0.16.04.2","7.0.15-0ubuntu0.16.04.4","7.0.18-0ubuntu0.16.04.1","7.0.22-0ubuntu0.16.04.1","7.0.25-0ubuntu0.16.04.1","7.0.28-0ubuntu0.16.04.1","7.0.30-0ubuntu0.16.04.1","7.0.32-0ubuntu0.16.04.1","7.0.33-0ubuntu0.16.04.1","7.0.33-0ubuntu0.16.04.2","7.0.33-0ubuntu0.16.04.3","7.0.33-0ubuntu0.16.04.4","7.0.33-0ubuntu0.16.04.5","7.0.33-0ubuntu0.16.04.6","7.0.33-0ubuntu0.16.04.7","7.0.33-0ubuntu0.16.04.9","7.0.33-0ubuntu0.16.04.11","7.0.33-0ubuntu0.16.04.12","7.0.33-0ubuntu0.16.04.14","7.0.33-0ubuntu0.16.04.15","7.0.33-0ubuntu0.16.04.16","7.0.33-0ubuntu0.16.04.16+esm1","7.0.33-0ubuntu0.16.04.16+esm2","7.0.33-0ubuntu0.16.04.16+esm3","7.0.33-0ubuntu0.16.04.16+esm4","7.0.33-0ubuntu0.16.04.16+esm5","7.0.33-0ubuntu0.16.04.16+esm6","7.0.33-0ubuntu0.16.04.16+esm7","7.0.33-0ubuntu0.16.04.16+esm8","7.0.33-0ubuntu0.16.04.16+esm9","7.0.33-0ubuntu0.16.04.16+esm10","7.0.33-0ubuntu0.16.04.16+esm11","7.0.33-0ubuntu0.16.04.16+esm12","7.0.33-0ubuntu0.16.04.16+esm13","7.0.33-0ubuntu0.16.04.16+esm14","7.0.33-0ubuntu0.16.04.16+esm15","7.0.33-0ubuntu0.16.04.16+esm16","7.0.33-0ubuntu0.16.04.16+esm17","7.0.33-0ubuntu0.16.04.16+esm18","7.0.33-0ubuntu0.16.04.16+esm19","7.0.33-0ubuntu0.16.04.16+esm20","7.0.33-0ubuntu0.16.04.16+esm21","7.0.33-0ubuntu0.16.04.16+esm22"]}],"products":[{"vendor":"php","product":"php"}],"references":[{"url":"https://bugs.php.net/bug.php?id=74146","tags":["x_refsource_MISC","x_transferred","Issue Tracking","report"]},{"url":"https://github.com/php/php-src/pull/2396","tags":["x_refsource_MISC","x_transferred","Patch","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-6441"},{"url":"https://github.com/advisories/GHSA-cmfj-hp6v-cm88"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2017-6441","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20171717-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1032155","tags":["report"]},{"url":"https://bugzilla.suse.com/1035111","tags":["report"]},{"url":"https://bugzilla.suse.com/1040883","tags":["report"]},{"url":"https://bugzilla.suse.com/1040889","tags":["report"]},{"url":"https://bugzilla.suse.com/1040891","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6294","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-6441","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9224","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9226","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9227","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2017-6441","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-6441","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2017-6441","description":"The _zval_get_long_func_ex in Zend/zend_operators.c in PHP 7.1.2 allows attackers to cause a denial of service (NULL pointer dereference and application crash) via crafted use of \"declare(ticks=\" in a PHP script. NOTE: the vendor disputes the classification of this as a vulnerability, stating \"Please do not request CVEs for ordinary bugs. CVEs are relevant for security issues only.","status":"disputed","published":"2017-04-03T05:44:00Z","modified":"2024-08-05T15:25:49.366Z","updated_at":"2026-11-02T14:33:16.916541Z"}],"euvd":[{"id":"EUVD-2017-15498","description":"The _zval_get_long_func_ex in Zend/zend_operators.c in PHP 7.1.2 allows attackers to cause a denial of service (NULL pointer dereference and application crash) via crafted use of \"declare(ticks=\" in a PHP script. NOTE: the vendor disputes the classification of this as a vulnerability, stating \"Please do not request CVEs for ordinary bugs. CVEs are relevant for security issues only.","status":"published","published":"2017-04-03T05:44:00Z","modified":"2024-08-05T15:25:49Z","updated_at":"2026-11-03T02:39:12.564822Z"}],"ghsa":[{"id":"GHSA-cmfj-hp6v-cm88","title":"** DISPUTED ** The _zval_get_long_func_ex in Zend/zend_operators.c in PHP 7.1.2 allows attackers...","description":"** DISPUTED ** The _zval_get_long_func_ex in Zend/zend_operators.c in PHP 7.1.2 allows attackers to cause a denial of service (NULL pointer dereference and application crash) via crafted use of \"declare(ticks=\" in a PHP script. NOTE: the vendor disputes the classification of this as a vulnerability, stating \"Please do not request CVEs for ordinary bugs. CVEs are relevant for security issues only.\"","status":"published","published":"2022-05-17T02:51:04Z","modified":"2023-01-27T05:06:16Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:42:52.881185Z"}],"nvd":[{"id":"CVE-2017-6441","description":"The _zval_get_long_func_ex in Zend/zend_operators.c in PHP 7.1.2 allows attackers to cause a denial of service (NULL pointer dereference and application crash) via crafted use of \"declare(ticks=\" in a PHP script. NOTE: the vendor disputes the classification of this as a vulnerability, stating \"Please do not request CVEs for ordinary bugs. CVEs are relevant for security issues only.","status":"disputed","published":"2017-04-03T05:59:00.91Z","modified":"2026-06-17T01:22:21.27Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:03:44.86906Z"}],"osv":[{"id":"BELL-CVE-2017-6441","title":"CVE-2017-6441 does not affect BellSoft software","status":"withdrawn","published":"2017-04-03T05:59:00Z","modified":"2026-01-26T09:48:06.55554Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:14.137943Z"},{"id":"CVE-2017-6441","description":"The _zval_get_long_func_ex in Zend/zend_operators.c in PHP 7.1.2 allows attackers to cause a denial of service (NULL pointer dereference and application crash) via crafted use of \"declare(ticks=\" in a PHP script. NOTE: the vendor disputes the classification of this as a vulnerability, stating \"Please do not request CVEs for ordinary bugs. CVEs are relevant for security issues only.","status":"published","published":"2017-04-03T05:59:00.91Z","modified":"2026-10-20T10:48:20.553301697Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:06.029968Z"},{"id":"UBUNTU-CVE-2017-6441","description":"The _zval_get_long_func_ex in Zend/zend_operators.c in PHP 7.1.2 allows attackers to cause a denial of service (NULL pointer dereference and application crash) via crafted use of \"declare(ticks=\" in a PHP script. NOTE: the vendor disputes the classification of this as a vulnerability, stating \"Please do not request CVEs for ordinary bugs. CVEs are relevant for security issues only.","status":"published","published":"2017-04-03T05:59:00Z","modified":"2026-10-21T23:00:11.974352429Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:15.773974Z"},{"id":"SUSE-SU-2017:1717-1","title":"Security update for php7","description":"This update for php7 fixes the following security issues:\n\n- CVE-2017-9224: stack out-of-bounds read occurs in match_at() could lead to Denial of service (bsc#1040891)\n- CVE-2017-9226: heap out-of-bounds write orread occurs in next_state_val() could lead to Denial of service(bsc#1040889)\n- CVE-2017-9227: stack out-of-bounds read in mbc_enc_len() could lead to Denial of service (bsc#1040883)\n- CVE-2017-6441: The _zval_get_long_func_ex in Zend/zend_operators.c in PHP allowed attackers to cause a denial of service (NULL pointer dereference and application crash) via crafted use of 'declare(ticks=' in a PHP script (bsc#1032155).\n- CVE-2016-6294: The locale_accept_from_http function in ext/intl/locale/locale_methods.c did not properly restrict calls to the ICU uloc_acceptLanguageFromHTTP function, which allowed remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a call with a long argument (bsc#1035111).\n\n","status":"published","published":"2017-06-29T12:50:03Z","modified":"2025-05-02T04:05:27.414394Z","updated_at":"2026-11-02T15:53:44.209561Z"}]}}