CVE-2017-7189— PHP 输入验证错误漏洞

N/A

main/streams/xp_socket.c in PHP 7.x before 2017-03-07 misparses fsockopen calls, such as by interpreting fsockopen('127.0.0.1:80', 443) as if the address/port were 127.0.0.1:80:443, which is later truncated to 127.0.0.1:80. This behavior has a security risk if the explicitly provided port number (i.e., 443 in this example) is hardcoded into an application as a security policy, but the hostname argument (i.e., 127.0.0.1:80 in this example) is obtained from untrusted input.

N/A

N/A

PHP 输入验证错误漏洞

PHP（PHP：Hypertext Preprocessor，PHP：超文本预处理器）是PHPGroup和开放源代码社区的共同维护的一种开源的通用计算机脚本语言。该语言主要用于Web开发，支持多种数据库及操作系统。 PHP 2017-03-07之前的7.x版本中存在安全漏洞，该漏洞源于main/streams/xp_socket.c文件没有正确解析fsockopen调用。目前尚无此漏洞的相关信息，请随时关注CNNVD或厂商公告。

N/A

N/A