CVE catalog

CVE-2017-8923

UBUNTU-CVE-2017-8923

[CVE catalog]

Severity
Medium · CVSS 5.3CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Published
Updated
Source
[NVD] · [CVE record]
EPSS
7.19% · Oct 25, 2026

The zend_string_extend function in Zend/zend_string.h in PHP through 7.1.5 does not prevent changes to string objects that result in a negative length, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact by leveraging a script's use of .= with a long string.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Ubuntuphp5pro5.5.3+dfsg-1ubuntu2vulnerable
Ubuntuphp5pro5.5.3+dfsg-1ubuntu3vulnerable
Ubuntuphp5pro5.5.6+dfsg-1ubuntu1vulnerable
Ubuntuphp5pro5.5.6+dfsg-1ubuntu2vulnerable
Ubuntuphp5pro5.5.8+dfsg-2ubuntu1vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu1vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu2vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu3vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.1vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.2vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.3vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.4vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.5vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.6vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.7vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.9vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.11vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.12vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.13vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.14vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.16vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.17vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.19vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.20vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.21vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.22vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.23vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.24vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.25vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.26vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.27vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.29vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.29+esm1vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.29+esm2vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.29+esm3vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.29+esm4vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.29+esm5vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.29+esm6vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.29+esm8vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.29+esm10vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.29+esm11vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.29+esm12vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.29+esm13vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.29+esm14vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.29+esm15vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.29+esm16vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.29+esm17vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.29+esm18vulnerable
Ubuntuphp7.0pro7.0.1-5vulnerable
Ubuntuphp7.0pro7.0.1-6vulnerable
Ubuntuphp7.0pro7.0.2-1vulnerable
Ubuntuphp7.0pro7.0.2-3vulnerable
Ubuntuphp7.0pro7.0.2-4vulnerable
Ubuntuphp7.0pro7.0.2-5vulnerable
Ubuntuphp7.0pro7.0.3-2vulnerable
Ubuntuphp7.0pro7.0.3-3vulnerable
Ubuntuphp7.0pro7.0.3-9ubuntu1vulnerable
Ubuntuphp7.0pro7.0.4-5ubuntu1vulnerable
Ubuntuphp7.0pro7.0.4-5ubuntu2vulnerable
Ubuntuphp7.0pro7.0.4-7ubuntu1vulnerable
Ubuntuphp7.0pro7.0.4-7ubuntu2vulnerable
Ubuntuphp7.0pro7.0.4-7ubuntu2.1vulnerable
Ubuntuphp7.0pro7.0.8-0ubuntu0.16.04.1vulnerable
Ubuntuphp7.0pro7.0.8-0ubuntu0.16.04.2vulnerable
Ubuntuphp7.0pro7.0.8-0ubuntu0.16.04.3vulnerable
Ubuntuphp7.0pro7.0.13-0ubuntu0.16.04.1vulnerable
Ubuntuphp7.0pro7.0.15-0ubuntu0.16.04.1vulnerable
Ubuntuphp7.0pro7.0.15-0ubuntu0.16.04.2vulnerable
Ubuntuphp7.0pro7.0.15-0ubuntu0.16.04.4vulnerable
Ubuntuphp7.0pro7.0.18-0ubuntu0.16.04.1vulnerable
Ubuntuphp7.0pro7.0.22-0ubuntu0.16.04.1vulnerable
Ubuntuphp7.0pro7.0.25-0ubuntu0.16.04.1vulnerable
Ubuntuphp7.0pro7.0.28-0ubuntu0.16.04.1vulnerable
Ubuntuphp7.0pro7.0.30-0ubuntu0.16.04.1vulnerable
Ubuntuphp7.0pro7.0.32-0ubuntu0.16.04.1vulnerable
Ubuntuphp7.0pro7.0.33-0ubuntu0.16.04.1vulnerable
Ubuntuphp7.0pro7.0.33-0ubuntu0.16.04.2vulnerable
Ubuntuphp7.0pro7.0.33-0ubuntu0.16.04.3vulnerable
Ubuntuphp7.0pro7.0.33-0ubuntu0.16.04.4vulnerable
Ubuntuphp7.0pro7.0.33-0ubuntu0.16.04.5vulnerable
Ubuntuphp7.0pro7.0.33-0ubuntu0.16.04.6vulnerable
Ubuntuphp7.0pro7.0.33-0ubuntu0.16.04.7vulnerable
Ubuntuphp7.0pro7.0.33-0ubuntu0.16.04.9vulnerable
Ubuntuphp7.0pro7.0.33-0ubuntu0.16.04.11vulnerable
Ubuntuphp7.0pro7.0.33-0ubuntu0.16.04.12vulnerable
Ubuntuphp7.0pro7.0.33-0ubuntu0.16.04.14vulnerable
Ubuntuphp7.0pro7.0.33-0ubuntu0.16.04.15vulnerable
Ubuntuphp7.0pro7.0.33-0ubuntu0.16.04.16vulnerable
Ubuntuphp7.0pro7.0.33-0ubuntu0.16.04.16+esm1vulnerable
Ubuntuphp7.0pro7.0.33-0ubuntu0.16.04.16+esm2vulnerable
Ubuntuphp7.0pro7.0.33-0ubuntu0.16.04.16+esm3fixed
Ubuntuphp7.218.047.2.1-1ubuntu2vulnerable
Ubuntuphp7.218.047.2.2-1ubuntu1vulnerable
Ubuntuphp7.218.047.2.2-1ubuntu2vulnerable
Ubuntuphp7.218.047.2.3-1ubuntu1vulnerable
Ubuntuphp7.218.047.2.5-0ubuntu0.18.04.1vulnerable
Ubuntuphp7.218.047.2.7-0ubuntu0.18.04.1vulnerable
Ubuntuphp7.218.047.2.7-0ubuntu0.18.04.2vulnerable
Ubuntuphp7.218.047.2.10-0ubuntu0.18.04.1vulnerable
Ubuntuphp7.218.047.2.15-0ubuntu0.18.04.1vulnerable
Ubuntuphp7.218.047.2.15-0ubuntu0.18.04.2vulnerable
Ubuntuphp7.218.047.2.17-0ubuntu0.18.04.1vulnerable
Ubuntuphp7.218.047.2.19-0ubuntu0.18.04.1vulnerable
Ubuntuphp7.218.047.2.19-0ubuntu0.18.04.2vulnerable
Ubuntuphp7.218.047.2.24-0ubuntu0.18.04.1vulnerable
Ubuntuphp7.218.047.2.24-0ubuntu0.18.04.2vulnerable
Ubuntuphp7.218.047.2.24-0ubuntu0.18.04.3vulnerable
Ubuntuphp7.218.047.2.24-0ubuntu0.18.04.4vulnerable
Ubuntuphp7.218.047.2.24-0ubuntu0.18.04.6vulnerable
Ubuntuphp7.218.047.2.24-0ubuntu0.18.04.7vulnerable
Ubuntuphp7.218.047.2.24-0ubuntu0.18.04.8vulnerable
Ubuntuphp7.218.047.2.24-0ubuntu0.18.04.9vulnerable
Ubuntuphp7.218.047.2.24-0ubuntu0.18.04.10vulnerable
Ubuntuphp7.218.047.2.24-0ubuntu0.18.04.11fixed
Ubuntuphp7.420.047.4.3-4build1vulnerable
Ubuntuphp7.420.047.4.3-4build2vulnerable
Ubuntuphp7.420.047.4.3-4ubuntu1vulnerable
Ubuntuphp7.420.047.4.3-4ubuntu1.1vulnerable
Ubuntuphp7.420.047.4.3-4ubuntu2.2vulnerable
Ubuntuphp7.420.047.4.3-4ubuntu2.4vulnerable
Ubuntuphp7.420.047.4.3-4ubuntu2.5vulnerable
Ubuntuphp7.420.047.4.3-4ubuntu2.6vulnerable
Ubuntuphp7.420.047.4.3-4ubuntu2.7vulnerable
Ubuntuphp7.420.047.4.3-4ubuntu2.8vulnerable
Ubuntuphp7.420.047.4.3-4ubuntu2.9vulnerable
Ubuntuphp7.420.047.4.3-4ubuntu2.10fixed
Opensusephp7leap 15.37.4.6-3.32.1fixed
Opensusephp7-testleap 15.37.4.6-3.32.1fixed
Susephp7linux enterprise module for package hub 15 sp37.4.6-3.32.1fixed
Susephp7linux enterprise module for web and scripting 15 sp37.4.6-3.32.1fixed
Susephp74linux enterprise module for web and scripting 127.4.6-1.33.1fixed
Susephp74linux enterprise software development kit 12 sp57.4.6-1.33.1fixed
Susephp74linux enterprise module for web and scripting 127.4.33-1.47.2fixed
Susephp74linux enterprise software development kit 12 sp57.4.33-1.47.2fixed
Susephp7linux enterprise module for package hub 15 sp37.4.33-150200.3.46.2fixed
Susephp7linux enterprise module for web and scripting 15 sp37.4.33-150200.3.46.2fixed
Susephp7linux enterprise high performance computing 15 sp2-espos7.4.33-150200.3.46.2fixed
Susephp7linux enterprise high performance computing 15 sp2-ltss7.4.33-150200.3.46.2fixed
Susephp7linux enterprise server 15 sp2-bcl7.4.33-150200.3.46.2fixed
Susephp7linux enterprise server 15 sp2-ltss7.4.33-150200.3.46.2fixed
Susephp7linux enterprise server for sap applications 15 sp27.4.33-150200.3.46.2fixed
Susephp7manager proxy 4.17.4.33-150200.3.46.2fixed
Susephp7manager retail branch server 4.17.4.33-150200.3.46.2fixed
Susephp7manager server 4.17.4.33-150200.3.46.2fixed
Susephp7enterprise storage 77.4.33-150200.3.46.2fixed
Opensusephp7leap 15.37.4.33-150200.3.46.2fixed
Opensusephp7-testleap 15.37.4.33-150200.3.46.2fixed
Opensusephp7leap 15.47.4.33-150200.3.46.2fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Ubuntuphp7.0debpro7.0.33-0ubuntu0.16.04.16+esm3Not reportedUBUNTU-CVE-2017-8923Not reported
Ubuntuphp7.2deb18.047.2.24-0ubuntu0.18.04.11Not reportedUBUNTU-CVE-2017-8923Not reported
Ubuntuphp7.4deb20.047.4.3-4ubuntu2.10Not reportedUBUNTU-CVE-2017-8923Not reported
Opensusephp7rpmleap 15.37.4.6-3.32.1Not reportedOPENSUSE-SU-2022:0699-1Not reported
Opensusephp7-testrpmleap 15.37.4.6-3.32.1Not reportedOPENSUSE-SU-2022:0699-1Not reported
Susephp7rpmlinux enterprise module for package hub 15 sp37.4.6-3.32.1Not reportedSUSE-SU-2022:0699-1Not reported
Susephp7rpmlinux enterprise module for web and scripting 15 sp37.4.6-3.32.1Not reportedSUSE-SU-2022:0699-1Not reported
Susephp74rpmlinux enterprise module for web and scripting 127.4.6-1.33.1Not reportedSUSE-SU-2022:0530-1Not reported
Susephp74rpmlinux enterprise software development kit 12 sp57.4.6-1.33.1Not reportedSUSE-SU-2022:0530-1Not reported
Susephp74rpmlinux enterprise module for web and scripting 127.4.33-1.47.2Not reportedSUSE-SU-2022:4068-1Not reported
Susephp74rpmlinux enterprise software development kit 12 sp57.4.33-1.47.2Not reportedSUSE-SU-2022:4068-1Not reported
Susephp7rpmlinux enterprise module for package hub 15 sp37.4.33-150200.3.46.2Not reportedSUSE-SU-2022:4069-1Not reported
Susephp7rpmlinux enterprise module for web and scripting 15 sp37.4.33-150200.3.46.2Not reportedSUSE-SU-2022:4069-1Not reported
Susephp7rpmlinux enterprise high performance computing 15 sp2-espos7.4.33-150200.3.46.2Not reportedSUSE-SU-2022:4069-1Not reported
Susephp7rpmlinux enterprise high performance computing 15 sp2-ltss7.4.33-150200.3.46.2Not reportedSUSE-SU-2022:4069-1Not reported
Susephp7rpmlinux enterprise server 15 sp2-bcl7.4.33-150200.3.46.2Not reportedSUSE-SU-2022:4069-1Not reported
Susephp7rpmlinux enterprise server 15 sp2-ltss7.4.33-150200.3.46.2Not reportedSUSE-SU-2022:4069-1Not reported
Susephp7rpmlinux enterprise server for sap applications 15 sp27.4.33-150200.3.46.2Not reportedSUSE-SU-2022:4069-1Not reported
Susephp7rpmmanager proxy 4.17.4.33-150200.3.46.2Not reportedSUSE-SU-2022:4069-1Not reported
Susephp7rpmmanager retail branch server 4.17.4.33-150200.3.46.2Not reportedSUSE-SU-2022:4069-1Not reported
Susephp7rpmmanager server 4.17.4.33-150200.3.46.2Not reportedSUSE-SU-2022:4069-1Not reported
Susephp7rpmenterprise storage 77.4.33-150200.3.46.2Not reportedSUSE-SU-2022:4069-1Not reported
Opensusephp7rpmleap 15.37.4.33-150200.3.46.2Not reportedSUSE-SU-2022:4069-1Not reported
Opensusephp7-testrpmleap 15.37.4.33-150200.3.46.2Not reportedSUSE-SU-2022:4069-1Not reported
Opensusephp7rpmleap 15.47.4.33-150200.3.46.2Not reportedSUSE-SU-2022:4069-1Not reported

OpenFactory catalog packages

No matching packages in this catalog.

Observed:

References

[FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]