CVE catalog

CVE-2017-11144

php7.0 - security update

[CVE catalog]

Severity
Medium · CVSS 5.9CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
Updated
Source
[NVD] · [CVE record]
EPSS
6.16% · Oct 25, 2026

In PHP before 5.6.31, 7.x before 7.0.21, and 7.1.x before 7.1.7, the openssl extension PEM sealing code did not check the return value of the OpenSSL sealing function, which could lead to a crash of the PHP interpreter, related to an interpretation conflict for a negative number in ext/openssl/openssl.c, and an OpenSSL documentation omission.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Ubuntuphp514.045.5.3+dfsg-1ubuntu2vulnerable
Ubuntuphp514.045.5.3+dfsg-1ubuntu3vulnerable
Ubuntuphp514.045.5.6+dfsg-1ubuntu1vulnerable
Ubuntuphp514.045.5.6+dfsg-1ubuntu2vulnerable
Ubuntuphp514.045.5.8+dfsg-2ubuntu1vulnerable
Ubuntuphp514.045.5.9+dfsg-1ubuntu1vulnerable
Ubuntuphp514.045.5.9+dfsg-1ubuntu2vulnerable
Ubuntuphp514.045.5.9+dfsg-1ubuntu3vulnerable
Ubuntuphp514.045.5.9+dfsg-1ubuntu4vulnerable
Ubuntuphp514.045.5.9+dfsg-1ubuntu4.1vulnerable
Ubuntuphp514.045.5.9+dfsg-1ubuntu4.2vulnerable
Ubuntuphp514.045.5.9+dfsg-1ubuntu4.3vulnerable
Ubuntuphp514.045.5.9+dfsg-1ubuntu4.4vulnerable
Ubuntuphp514.045.5.9+dfsg-1ubuntu4.5vulnerable
Ubuntuphp514.045.5.9+dfsg-1ubuntu4.6vulnerable
Ubuntuphp514.045.5.9+dfsg-1ubuntu4.7vulnerable
Ubuntuphp514.045.5.9+dfsg-1ubuntu4.9vulnerable
Ubuntuphp514.045.5.9+dfsg-1ubuntu4.11vulnerable
Ubuntuphp514.045.5.9+dfsg-1ubuntu4.12vulnerable
Ubuntuphp514.045.5.9+dfsg-1ubuntu4.13vulnerable
Ubuntuphp514.045.5.9+dfsg-1ubuntu4.14vulnerable
Ubuntuphp514.045.5.9+dfsg-1ubuntu4.16vulnerable
Ubuntuphp514.045.5.9+dfsg-1ubuntu4.17vulnerable
Ubuntuphp514.045.5.9+dfsg-1ubuntu4.19vulnerable
Ubuntuphp514.045.5.9+dfsg-1ubuntu4.20vulnerable
Ubuntuphp514.045.5.9+dfsg-1ubuntu4.21vulnerable
Ubuntuphp514.045.5.9+dfsg-1ubuntu4.22fixed
Ubuntuphp7.016.047.0.1-5vulnerable
Ubuntuphp7.016.047.0.1-6vulnerable
Ubuntuphp7.016.047.0.2-1vulnerable
Ubuntuphp7.016.047.0.2-3vulnerable
Ubuntuphp7.016.047.0.2-4vulnerable
Ubuntuphp7.016.047.0.2-5vulnerable
Ubuntuphp7.016.047.0.3-2vulnerable
Ubuntuphp7.016.047.0.3-3vulnerable
Ubuntuphp7.016.047.0.3-9ubuntu1vulnerable
Ubuntuphp7.016.047.0.4-5ubuntu1vulnerable
Ubuntuphp7.016.047.0.4-5ubuntu2vulnerable
Ubuntuphp7.016.047.0.4-7ubuntu1vulnerable
Ubuntuphp7.016.047.0.4-7ubuntu2vulnerable
Ubuntuphp7.016.047.0.4-7ubuntu2.1vulnerable
Ubuntuphp7.016.047.0.8-0ubuntu0.16.04.1vulnerable
Ubuntuphp7.016.047.0.8-0ubuntu0.16.04.2vulnerable
Ubuntuphp7.016.047.0.8-0ubuntu0.16.04.3vulnerable
Ubuntuphp7.016.047.0.13-0ubuntu0.16.04.1vulnerable
Ubuntuphp7.016.047.0.15-0ubuntu0.16.04.1vulnerable
Ubuntuphp7.016.047.0.15-0ubuntu0.16.04.2vulnerable
Ubuntuphp7.016.047.0.15-0ubuntu0.16.04.4vulnerable
Ubuntuphp7.016.047.0.18-0ubuntu0.16.04.1vulnerable
Ubuntuphp7.016.047.0.22-0ubuntu0.16.04.1fixed
Debianphp7.097.0.19-1vulnerable
Debianphp7.097.0.20-1vulnerable
Debianphp7.097.0.20-2vulnerable
Debianphp7.097.0.22-1vulnerable
Debianphp7.097.0.22-2vulnerable
Debianphp7.097.0.22-3vulnerable
Debianphp7.097.0.25-1vulnerable
Debianphp7.097.0.26-1vulnerable
Debianphp7.097.0.27-0+deb9u1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Ubuntuphp5deb14.045.5.9+dfsg-1ubuntu4.22Not reportedUBUNTU-CVE-2017-11144Not reported
Ubuntuphp7.0deb16.047.0.22-0ubuntu0.16.04.1Not reportedUBUNTU-CVE-2017-11144Not reported
Debianphp7.0deb97.0.27-0+deb9u1Not reportedDSA-4080-1Not reported

OpenFactory catalog packages

No matching packages in this catalog.

Observed:

References

[FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]