CVE-2018-7584

Name of the Vulnerable Software and Affected Versions PHP versions 5.6.33 and earlier PHP versions 7.0.x through 7.0.27 PHP versions 7.1.x through 7.1.14 PHP versions 7.2.x through 7.2.2

Description The issue is caused by a stack-based buffer under-read in the php stream url wrap http ex function when parsing an HTTP response. This results in copying a large string. The vulnerability can be exploited by a remote attacker using a specially crafted HTTP response, potentially allowing them to execute arbitrary code or cause a denial of service.

Recommendations For PHP version 5.6.33 and earlier, update to a version later than 5.6.33. For PHP versions 7.0.x through 7.0.27, update to version 7.0.28 or later. For PHP versions 7.1.x through 7.1.14, update to a version later than 7.1.14. For PHP versions 7.2.x through 7.2.2, update to a version later than 7.2.2. As a temporary workaround, consider restricting access to the php stream url wrap http ex function until a patch is available.