CVE-2017-16642

HIGH

PHP <5.6.32, 7.x <7.0.25, 7.1.x <7.1.11 - Info Disclosure

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2017-16642. PoCs published by Wei Lei and Liu Yang.

AI-analyzed exploit summary This exploit demonstrates a heap out-of-bounds read vulnerability in PHP's timelib_meridian() function, triggered via wddx_deserialize() with malformed input. The PoC causes a crash due to a heap-buffer-overflow, as confirmed by AddressSanitizer.

Description

In PHP before 5.6.32, 7.x before 7.0.25, and 7.1.x before 7.1.11, an error in the date extension's timelib_meridian handling of 'front of' and 'back of' directives could be used by attackers able to supply date strings to leak information from the interpreter, related to ext/date/lib/parse_date.c out-of-bounds reads affecting the php_parse_date function. NOTE: this is a different issue than CVE-2017-11145.

Exploits (1)

exploitdb WORKING POC VERIFIED
by Wei Lei and Liu Yang · phpdosmultiple
https://www.exploit-db.com/exploits/43133

This exploit demonstrates a heap out-of-bounds read vulnerability in PHP's timelib_meridian() function, triggered via wddx_deserialize() with malformed input. The PoC causes a crash due to a heap-buffer-overflow, as confirmed by AddressSanitizer.

Classification
Working Poc 100%
Attack Type
Dos
Complexity
Trivial
Reliability
Reliable
Target: PHP 7.1.8 with WDDX extension enabled
No auth needed
Prerequisites: PHP 7.1.8 with WDDX extension loaded · Ability to provide malformed WDDX input
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (13)

Core 13
Core References
Third Party Advisory x_refsource_confirm
https://security.netapp.com/advisory/ntap-20181123-0001/
Exploit, Issue Tracking, Third Party Advisory, VDB Entry exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/43133/
Issue Tracking, Vendor Advisory x_refsource_confirm
https://bugs.php.net/bug.php?id=75055
Third Party Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2018:1296
Issue Tracking, Release Notes, Vendor Advisory x_refsource_confirm
http://php.net/ChangeLog-5.php
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/101745
Third Party Advisory vendor-advisory x_refsource_debian
https://www.debian.org/security/2018/dsa-4081
Third Party Advisory vendor-advisory x_refsource_debian
https://www.debian.org/security/2018/dsa-4080
Third Party Advisory vendor-advisory x_refsource_ubuntu
https://usn.ubuntu.com/3566-1/
Issue Tracking, Release Notes, Vendor Advisory x_refsource_confirm
http://php.net/ChangeLog-7.php
Vendor Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2019:2519

Scores

CVSS v3 7.5
EPSS 0.2637
EPSS Percentile 97.7%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Details

CWE
CWE-125
Status published
Products (6)
canonical/ubuntu_linux 14.04
debian/debian_linux 8.0
debian/debian_linux 9.0
netapp/clustered_data_ontap
netapp/storage_automation_store
php/php < 5.6.32
Published Nov 07, 2017
Tracked Since Feb 18, 2026