CVE-2017-16642
HighSummary
In PHP before 5.6.32, 7.x before 7.0.25, and 7.1.x before 7.1.11, an error in the date extension's handling of 'front of' and 'back of' directives could be exploited by attackers to leak information from the interpreter.
Risk Assessment
Attackers may exploit this vulnerability to gain access to sensitive information, potentially leading to further attacks on the system.
Recommendation
It is recommended to update PHP to the latest version to mitigate this vulnerability.
Other vulnerabilities in PHP date extension
Original NVD description (English source)
In PHP before 5.6.32, 7.x before 7.0.25, and 7.1.x before 7.1.11, an error in the date extension's timelib_meridian handling of 'front of' and 'back of' directives could be used by attackers able to supply date strings to leak information from the interpreter, related to ext/date/lib/parse_date.c out-of-bounds reads affecting the php_parse_date function. NOTE: this is a different issue than CVE-2017-11145.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS