Vulnerability Details : CVE-2018-7584

In PHP through 5.6.33, 7.0.x before 7.0.28, 7.1.x through 7.1.14, and 7.2.x through 7.2.2, there is a stack-based buffer under-read while parsing an HTTP response in the php_stream_url_wrap_http_ex function in ext/standard/http_fopen_wrapper.c. This subsequently results in copying a large string.

Vulnerability category: Overflow

Published 2018-03-01 19:29:00

Updated 2019-08-19 11:15:15

Source MITRE

View at NVD, CVE.org

Threat overview for CVE-2018-7584

Top countries where our scanners detected CVE-2018-7584

Top open port discovered on systems with this issue 80

IPs affected by CVE-2018-7584 87,339

Threat actors abusing to this issue? Yes

Find out if you^* are affected by CVE-2018-7584!

^*Directly or indirectly through your vendors, service providers and 3rd parties. Powered by attack surface intelligence from SecurityScorecard.

Exploit prediction scoring system (EPSS) score for CVE-2018-7584

Probability of exploitation activity in the next 30 days: 79.89%

Percentile, the proportion of vulnerabilities that are scored at or less: ~ 98 % EPSS Score History EPSS FAQ

CVSS scores for CVE-2018-7584

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Source
7.5	HIGH	AV:N/AC:L/Au:N/C:P/I:P/A:P	10.0	6.4	nvd@nist.gov
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial
9.8	CRITICAL	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9	nvd@nist.gov
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2018-7584

CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2018-7584

https://www.debian.org/security/2018/dsa-4240

Debian -- Security Information -- DSA-4240-1 php7.0
Third Party Advisory

CVEs referencing this url
https://usn.ubuntu.com/3600-2/

USN-3600-2: PHP vulnerabilities | Ubuntu security notices
Third Party Advisory

CVEs referencing this url
https://lists.debian.org/debian-lts-announce/2018/03/msg00030.html

[SECURITY] [DLA 1326-1] php5 security update
Mailing List;Third Party Advisory
http://www.securityfocus.com/bid/103204

PHP CVE-2018-7584 Stack Buffer Overflow Vulnerability
Third Party Advisory;VDB Entry
https://access.redhat.com/errata/RHSA-2019:2519

RHSA-2019:2519 - Security Advisory - Red Hat Customer Portal

CVEs referencing this url
https://bugs.php.net/bug.php?id=75981

PHP :: Sec Bug #75981 :: stack-buffer-overflow while parsing HTTP response
Issue Tracking
http://www.securitytracker.com/id/1041607

QNAP Storage Devices PHP Buffer Error Lets Remote Users Deny Service - SecurityTracker
Third Party Advisory;VDB Entry
https://github.com/php/php-src/commit/523f230c831d7b33353203fa34aee4e92ac12bba

Fix bug #75981: prevent reading beyond buffer start · php/php-src@523f230 · GitHub
Patch
https://usn.ubuntu.com/3600-1/

USN-3600-1: PHP vulnerabilities | Ubuntu security notices
Third Party Advisory

CVEs referencing this url
https://www.exploit-db.com/exploits/44846/

PHP 7.2.2 - 'php_stream_url_wrap_http_ex' Buffer Overflow
Exploit;Third Party Advisory;VDB Entry
https://www.tenable.com/security/tns-2018-03

[R2] SecurityCenter 5.6.2.1 Fixes One Third-party Vulnerability - Security Advisory | Tenable®
Third Party Advisory
http://php.net/ChangeLog-7.php

PHP: PHP 7 ChangeLog
Release Notes

CVEs referencing this url
https://www.tenable.com/security/tns-2018-12

[R1] SecurityCenter 5.7.1 Fixes Multiple Third-Party Vulnerabilities - Security Advisory | Tenable®
Third Party Advisory

CVEs referencing this url
https://lists.debian.org/debian-lts-announce/2018/06/msg00005.html

[SECURITY] [DLA 1397-1] php5 security update
Mailing List;Third Party Advisory

CVEs referencing this url

Products affected by CVE-2018-7584

Debian » Debian Linux » Version: 7.0
cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*
Matching versions
Debian » Debian Linux » Version: 8.0
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
Matching versions
Debian » Debian Linux » Version: 9.0
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
Matching versions
PHP » PHP
Versions from including (>=) 7.2.0 and up to, including, (<=) 7.2.2
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Matching versions
PHP » PHP
Versions up to, including, (<=) 5.6.33
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Matching versions
PHP » PHP
Versions from including (>=) 7.1.0 and up to, including, (<=) 7.1.14
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Matching versions
PHP » PHP
Versions from including (>=) 7.0.0 and before (<) 7.0.28
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Matching versions
Canonical » Ubuntu Linux » Version: 14.04 LTS Edition
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
Matching versions
Canonical » Ubuntu Linux » Version: 12.04 ESM Edition
cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*
Matching versions
Canonical » Ubuntu Linux » Version: 16.04 LTS Edition
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
Matching versions
Canonical » Ubuntu Linux » Version: 17.10
cpe:2.3:o:canonical:ubuntu_linux:17.10:*:*:*:*:*:*:*
Matching versions