Vulnerability in N/a
CVE-2018-7584
In PHP through 5.6.33, 7.0.x before 7.0.28, 7.1.x through 7.1.14, and 7.2.x through 7.2.2, there is a stack-based buffer under-read while parsing an HTTP response in the php_stream_url_wrap_http_ex function in ext/standard/http_fopen_wrapp…
EPSS: 0.831 (99.3th percentile) — read the EPSS interpretation.
Affected products
- N/a — versions n/a
Public proof-of-concept exploits
References
- USN-3600-1 (vendor-advisory, x_refsource_UBUNTU)
- DSA-4240 (vendor-advisory, x_refsource_DEBIAN)
- bugs.php.net/bug.php (x_refsource_CONFIRM)
- [debian-lts-announce] 20180329 [SECURITY] [DLA 1326-1] php5 security update (mailing-list, x_refsource_MLIST)
- www.tenable.com/security/tns-2018-12 (x_refsource_CONFIRM)
- www.tenable.com/security/tns-2018-03 (x_refsource_CONFIRM)
- 1041607 (vdb-entry, x_refsource_SECTRACK)
- github.com/php/php-src/commit/523f230c831d7b33353203fa34aee4e92ac12bba (x_refsource_CONFIRM)
- 44846 (exploit, x_refsource_EXPLOIT-DB)
- php.net/ChangeLog-7.php (x_refsource_CONFIRM)
Frequently asked questions
- What is CVE-2018-7584?
- CVE-2018-7584 is a vulnerability in N/a. Published 2018-03-01.
- Is CVE-2018-7584 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.