CVE-2017-8923
CriticalSummary
The zend_string_extend function in PHP through version 7.1.5 does not prevent changes to string objects that can lead to negative length. This allows remote attackers to cause application crashes or potentially other unspecified impacts by leveraging the .= operator with a long string.
Risk Assessment
The organization may experience application crashes, leading to service downtime. There is also a risk of unspecified impacts that could affect system integrity.
Recommendation
It is recommended to update PHP to the latest version to mitigate this vulnerability. Additionally, applications should be monitored for unusual behavior related to string operations.
Original NVD description (English source)
The zend_string_extend function in Zend/zend_string.h in PHP through 7.1.5 does not prevent changes to string objects that result in a negative length, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact by leveraging a script's use of .= with a long string.