CVE-2017-11147
CriticalSummary
In PHP before 5.6.30 and 7.x before 7.0.15, attackers could exploit the PHAR archive handler by supplying malicious archive files, potentially causing the PHP interpreter to crash or disclosing information due to a buffer over-read in the phar_parse_pharfile function.
Risk Assessment
Organizations may face application crashes and potential data leaks, leading to serious information security consequences.
Recommendation
It is recommended to upgrade PHP to version 5.6.30 or 7.0.15 and later to mitigate the risks associated with this vulnerability.
Original NVD description (English source)
In PHP before 5.6.30 and 7.x before 7.0.15, the PHAR archive handler could be used by attackers supplying malicious archive files to crash the PHP interpreter or potentially disclose information due to a buffer over-read in the phar_parse_pharfile function in ext/phar/phar.c.