CVE编号
CVE-2017-6441利用情况
暂无补丁情况
官方补丁披露时间
2017-04-03漏洞描述
PHP（PHP：Hypertext Preprocessor，PHP：超文本预处理器）是PHP Group和开放源代码社区共同维护的一种开源的通用计算机脚本语言。该语言支持多重语法、支持多数据库及操作系统和支持C、C++进行程序扩展等。PHP 7.1.2版本中Zend/zend_operators.c文件中的_zval_get_long_func_ex函数存在拒绝服务漏洞，允许攻击者通过在PHP脚本中的“ticks =”来引发拒绝服务（NULL指针解除引用和应用程序崩溃）。
解决建议
目前厂商已经发布了升级补丁以修复此安全问题，补丁获取链接:https://github.com/php/php-src/pull/2396
参考链接 |
|
|---|---|
| https://bugs.php.net/bug.php?id=74146 | |
| https://github.com/php/php-src/pull/2396 |
受影响软件情况
| # | 类型 | 厂商 | 产品 | 版本 | 影响面 | ||||
| 1 | |||||||||
|---|---|---|---|---|---|---|---|---|---|
| 运行在以下环境 | |||||||||
| 应用 | php | php | 7.1.2 | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | opensuse_Leap_42.2 | apache2-mod_php7 | * |
Up to (excluding) 7.0.7-14.6.1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | opensuse_Leap_42.2 | php7 | * |
Up to (excluding) 7.0.7-14.6.1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | opensuse_Leap_42.2 | php7-bcmath | * |
Up to (excluding) 7.0.7-14.6.1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | opensuse_Leap_42.2 | php7-bz2 | * |
Up to (excluding) 7.0.7-14.6.1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | opensuse_Leap_42.2 | php7-calendar | * |
Up to (excluding) 7.0.7-14.6.1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | opensuse_Leap_42.2 | php7-ctype | * |
Up to (excluding) 7.0.7-14.6.1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | opensuse_Leap_42.2 | php7-dba | * |
Up to (excluding) 7.0.7-14.6.1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | opensuse_Leap_42.2 | php7-dom | * |
Up to (excluding) 7.0.7-14.6.1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | opensuse_Leap_42.2 | php7-enchant | * |
Up to (excluding) 7.0.7-14.6.1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | opensuse_Leap_42.2 | php7-exif | * |
Up to (excluding) 7.0.7-14.6.1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | opensuse_Leap_42.2 | php7-fileinfo | * |
Up to (excluding) 7.0.7-14.6.1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | opensuse_Leap_42.2 | php7-firebird | * |
Up to (excluding) 7.0.7-14.6.1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | opensuse_Leap_42.2 | php7-fpm | * |
Up to (excluding) 7.0.7-14.6.1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | opensuse_Leap_42.2 | php7-ftp | * |
Up to (excluding) 7.0.7-14.6.1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | opensuse_Leap_42.2 | php7-gd | * |
Up to (excluding) 7.0.7-14.6.1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | opensuse_Leap_42.2 | php7-gettext | * |
Up to (excluding) 7.0.7-14.6.1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | opensuse_Leap_42.2 | php7-gmp | * |
Up to (excluding) 7.0.7-14.6.1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | opensuse_Leap_42.2 | php7-iconv | * |
Up to (excluding) 7.0.7-14.6.1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | opensuse_Leap_42.2 | php7-imap | * |
Up to (excluding) 7.0.7-14.6.1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | opensuse_Leap_42.2 | php7-intl | * |
Up to (excluding) 7.0.7-14.6.1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | opensuse_Leap_42.2 | php7-json | * |
Up to (excluding) 7.0.7-14.6.1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | opensuse_Leap_42.2 | php7-ldap | * |
Up to (excluding) 7.0.7-14.6.1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | opensuse_Leap_42.2 | php7-odbc | * |
Up to (excluding) 7.0.7-14.6.1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | opensuse_Leap_42.2 | php7-opcache | * |
Up to (excluding) 7.0.7-14.6.1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | opensuse_Leap_42.2 | php7-pcntl | * |
Up to (excluding) 7.0.7-14.6.1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | opensuse_Leap_42.2 | php7-pdo | * |
Up to (excluding) 7.0.7-14.6.1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | opensuse_Leap_42.2 | php7-pear-Archive_Tar | * |
Up to (excluding) 7.0.7-14.6.1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | opensuse_Leap_42.2 | php7-pgsql | * |
Up to (excluding) 7.0.7-14.6.1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | opensuse_Leap_42.2 | php7-phar | * |
Up to (excluding) 7.0.7-14.6.1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | opensuse_Leap_42.2 | php7-posix | * |
Up to (excluding) 7.0.7-14.6.1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | opensuse_Leap_42.2 | php7-pspell | * |
Up to (excluding) 7.0.7-14.6.1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | opensuse_Leap_42.2 | php7-readline | * |
Up to (excluding) 7.0.7-14.6.1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | opensuse_Leap_42.2 | php7-shmop | * |
Up to (excluding) 7.0.7-14.6.1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | opensuse_Leap_42.2 | php7-snmp | * |
Up to (excluding) 7.0.7-14.6.1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | opensuse_Leap_42.2 | php7-sqlite | * |
Up to (excluding) 7.0.7-14.6.1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | opensuse_Leap_42.2 | php7-sysvsem | * |
Up to (excluding) 7.0.7-14.6.1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | opensuse_Leap_42.2 | php7-sysvshm | * |
Up to (excluding) 7.0.7-14.6.1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | opensuse_Leap_42.2 | php7-tokenizer | * |
Up to (excluding) 7.0.7-14.6.1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | opensuse_Leap_42.2 | php7-wddx | * |
Up to (excluding) 7.0.7-14.6.1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | opensuse_Leap_42.2 | php7-xmlreader | * |
Up to (excluding) 7.0.7-14.6.1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | opensuse_Leap_42.2 | php7-xmlrpc | * |
Up to (excluding) 7.0.7-14.6.1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | opensuse_Leap_42.2 | php7-xmlwriter | * |
Up to (excluding) 7.0.7-14.6.1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | opensuse_Leap_42.2 | php7-xsl | * |
Up to (excluding) 7.0.7-14.6.1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | opensuse_Leap_42.2 | php7-zip | * |
Up to (excluding) 7.0.7-14.6.1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | opensuse_Leap_42.2 | php7-zlib | * |
Up to (excluding) 7.0.7-14.6.1 |
|||||
- 攻击路径 远程
- 攻击复杂度 复杂
- 权限要求 无需权限
- 影响范围 有限影响
- EXP成熟度 未验证
- 补丁情况 官方补丁
- 数据保密性 无影响
- 数据完整性 无影响
- 服务器危害 无影响
- 全网数量 100
还没有评论，来说两句吧...