{"id":"CVE-2017-11362","details":"In PHP 7.x before 7.0.21 and 7.1.x before 7.1.7, ext/intl/msgformat/msgformat_parse.c does not restrict the locale length, which allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) or possibly have unspecified other impact within International Components for Unicode (ICU) for C/C++ via a long first argument to the msgfmt_parse_message function.","modified":"2026-08-18T08:26:57.966147Z","published":"2017-07-17T13:18:21.673Z","references":[{"type":"WEB","url":"https://usn.ubuntu.com/3566-2/"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2018:1296"},{"type":"ADVISORY","url":"https://security.gentoo.org/glsa/201709-21"},{"type":"ADVISORY","url":"https://security.netapp.com/advisory/ntap-20180112-0001/"},{"type":"REPORT","url":"https://bugs.php.net/bug.php?id=73473"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/php/php-src","events":[{"introduced":"60fffd296abce5fc071f3c173c25a2696cf683c6"},{"last_affected":"5b34dc2d52841bfab425cbb24e9111172de20ef9"}],"database_specific":{"cpe":["cpe:2.3:a:php:php:7.0.0:*:*:*:*:*:*:*","cpe:2.3:a:php:php:7.0.1:*:*:*:*:*:*:*","cpe:2.3:a:php:php:7.0.2:*:*:*:*:*:*:*","cpe:2.3:a:php:php:7.0.3:*:*:*:*:*:*:*","cpe:2.3:a:php:php:7.0.4:*:*:*:*:*:*:*","cpe:2.3:a:php:php:7.0.5:*:*:*:*:*:*:*","cpe:2.3:a:php:php:7.0.6:*:*:*:*:*:*:*","cpe:2.3:a:php:php:7.0.7:*:*:*:*:*:*:*","cpe:2.3:a:php:php:7.0.8:*:*:*:*:*:*:*","cpe:2.3:a:php:php:7.0.9:*:*:*:*:*:*:*","cpe:2.3:a:php:php:7.0.10:*:*:*:*:*:*:*","cpe:2.3:a:php:php:7.0.11:*:*:*:*:*:*:*","cpe:2.3:a:php:php:7.0.12:*:*:*:*:*:*:*","cpe:2.3:a:php:php:7.0.13:*:*:*:*:*:*:*","cpe:2.3:a:php:php:7.0.14:*:*:*:*:*:*:*","cpe:2.3:a:php:php:7.0.15:*:*:*:*:*:*:*","cpe:2.3:a:php:php:7.0.16:*:*:*:*:*:*:*","cpe:2.3:a:php:php:7.0.17:*:*:*:*:*:*:*","cpe:2.3:a:php:php:7.0.18:*:*:*:*:*:*:*","cpe:2.3:a:php:php:7.0.19:*:*:*:*:*:*:*","cpe:2.3:a:php:php:7.0.20:*:*:*:*:*:*:*","cpe:2.3:a:php:php:7.1.0:*:*:*:*:*:*:*","cpe:2.3:a:php:php:7.1.1:*:*:*:*:*:*:*","cpe:2.3:a:php:php:7.1.2:*:*:*:*:*:*:*","cpe:2.3:a:php:php:7.1.3:*:*:*:*:*:*:*","cpe:2.3:a:php:php:7.1.4:*:*:*:*:*:*:*","cpe:2.3:a:php:php:7.1.5:*:*:*:*:*:*:*","cpe:2.3:a:php:php:7.1.6:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"7.0.0"},{"last_affected":"7.0.0"},{"introduced":"7.0.1"},{"last_affected":"7.0.1"},{"introduced":"7.0.2"},{"last_affected":"7.0.2"},{"introduced":"7.0.3"},{"last_affected":"7.0.3"},{"introduced":"7.0.4"},{"last_affected":"7.0.4"},{"introduced":"7.0.5"},{"last_affected":"7.0.5"},{"introduced":"7.0.6"},{"last_affected":"7.0.6"},{"introduced":"7.0.7"},{"last_affected":"7.0.7"},{"introduced":"7.0.8"},{"last_affected":"7.0.8"},{"introduced":"7.0.9"},{"last_affected":"7.0.9"},{"introduced":"7.0.10"},{"last_affected":"7.0.10"},{"introduced":"7.0.11"},{"last_affected":"7.0.11"},{"introduced":"7.0.12"},{"last_affected":"7.0.12"},{"introduced":"7.0.13"},{"last_affected":"7.0.13"},{"introduced":"7.0.14"},{"last_affected":"7.0.14"},{"introduced":"7.0.15"},{"last_affected":"7.0.15"},{"introduced":"7.0.16"},{"last_affected":"7.0.16"},{"introduced":"7.0.17"},{"last_affected":"7.0.17"},{"introduced":"7.0.18"},{"last_affected":"7.0.18"},{"introduced":"7.0.19"},{"last_affected":"7.0.19"},{"introduced":"7.0.20"},{"last_affected":"7.0.20"},{"introduced":"7.1.0"},{"last_affected":"7.1.0"},{"introduced":"7.1.1"},{"last_affected":"7.1.1"},{"introduced":"7.1.2"},{"last_affected":"7.1.2"},{"introduced":"7.1.3"},{"last_affected":"7.1.3"},{"introduced":"7.1.4"},{"last_affected":"7.1.4"},{"introduced":"7.1.5"},{"last_affected":"7.1.5"},{"introduced":"7.1.6"},{"last_affected":"7.1.6"}],"source":"CPE_STRING"}}],"versions":["7.0.0","7.0.1","7.0.10","7.0.11","7.0.12","7.0.13","7.0.14","7.0.15","7.0.16","7.0.17","7.0.18","7.0.19","7.0.2","7.0.20","7.0.3","7.0.4","7.0.5","7.0.6","7.0.7","7.0.8","7.0.9","7.1.0","7.1.1","7.1.2","7.1.3","7.1.4","7.1.5","7.1.6"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2017-11362.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}