CVE-2018-5712
Published: 16 January 2018
An issue was discovered in PHP before 5.6.33, 7.0.x before 7.0.27, 7.1.x before 7.1.13, and 7.2.x before 7.2.1. There is Reflected XSS on the PHAR 404 error page via the URI of a request for a .phar file.
Priority
Status
Package | Release | Status |
---|---|---|
php7.1 Launchpad, Ubuntu, Debian |
trusty |
Does not exist
|
xenial |
Does not exist
|
|
upstream |
Released
(7.1.13)
|
|
artful |
Released
(7.1.15-0ubuntu0.17.10.1)
|
|
bionic |
Does not exist
|
|
php5 Launchpad, Ubuntu, Debian |
upstream |
Released
(5.6.33)
|
trusty |
Released
(5.5.9+dfsg-1ubuntu4.23)
|
|
xenial |
Does not exist
|
|
artful |
Does not exist
|
|
bionic |
Does not exist
|
|
Patches: upstream: http://git.php.net/?p=php-src.git;a=commit;h=73ca9b37731dd9690ffd9706333b17eaf90ea091 |
||
php7.0 Launchpad, Ubuntu, Debian |
upstream |
Released
(7.0.27)
|
trusty |
Does not exist
|
|
xenial |
Released
(7.0.28-0ubuntu0.16.04.1)
|
|
artful |
Does not exist
|
|
bionic |
Does not exist
|
|
php7.2 Launchpad, Ubuntu, Debian |
upstream |
Released
(7.2.1)
|
trusty |
Does not exist
|
|
xenial |
Does not exist
|
|
artful |
Does not exist
|
|
bionic |
Not vulnerable
(7.2.2-1ubuntu2)
|
Severity score breakdown
Parameter | Value |
---|---|
Base score | 6.1 |
Attack vector | Network |
Attack complexity | Low |
Privileges required | None |
User interaction | Required |
Scope | Changed |
Confidentiality | Low |
Integrity impact | Low |
Availability impact | None |
Vector | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
References
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5712
- http://php.net/ChangeLog-5.php
- http://php.net/ChangeLog-7.php
- https://ubuntu.com/security/notices/USN-3566-1
- https://ubuntu.com/security/notices/USN-3600-1
- https://ubuntu.com/security/notices/USN-3600-2
- NVD
- Launchpad
- Debian