The GNU Multiple Precision Arithmetic Library (GMP) interfaces for PHP through 7.1.4 allow attackers to cause a denial of service (memory consumption and application crash) via operations on long strings. NOTE: the vendor disputes this, stating "There is no security issue here, because GMP safely aborts in case of an OOM condition. The only attack vector here is denial of service. However, if you allow attacker-controlled, unbounded allocations you have a DoS vector regardless of GMP's OOM behavior.
References
| Link | Resource |
|---|---|
| https://bugs.php.net/bug.php?id=74308 | Issue Tracking Vendor Advisory |
| https://bugs.php.net/bug.php?id=74308 | Issue Tracking Vendor Advisory |
Configurations
History
21 Nov 2024, 03:33
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://bugs.php.net/bug.php?id=74308 - Issue Tracking, Vendor Advisory |
07 Nov 2023, 02:50
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | The GNU Multiple Precision Arithmetic Library (GMP) interfaces for PHP through 7.1.4 allow attackers to cause a denial of service (memory consumption and application crash) via operations on long strings. NOTE: the vendor disputes this, stating "There is no security issue here, because GMP safely aborts in case of an OOM condition. The only attack vector here is denial of service. However, if you allow attacker-controlled, unbounded allocations you have a DoS vector regardless of GMP's OOM behavior. |
Information
Published : 2017-04-19 15:59
Updated : 2024-11-21 03:33
NVD link : CVE-2017-7963
Mitre link : CVE-2017-7963
CVE.ORG link : CVE-2017-7963
JSON object : View
Products Affected
php
- php
CWE
CWE-770
Allocation of Resources Without Limits or Throttling