CVE-2017-9120

CRITICAL

PHP 7.0.0-7.1.5 - Denial of Service via Integer Overflow in mysqli_real_escape_string

Title source: llm

Description

PHP 7.x through 7.1.5 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a long string because of an Integer overflow in mysqli_real_escape_string.

References (3)

Core 3

Core References

Third Party Advisory x_refsource_confirm

https://security.netapp.com/advisory/ntap-20181107-0003/

Exploit, Issue Tracking, Patch, Vendor Advisory x_refsource_misc

https://bugs.php.net/bug.php?id=74544

Third Party Advisory vendor-advisory x_refsource_redhat

https://access.redhat.com/errata/RHSA-2019:2519

Scores

CVSS v3 9.8

EPSS 0.0172

EPSS Percentile 82.7%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-190

Status published

Products (2)

netapp/storage_automation_store

php/php 7.0.0 - 7.1.5

Published Aug 02, 2018

Tracked Since Feb 18, 2026