{"id":"CVE-2017-7272","aliases":["DLA-875-1","EUVD-2017-16301","GHSA-943r-xvqq-r4rh","SUSE-SU-2017:1585-1","SUSE-SU-2017:1709-1","UBUNTU-CVE-2017-7272"],"status":"published","title":"PHP through 7.1.11 enables potential SSRF in applications that accept an fsockopen or pfsockopen...","description":"PHP through 7.1.11 enables potential SSRF in applications that accept an fsockopen or pfsockopen hostname argument with an expectation that the port number is constrained. Because a :port syntax is recognized, fsockopen will use the port number that is specified in the hostname argument, instead of the port number in the second argument of the function.","severity":{"version":"3.0","score":7.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.03514,"percentile":0.8929,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-918"],"published":"2017-03-27T17:00:00Z","modified":"2026-10-21T23:00:12Z","fixes":[{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"php53","fixed_in":["5.3.17-111.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"php53","fixed_in":["5.3.17-111.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"php53","fixed_in":["5.3.17-111.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:7","package":"php5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.45-0+deb7u8"}]}],"versions":["5.4.11-1","5.4.15-1","5.4.34-0+deb7u1","5.4.35-0+deb7u1","5.4.35-0+deb7u2","5.4.36-0+deb7u1","5.4.36-0+deb7u3","5.4.38-0+deb7u1","5.4.39-0+deb7u1","5.4.39-0+deb7u2","5.4.4-14","5.4.4-14+deb7u1","5.4.4-14+deb7u10","5.4.4-14+deb7u11","5.4.4-14+deb7u12","5.4.4-14+deb7u13","5.4.4-14+deb7u14","5.4.4-14+deb7u2","5.4.4-14+deb7u3","5.4.4-14+deb7u4","5.4.4-14+deb7u5","5.4.4-14+deb7u7","5.4.4-14+deb7u8","5.4.4-14+deb7u9","5.4.4-15","5.4.4-15.1","5.4.41-0+deb7u1","5.4.44-0+deb7u1","5.4.45-0+deb7u1","5.4.45-0+deb7u2","5.4.45-0+deb7u3","5.4.45-0+deb7u4","5.4.45-0+deb7u5","5.4.45-0+deb7u6","5.4.45-0+deb7u7","5.4.6-1","5.4.6-2","5.4.8-1","5.4.9-1","5.4.9-2","5.4.9-3","5.4.9-4"],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"php53","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.17-108.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"php53","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.17-108.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"php53","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.17-108.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"php53","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.17-111.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"php53","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.17-111.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"php53","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.17-111.2"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"php5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.5.3+dfsg-1ubuntu2","5.5.3+dfsg-1ubuntu3","5.5.6+dfsg-1ubuntu1","5.5.6+dfsg-1ubuntu2","5.5.8+dfsg-2ubuntu1","5.5.9+dfsg-1ubuntu1","5.5.9+dfsg-1ubuntu2","5.5.9+dfsg-1ubuntu3","5.5.9+dfsg-1ubuntu4","5.5.9+dfsg-1ubuntu4.1","5.5.9+dfsg-1ubuntu4.2","5.5.9+dfsg-1ubuntu4.3","5.5.9+dfsg-1ubuntu4.4","5.5.9+dfsg-1ubuntu4.5","5.5.9+dfsg-1ubuntu4.6","5.5.9+dfsg-1ubuntu4.7","5.5.9+dfsg-1ubuntu4.9","5.5.9+dfsg-1ubuntu4.11","5.5.9+dfsg-1ubuntu4.12","5.5.9+dfsg-1ubuntu4.13","5.5.9+dfsg-1ubuntu4.14","5.5.9+dfsg-1ubuntu4.16","5.5.9+dfsg-1ubuntu4.17","5.5.9+dfsg-1ubuntu4.19","5.5.9+dfsg-1ubuntu4.20","5.5.9+dfsg-1ubuntu4.21","5.5.9+dfsg-1ubuntu4.22","5.5.9+dfsg-1ubuntu4.23","5.5.9+dfsg-1ubuntu4.24","5.5.9+dfsg-1ubuntu4.25","5.5.9+dfsg-1ubuntu4.26","5.5.9+dfsg-1ubuntu4.27","5.5.9+dfsg-1ubuntu4.29","5.5.9+dfsg-1ubuntu4.29+esm1","5.5.9+dfsg-1ubuntu4.29+esm2","5.5.9+dfsg-1ubuntu4.29+esm3","5.5.9+dfsg-1ubuntu4.29+esm4","5.5.9+dfsg-1ubuntu4.29+esm5","5.5.9+dfsg-1ubuntu4.29+esm6","5.5.9+dfsg-1ubuntu4.29+esm8","5.5.9+dfsg-1ubuntu4.29+esm10","5.5.9+dfsg-1ubuntu4.29+esm11","5.5.9+dfsg-1ubuntu4.29+esm12","5.5.9+dfsg-1ubuntu4.29+esm13","5.5.9+dfsg-1ubuntu4.29+esm14","5.5.9+dfsg-1ubuntu4.29+esm15","5.5.9+dfsg-1ubuntu4.29+esm16","5.5.9+dfsg-1ubuntu4.29+esm17","5.5.9+dfsg-1ubuntu4.29+esm18"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"php7.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.0.1-5","7.0.1-6","7.0.2-1","7.0.2-3","7.0.2-4","7.0.2-5","7.0.3-2","7.0.3-3","7.0.3-9ubuntu1","7.0.4-5ubuntu1","7.0.4-5ubuntu2","7.0.4-7ubuntu1","7.0.4-7ubuntu2","7.0.4-7ubuntu2.1","7.0.8-0ubuntu0.16.04.1","7.0.8-0ubuntu0.16.04.2","7.0.8-0ubuntu0.16.04.3","7.0.13-0ubuntu0.16.04.1","7.0.15-0ubuntu0.16.04.1","7.0.15-0ubuntu0.16.04.2","7.0.15-0ubuntu0.16.04.4","7.0.18-0ubuntu0.16.04.1","7.0.22-0ubuntu0.16.04.1","7.0.25-0ubuntu0.16.04.1","7.0.28-0ubuntu0.16.04.1","7.0.30-0ubuntu0.16.04.1","7.0.32-0ubuntu0.16.04.1","7.0.33-0ubuntu0.16.04.1","7.0.33-0ubuntu0.16.04.2","7.0.33-0ubuntu0.16.04.3","7.0.33-0ubuntu0.16.04.4","7.0.33-0ubuntu0.16.04.5","7.0.33-0ubuntu0.16.04.6","7.0.33-0ubuntu0.16.04.7","7.0.33-0ubuntu0.16.04.9","7.0.33-0ubuntu0.16.04.11","7.0.33-0ubuntu0.16.04.12","7.0.33-0ubuntu0.16.04.14","7.0.33-0ubuntu0.16.04.15","7.0.33-0ubuntu0.16.04.16","7.0.33-0ubuntu0.16.04.16+esm1","7.0.33-0ubuntu0.16.04.16+esm2","7.0.33-0ubuntu0.16.04.16+esm3","7.0.33-0ubuntu0.16.04.16+esm4","7.0.33-0ubuntu0.16.04.16+esm5","7.0.33-0ubuntu0.16.04.16+esm6","7.0.33-0ubuntu0.16.04.16+esm7","7.0.33-0ubuntu0.16.04.16+esm8","7.0.33-0ubuntu0.16.04.16+esm9","7.0.33-0ubuntu0.16.04.16+esm10","7.0.33-0ubuntu0.16.04.16+esm11","7.0.33-0ubuntu0.16.04.16+esm12","7.0.33-0ubuntu0.16.04.16+esm13","7.0.33-0ubuntu0.16.04.16+esm14","7.0.33-0ubuntu0.16.04.16+esm15","7.0.33-0ubuntu0.16.04.16+esm16","7.0.33-0ubuntu0.16.04.16+esm17","7.0.33-0ubuntu0.16.04.16+esm18","7.0.33-0ubuntu0.16.04.16+esm19","7.0.33-0ubuntu0.16.04.16+esm20","7.0.33-0ubuntu0.16.04.16+esm21","7.0.33-0ubuntu0.16.04.16+esm22"]}],"products":[{"vendor":"php","product":"php"}],"references":[{"url":"http://www.securityfocus.com/bid/97178","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"http://www.securitytracker.com/id/1038158","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","web"]},{"url":"https://bugs.php.net/bug.php?id=75505","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://github.com/php/php-src/commit/bab0b99f376dac9170ac81382a5ed526938d595a","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix"]},{"url":"https://security.netapp.com/advisory/ntap-20180112-0001/","tags":["x_refsource_CONFIRM","x_transferred","advisory"]},{"url":"https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20170403-0_PHP_Misbehavior_of_fsockopen_function_v10.txt","tags":["x_refsource_MISC","x_transferred","advisory"]},{"url":"https://bugs.php.net/bug.php?id=74216","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Vendor Advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-7272"},{"url":"https://security.netapp.com/advisory/ntap-20180112-0001"},{"url":"https://github.com/advisories/GHSA-943r-xvqq-r4rh"},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20171585-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1031246","tags":["report"]},{"url":"https://bugzilla.suse.com/1035111","tags":["report"]},{"url":"https://bugzilla.suse.com/1040883","tags":["report"]},{"url":"https://bugzilla.suse.com/1040889","tags":["report"]},{"url":"https://bugzilla.suse.com/1040891","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6294","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7272","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9224","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9226","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9227","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20171709-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1044976","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-7272","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-7272","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2017-7272","description":"PHP through 7.1.11 enables potential SSRF in applications that accept an fsockopen or pfsockopen hostname argument with an expectation that the port number is constrained. Because a :port syntax is recognized, fsockopen will use the port number that is specified in the hostname argument, instead of the port number in the second argument of the function.","status":"published","published":"2017-03-27T17:00:00Z","modified":"2024-08-05T15:56:36.36Z","updated_at":"2026-11-02T14:33:20.843976Z"}],"euvd":[{"id":"EUVD-2017-16301","description":"PHP through 7.1.11 enables potential SSRF in applications that accept an fsockopen or pfsockopen hostname argument with an expectation that the port number is constrained. Because a :port syntax is recognized, fsockopen will use the port number that is specified in the hostname argument, instead of the port number in the second argument of the function.","status":"published","published":"2017-03-27T17:00:00Z","modified":"2024-08-05T15:56:36Z","updated_at":"2026-11-03T02:39:08.892902Z"}],"ghsa":[{"id":"GHSA-943r-xvqq-r4rh","title":"PHP through 7.1.11 enables potential SSRF in applications that accept an fsockopen or pfsockopen...","description":"PHP through 7.1.11 enables potential SSRF in applications that accept an fsockopen or pfsockopen hostname argument with an expectation that the port number is constrained. Because a :port syntax is recognized, fsockopen will use the port number that is specified in the hostname argument, instead of the port number in the second argument of the function.","status":"published","published":"2022-05-14T03:42:21Z","modified":"2025-04-20T03:35:54Z","cvss":[{"version":"3.0","score":7.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T15:01:43.480751Z"}],"nvd":[{"id":"CVE-2017-7272","description":"PHP through 7.1.11 enables potential SSRF in applications that accept an fsockopen or pfsockopen hostname argument with an expectation that the port number is constrained. Because a :port syntax is recognized, fsockopen will use the port number that is specified in the hostname argument, instead of the port number in the second argument of the function.","status":"published","published":"2017-03-27T17:59:00.977Z","modified":"2026-06-17T01:23:58.887Z","cvss":[{"version":"3.0","score":7.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:03:44.275273Z"}],"osv":[{"id":"CVE-2017-7272","description":"PHP through 7.1.11 enables potential SSRF in applications that accept an fsockopen or pfsockopen hostname argument with an expectation that the port number is constrained. Because a :port syntax is recognized, fsockopen will use the port number that is specified in the hostname argument, instead of the port number in the second argument of the function.","status":"published","published":"2017-03-27T17:59:00.977Z","modified":"2026-10-20T13:32:31.658305178Z","cvss":[{"version":"3.0","score":7.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:06.412595Z"},{"id":"UBUNTU-CVE-2017-7272","description":"PHP through 7.1.11 enables potential SSRF in applications that accept an fsockopen or pfsockopen hostname argument with an expectation that the port number is constrained. Because a :port syntax is recognized, fsockopen will use the port number that is specified in the hostname argument, instead of the port number in the second argument of the function.","status":"published","published":"2017-03-27T17:59:00Z","modified":"2026-10-21T23:00:12.844158141Z","cvss":[{"version":"3.0","score":7.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:54:15.773974Z"},{"id":"DLA-875-1","title":"php5 - security update","status":"published","published":"2017-03-28T00:00:00Z","modified":"2026-03-09T02:10:54.25152Z","updated_at":"2026-11-02T15:46:13.584509Z"},{"id":"SUSE-SU-2017:1585-1","title":"Security update for php53","description":"\nThis update for php53 fixes the following issues:\n\nThis security issue was fixed:\n\n- CVE-2017-7272: PHP enabled potential SSRF in applications that accept an fsockopen hostname argument with an expectation that the port number is constrained. Because a :port syntax was recognized, fsockopen used the port number that is specified in the hostname argument, instead of the port number in the second argument of the function (bsc#1031246)\n- CVE-2016-6294: The locale_accept_from_http function in ext/intl/locale/locale_methods.c did not properly restrict calls to the ICU uloc_acceptLanguageFromHTTP function, which allowed remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a call with a long argument (bsc#1035111).\n- CVE-2017-9227: An issue was discovered in Oniguruma 6.2.0, as used in mbstring in PHP. A stack out-of-bounds read occurs in mbc_enc_len() during regular expression searching. Invalid handling of reg-\u003edmin in forward_search_range() could result in an invalid pointer dereference, as an out-of-bounds read from a stack buffer. (bsc#1040883)\n- CVE-2017-9226: An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in mbstring in PHP. A heap out-of-bounds write or read occurs in next_state_val() during regular expression compilation. Octal numbers larger than 0xff are not handled correctly in fetch_token() and fetch_token_in_cc(). A malformed regular expression containing an octal number in the form of '\\700' would produce an invalid code point value larger than 0xff in next_state_val(), resulting in an out-of-bounds write memory corruption. (bsc#1040889)\n- CVE-2017-9224: An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in mbstring in PHP. A stack out-of-bounds read occurs in match_at() during regular expression searching. A logical error involving order of validation and access in match_at() could result in an out-of-bounds read from a stack buffer. (bsc#1040891)\n\n","status":"published","published":"2017-06-16T15:01:55Z","modified":"2026-02-04T03:17:18.323722Z","updated_at":"2026-11-02T15:53:43.83457Z"},{"id":"SUSE-SU-2017:1709-1","title":"Security update for php53","description":"This update for php53 fixes the following issues:\n\n- The fix for CVE-2017-7272 was reverted, as it caused regressions in the mysql server connect module.  [bsc#1044976]\n  The security fix tried to avoid a server side request forgery, and will be submitted when a better fix becomes available.\n","status":"published","published":"2017-06-28T12:43:50Z","modified":"2026-02-04T03:53:50.891406Z","updated_at":"2026-11-02T15:53:44.209561Z"}]}}