← back
CVE-2018-17082

CVE-2018-17082

18Vexday Risk Score

Patch soon. It has a working public exploit.

ssvc Attendepss 4.1%
exploitation probability
4.1%top 10% of all CVEs
observed exploitation
nono source reports it
The Apache2 component in PHP before 5.6.38, 7.0.x before 7.0.32, 7.1.x before 7.1.22, and 7.2.x before 7.2.10 allows XSS via the body of a "Transfer-Encoding: chunked" request, because the bucket brigade is mishandled in the php_handler function in sapi/apache2handler/sapi_apache2.c.
Affected products
n/a · n/a
References
http://php.net/ChangeLog-5.phphttp://php.net/ChangeLog-7.phphttps://access.redhat.com/errata/RHSA-2019:2519https://bugs.php.net/bug.php?id=76582https://github.com/php/php-src/commit/23b057742e3cf199612fa8050ae86cae675e214ehttps://lists.debian.org/debian-lts-announce/2018/09/msg00020.htmlhttps://security.gentoo.org/glsa/201812-01https://security.netapp.com/advisory/ntap-20180924-0001/https://www.debian.org/security/2018/dsa-4353https://www.tenable.com/security/tns-2019-07