CVE-2017-8923 | BDVDB-2026-85454 Detail

Description#

The zend_string_extend function in Zend/zend_string.h in PHP through 7.1.5 does not prevent changes to string objects that result in a negative length, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact by leveraging a script's use of .= with a long string.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

http://www.securityfocus.com/bid/98518
https://bugs.php.net/bug.php?id=74577
https://security.netapp.com/advisory/ntap-20241227-0007/

Exploit#

No public exploit known

History#

Version 12017-05-12Record published in the CVE List.
Version 22024-12-27Most recent update recorded in the CVE List.