CVE-2017-11145

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2017-11145
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2017-11145.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2017-11145
Downstream
Related
Published
2017-07-10T14:29:00.637Z
Modified
2026-07-08T23:28:11.646446Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
[none]
Details

In PHP before 5.6.31, 7.x before 7.0.21, and 7.1.x before 7.1.7, an error in the date extension's timelibmeridian parsing code could be used by attackers able to supply date strings to leak information from the interpreter, related to ext/date/lib/parsedate.c out-of-bounds reads affecting the phpparsedate function. NOTE: the correct fix is in the e8b7698f5ee757ce2c8bd10a192a491a498f891c commit, not the bd77ac90d3bdf31ce2a5251ad92e9e75 gist.

References

Affected packages

Git / github.com/php/php-src

Affected ranges

Type
GIT
Repo
https://github.com/php/php-src
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
195427c55481d9913ac9dd3fbcedf2f7c637e6de
Introduced
60fffd296abce5fc071f3c173c25a2696cf683c6
Last affected
5b34dc2d52841bfab425cbb24e9111172de20ef9
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "5.6.30"
        },
        {
            "introduced": "7.0.0"
        },
        {
            "last_affected": "7.0.0"
        },
        {
            "introduced": "7.0.1"
        },
        {
            "last_affected": "7.0.1"
        },
        {
            "introduced": "7.0.2"
        },
        {
            "last_affected": "7.0.2"
        },
        {
            "introduced": "7.0.3"
        },
        {
            "last_affected": "7.0.3"
        },
        {
            "introduced": "7.0.4"
        },
        {
            "last_affected": "7.0.4"
        },
        {
            "introduced": "7.0.5"
        },
        {
            "last_affected": "7.0.5"
        },
        {
            "introduced": "7.0.6"
        },
        {
            "last_affected": "7.0.6"
        },
        {
            "introduced": "7.0.7"
        },
        {
            "last_affected": "7.0.7"
        },
        {
            "introduced": "7.0.8"
        },
        {
            "last_affected": "7.0.8"
        },
        {
            "introduced": "7.0.9"
        },
        {
            "last_affected": "7.0.9"
        },
        {
            "introduced": "7.0.10"
        },
        {
            "last_affected": "7.0.10"
        },
        {
            "introduced": "7.0.11"
        },
        {
            "last_affected": "7.0.11"
        },
        {
            "introduced": "7.0.12"
        },
        {
            "last_affected": "7.0.12"
        },
        {
            "introduced": "7.0.13"
        },
        {
            "last_affected": "7.0.13"
        },
        {
            "introduced": "7.0.14"
        },
        {
            "last_affected": "7.0.14"
        },
        {
            "introduced": "7.0.15"
        },
        {
            "last_affected": "7.0.15"
        },
        {
            "introduced": "7.0.16"
        },
        {
            "last_affected": "7.0.16"
        },
        {
            "introduced": "7.0.17"
        },
        {
            "last_affected": "7.0.17"
        },
        {
            "introduced": "7.0.18"
        },
        {
            "last_affected": "7.0.18"
        },
        {
            "introduced": "7.0.19"
        },
        {
            "last_affected": "7.0.19"
        },
        {
            "introduced": "7.0.20"
        },
        {
            "last_affected": "7.0.20"
        },
        {
            "introduced": "7.1.0"
        },
        {
            "last_affected": "7.1.0"
        },
        {
            "introduced": "7.1.1"
        },
        {
            "last_affected": "7.1.1"
        },
        {
            "introduced": "7.1.2"
        },
        {
            "last_affected": "7.1.2"
        },
        {
            "introduced": "7.1.3"
        },
        {
            "last_affected": "7.1.3"
        },
        {
            "introduced": "7.1.4"
        },
        {
            "last_affected": "7.1.4"
        },
        {
            "introduced": "7.1.5"
        },
        {
            "last_affected": "7.1.5"
        },
        {
            "introduced": "7.1.6"
        },
        {
            "last_affected": "7.1.6"
        }
    ],
    "cpe": [
        "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:php:php:7.0.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:php:php:7.0.1:*:*:*:*:*:*:*",
        "cpe:2.3:a:php:php:7.0.2:*:*:*:*:*:*:*",
        "cpe:2.3:a:php:php:7.0.3:*:*:*:*:*:*:*",
        "cpe:2.3:a:php:php:7.0.4:*:*:*:*:*:*:*",
        "cpe:2.3:a:php:php:7.0.5:*:*:*:*:*:*:*",
        "cpe:2.3:a:php:php:7.0.6:*:*:*:*:*:*:*",
        "cpe:2.3:a:php:php:7.0.7:*:*:*:*:*:*:*",
        "cpe:2.3:a:php:php:7.0.8:*:*:*:*:*:*:*",
        "cpe:2.3:a:php:php:7.0.9:*:*:*:*:*:*:*",
        "cpe:2.3:a:php:php:7.0.10:*:*:*:*:*:*:*",
        "cpe:2.3:a:php:php:7.0.11:*:*:*:*:*:*:*",
        "cpe:2.3:a:php:php:7.0.12:*:*:*:*:*:*:*",
        "cpe:2.3:a:php:php:7.0.13:*:*:*:*:*:*:*",
        "cpe:2.3:a:php:php:7.0.14:*:*:*:*:*:*:*",
        "cpe:2.3:a:php:php:7.0.15:*:*:*:*:*:*:*",
        "cpe:2.3:a:php:php:7.0.16:*:*:*:*:*:*:*",
        "cpe:2.3:a:php:php:7.0.17:*:*:*:*:*:*:*",
        "cpe:2.3:a:php:php:7.0.18:*:*:*:*:*:*:*",
        "cpe:2.3:a:php:php:7.0.19:*:*:*:*:*:*:*",
        "cpe:2.3:a:php:php:7.0.20:*:*:*:*:*:*:*",
        "cpe:2.3:a:php:php:7.1.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:php:php:7.1.1:*:*:*:*:*:*:*",
        "cpe:2.3:a:php:php:7.1.2:*:*:*:*:*:*:*",
        "cpe:2.3:a:php:php:7.1.3:*:*:*:*:*:*:*",
        "cpe:2.3:a:php:php:7.1.4:*:*:*:*:*:*:*",
        "cpe:2.3:a:php:php:7.1.5:*:*:*:*:*:*:*",
        "cpe:2.3:a:php:php:7.1.6:*:*:*:*:*:*:*"
    ],
    "source": [
        "CPE_RANGE",
        "CPE_STRING"
    ]
}

Affected versions

7.*
7.0.0
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
7.1.0
7.1.1
7.1.2
7.1.3
7.1.4
7.1.5
7.1.6
Other
POST_64BIT_BRANCH_MERGE
POST_AST_MERGE
POST_PHP7_NSAPI_REMOVAL
POST_PHP7_REMOVALS
POST_PHPNG_MERGE
PRE_64BIT_BRANCH_MERGE
PRE_AST_MERGE
PRE_PHP7_EREG_MYSQL_REMOVALS
PRE_PHP7_NSAPI_REMOVAL
PRE_PHP7_REMOVALS
php-5.*
php-5.6.30
php-5.6.30RC1
php-7.*
php-7.1.6
php-7.1.6RC1

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2017-11145.json"