CVE-2017-5340
CriticalSummary
In PHP before 7.0.15 and 7.1.x before 7.1.1, there is an issue in zend_hash.c that mishandles cases requiring large array allocations. This can allow remote attackers to execute arbitrary code or cause a denial of service.
Risk Assessment
Organizations may be exposed to remote attacks that could lead to unauthorized code execution or disruption of service.
Recommendation
It is recommended to update PHP to version 7.0.15 or 7.1.1 and to monitor applications for suspicious activities.
Original NVD description (English source)
Zend/zend_hash.c in PHP before 7.0.15 and 7.1.x before 7.1.1 mishandles certain cases that require large array allocations, which allows remote attackers to execute arbitrary code or cause a denial of service (integer overflow, uninitialized memory access, and use of arbitrary destructor function pointers) via crafted serialized data.