CVE-2017-12933

Critical

Published: 18/08/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

The finish_nested_data function in PHP before 5.6.31, 7.0.x before 7.0.21, and 7.1.x before 7.1.7 is prone to a buffer over-read while unserializing untrusted data. Exploitation of this issue can impact the integrity of PHP.

Risk Assessment

Exploitation of this vulnerability may lead to unspecified impacts on the integrity of PHP applications, posing a risk to data security.

Recommendation

It is recommended to update PHP to the latest version to mitigate this vulnerability and reduce the risks associated with unserializing untrusted data.

Original NVD description (English source)

The finish_nested_data function in ext/standard/var_unserializer.re in PHP before 5.6.31, 7.0.x before 7.0.21, and 7.1.x before 7.1.7 is prone to a buffer over-read while unserializing untrusted data. Exploitation of this issue can have an unspecified impact on the integrity of PHP.