CVE-2017-8923 is a critical vulnerability affecting PHP versions through 7.1.5, specifically within the zend_string_extend function. Attackers can exploit this by manipulating string objects to create negative lengths, leading to a denial of service (application crash) or potentially other unspecified impacts. With a CVSS score of 9.8, this vulnerability is easily exploitable over the network with no user interaction, posing a high risk to confidentiality, integrity, and availability. Despite its severity, there is no known active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 7.4.24CPE matchmatch criteria | cpe:2.3:a:php:php:*:*:*:*:*:*:*:* | ||
>= 8.0.0, < 8.0.11CPE matchmatch criteria | cpe:2.3:a:php:php:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
php: Overflowing the length of string causes crash
May 12, 2017The zend_string_extend function in Zend/zend_string.h in PHP through 7.1.5 does not prevent changes to string objects that result in a negative length, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact by leveraging a script's use of .= with a long string.
May 9, 2017