PublicDateAtUSN: 2017-07-10
Candidate: CVE-2017-11144
PublicDate: 2017-07-10 14:29:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11144
 http://openwall.com/lists/oss-security/2017/07/10/6
 http://php.net/ChangeLog-5.php
 http://php.net/ChangeLog-7.php
 https://ubuntu.com/security/notices/USN-3382-1
 https://ubuntu.com/security/notices/USN-3382-2
Description:
 In PHP before 5.6.31, 7.x before 7.0.21, and 7.1.x before 7.1.7, the
 openssl extension PEM sealing code did not check the return value of the
 OpenSSL sealing function, which could lead to a crash of the PHP
 interpreter, related to an interpretation conflict for a negative number in
 ext/openssl/openssl.c, and an OpenSSL documentation omission.
Ubuntu-Description:
Notes:
Bugs:
 https://bugs.php.net/bug.php?id=74651
Priority: medium
Discovered-by: Sebastian Li, Wei Lei, Xie Xiaofei, and Liu Yang
Assigned-to:
CVSS:
 nvd: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H [7.5 HIGH]

Patches_php5:
 upstream: https://github.com/php/php-src/commit/89637c6b41b510c20d262c17483f582f115c66d6
upstream_php5: released (5.6.31)
precise/esm_php5: released (5.3.10-1ubuntu3.28)
trusty_php5: released (5.5.9+dfsg-1ubuntu4.22)
trusty/esm_php5: released (5.5.9+dfsg-1ubuntu4.22)
vivid/ubuntu-core_php5: DNE
xenial_php5: DNE
yakkety_php5: DNE
zesty_php5: DNE
artful_php5: DNE
devel_php5: DNE

Patches_php7.0:
 upstream: https://github.com/php/php-src/commit/73cabfedf519298e1a11192699f44d53c529315e
upstream_php7.0: released (7.0.21)
precise/esm_php7.0: DNE
trusty_php7.0: DNE
trusty/esm_php7.0: DNE
vivid/ubuntu-core_php7.0: DNE
xenial_php7.0: released (7.0.22-0ubuntu0.16.04.1)
esm-infra/xenial_php7.0: released (7.0.22-0ubuntu0.16.04.1)
yakkety_php7.0: ignored (reached end-of-life)
zesty_php7.0: released (7.0.22-0ubuntu0.17.04.1)
artful_php7.0: DNE
devel_php7.0: DNE

Patches_php7.1:
 upstream: https://github.com/php/php-src/commit/73cabfedf519298e1a11192699f44d53c529315e
upstream_php7.1: released (7.1.7)
precise/esm_php7.1: DNE
trusty_php7.1: DNE
trusty/esm_php7.1: DNE
vivid/ubuntu-core_php7.1: DNE
xenial_php7.1: DNE
yakkety_php7.1: DNE
zesty_php7.1: DNE
artful_php7.1: released (7.1.8-1ubuntu1)
devel_php7.1: released (7.1.8-1ubuntu1)