The _zval_get_long_func_ex in Zend/zend_operators.c in PHP 7.1.2 allows attackers to cause a denial of service (NULL pointer dereference and application crash) via crafted use of "declare(ticks=" in a PHP script. NOTE: the vendor disputes the classification of this as a vulnerability, stating "Please do not request CVEs for ordinary bugs. CVEs are relevant for security issues only.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The _zval_get_long_func_ex in Zend/zend_operators.c in PHP 7.1.2 allows attackers to cause a denial of     service (NULL pointer dereference and application crash) via crafted use of declare(ticks= in a PHP     script. NOTE: the vendor disputes the classification of this as a vulnerability, stating Please do not     request CVEs for ordinary bugs. CVEs are relevant for security issues only. (CVE-2017-6441)

Note that Nessus relies on the presence of the package as reported by the vendor.

This update for php7 fixes the following security issues :

  - CVE-2017-9224: stack out-of-bounds read occurs in     match_at() could lead to Denial of service (bsc#1040891)

  - CVE-2017-9226: heap out-of-bounds write orread occurs in     next_state_val() could lead to Denial of     service(bsc#1040889)

  - CVE-2017-9227: stack out-of-bounds read in mbc_enc_len()     could lead to Denial of service (bsc#1040883)

  - CVE-2017-6441: The _zval_get_long_func_ex in     Zend/zend_operators.c in PHP allowed attackers to cause     a denial of service (NULL pointer dereference and     application crash) via crafted use of 'declare(ticks='     in a PHP script (bsc#1032155).

  - CVE-2016-6294: The locale_accept_from_http function in     ext/intl/locale/locale_methods.c did not properly     restrict calls to the ICU uloc_acceptLanguageFromHTTP     function, which allowed remote attackers to cause a     denial of service (out-of-bounds read) or possibly have     unspecified other impact via a call with a long argument     (bsc#1035111).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for php7 fixes the following security issues :

  - CVE-2017-9224: stack out-of-bounds read occurs in     match_at() could lead to Denial of service (bsc#1040891)

  - CVE-2017-9226: heap out-of-bounds write orread occurs in     next_state_val() could lead to Denial of     service(bsc#1040889)

  - CVE-2017-9227: stack out-of-bounds read in mbc_enc_len()     could lead to Denial of service (bsc#1040883)

  - CVE-2017-6441: The _zval_get_long_func_ex in     Zend/zend_operators.c in PHP allowed attackers to cause     a denial of service (NULL pointer dereference and     application crash) via crafted use of 'declare(ticks='     in a PHP script (bsc#1032155).

  - CVE-2016-6294: The locale_accept_from_http function in     ext/intl/locale/locale_methods.c did not properly     restrict calls to the ICU uloc_acceptLanguageFromHTTP     function, which allowed remote attackers to cause a     denial of service (out-of-bounds read) or possibly have     unspecified other impact via a call with a long argument     (bsc#1035111).

This update was imported from the SUSE:SLE-12:Update update project.

ID	Name	Product	Family	Severity
253185	Linux Distros Unpatched Vulnerability : CVE-2017-6441	Nessus	Misc.	high
120000	SUSE SLES12 Security Update : php7 (SUSE-SU-2017:1717-1)	Nessus	SuSE Local Security Checks	critical
101287	openSUSE Security Update : php7 (openSUSE-2017-790)	Nessus	SuSE Local Security Checks	critical

Detections

Analytics

CVE-2017-6441

high

Tenable Plugins

high

critical

critical