critical
CVE-2018-7584
php: Stack-based buffer under-read in php_stream_url_wrap_http_ex() in http_fopen_wrapper.c when parsing HTTP response
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.
Severity by source
NVD9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat5.9CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Trivy's own label is CRITICAL. Rated critical by NVD. Rated lower by Red Hat (medium), Amazon (medium), Oracle (medium), Ubuntu (medium).
Description
In PHP through 5.6.33, 7.0.x before 7.0.28, 7.1.x through 7.1.14, and 7.2.x through 7.2.2, there is a stack-based buffer under-read while parsing an HTTP response in the php_stream_url_wrap_http_ex function in ext/standard/http_fopen_wrapper.c. This subsequently results in copying a large string.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| alpine 3.4 | php5 | 5.6.34-r0 |
| alpine 3.5 | php5, php7 | 5.6.34-r0 and 1 more |
| alpine 3.6 | php5, php7 | 5.6.34-r0 and 1 more |
| alpine 3.7 | php5, php7 | 5.6.34-r0 and 1 more |
| alpine 3.8 | php5 | 5.6.34-r0 |
| amazon linux 1 | php56, php56-bcmath, php56-cli and 96 more | 5.6.35-1.137.amzn1 and 2 more |
| debian 7 | php5 | 5.4.45-0+deb7u13 |
| debian 8 | php5 | 5.6.36+dfsg-0+deb8u1 |
| debian 9 | php7.0 | 7.0.30-0+deb9u1 |
| Oracle Linux 7 | php, php-bcmath, php-cli and 22 more | 5.4.16-48.el7 |
| Red Hat | php, php-bcmath, php-cli and 24 more | no fix listed |
| ubuntu 14.04 | php5 | 5.5.9+dfsg-1ubuntu4.24 |
Show all 169 entries from 18 sources
| Source | Package | Fixed in |
|---|---|---|
| alpine 3.4 | php5 | 5.6.34-r0 |
| alpine 3.5 | php5 | 5.6.34-r0 |
| alpine 3.5 | php7 | 7.0.28-r0 |
| alpine 3.6 | php5 | 5.6.34-r0 |
| alpine 3.6 | php7 | 7.1.15-r0 |
| alpine 3.7 | php5 | 5.6.34-r0 |
| alpine 3.7 | php7 | 7.1.15-r0 |
| alpine 3.8 | php5 | 5.6.34-r0 |
| amazon linux 1 | php56 | 5.6.35-1.137.amzn1 |
| amazon linux 1 | php56-bcmath | 5.6.35-1.137.amzn1 |
| amazon linux 1 | php56-cli | 5.6.35-1.137.amzn1 |
| amazon linux 1 | php56-common | 5.6.35-1.137.amzn1 |
| amazon linux 1 | php56-dba | 5.6.35-1.137.amzn1 |
| amazon linux 1 | php56-dbg | 5.6.35-1.137.amzn1 |
| amazon linux 1 | php56-debuginfo | 5.6.35-1.137.amzn1 |
| amazon linux 1 | php56-devel | 5.6.35-1.137.amzn1 |
| amazon linux 1 | php56-embedded | 5.6.35-1.137.amzn1 |
| amazon linux 1 | php56-enchant | 5.6.35-1.137.amzn1 |
| amazon linux 1 | php56-fpm | 5.6.35-1.137.amzn1 |
| amazon linux 1 | php56-gd | 5.6.35-1.137.amzn1 |
| amazon linux 1 | php56-gmp | 5.6.35-1.137.amzn1 |
| amazon linux 1 | php56-imap | 5.6.35-1.137.amzn1 |
| amazon linux 1 | php56-intl | 5.6.35-1.137.amzn1 |
| amazon linux 1 | php56-ldap | 5.6.35-1.137.amzn1 |
| amazon linux 1 | php56-mbstring | 5.6.35-1.137.amzn1 |
| amazon linux 1 | php56-mcrypt | 5.6.35-1.137.amzn1 |
| amazon linux 1 | php56-mssql | 5.6.35-1.137.amzn1 |
| amazon linux 1 | php56-mysqlnd | 5.6.35-1.137.amzn1 |
| amazon linux 1 | php56-odbc | 5.6.35-1.137.amzn1 |
| amazon linux 1 | php56-opcache | 5.6.35-1.137.amzn1 |
| amazon linux 1 | php56-pdo | 5.6.35-1.137.amzn1 |
| amazon linux 1 | php56-pgsql | 5.6.35-1.137.amzn1 |
| amazon linux 1 | php56-process | 5.6.35-1.137.amzn1 |
| amazon linux 1 | php56-pspell | 5.6.35-1.137.amzn1 |
| amazon linux 1 | php56-recode | 5.6.35-1.137.amzn1 |
| amazon linux 1 | php56-snmp | 5.6.35-1.137.amzn1 |
| amazon linux 1 | php56-soap | 5.6.35-1.137.amzn1 |
| amazon linux 1 | php56-tidy | 5.6.35-1.137.amzn1 |
| amazon linux 1 | php56-xml | 5.6.35-1.137.amzn1 |
| amazon linux 1 | php56-xmlrpc | 5.6.35-1.137.amzn1 |
| amazon linux 1 | php70 | 7.0.29-1.28.amzn1 |
| amazon linux 1 | php70-bcmath | 7.0.29-1.28.amzn1 |
| amazon linux 1 | php70-cli | 7.0.29-1.28.amzn1 |
| amazon linux 1 | php70-common | 7.0.29-1.28.amzn1 |
| amazon linux 1 | php70-dba | 7.0.29-1.28.amzn1 |
| amazon linux 1 | php70-dbg | 7.0.29-1.28.amzn1 |
| amazon linux 1 | php70-debuginfo | 7.0.29-1.28.amzn1 |
| amazon linux 1 | php70-devel | 7.0.29-1.28.amzn1 |
| amazon linux 1 | php70-embedded | 7.0.29-1.28.amzn1 |
| amazon linux 1 | php70-enchant | 7.0.29-1.28.amzn1 |
| amazon linux 1 | php70-fpm | 7.0.29-1.28.amzn1 |
| amazon linux 1 | php70-gd | 7.0.29-1.28.amzn1 |
| amazon linux 1 | php70-gmp | 7.0.29-1.28.amzn1 |
| amazon linux 1 | php70-imap | 7.0.29-1.28.amzn1 |
| amazon linux 1 | php70-intl | 7.0.29-1.28.amzn1 |
| amazon linux 1 | php70-json | 7.0.29-1.28.amzn1 |
| amazon linux 1 | php70-ldap | 7.0.29-1.28.amzn1 |
| amazon linux 1 | php70-mbstring | 7.0.29-1.28.amzn1 |
| amazon linux 1 | php70-mcrypt | 7.0.29-1.28.amzn1 |
| amazon linux 1 | php70-mysqlnd | 7.0.29-1.28.amzn1 |
| amazon linux 1 | php70-odbc | 7.0.29-1.28.amzn1 |
| amazon linux 1 | php70-opcache | 7.0.29-1.28.amzn1 |
| amazon linux 1 | php70-pdo | 7.0.29-1.28.amzn1 |
| amazon linux 1 | php70-pdo-dblib | 7.0.29-1.28.amzn1 |
| amazon linux 1 | php70-pgsql | 7.0.29-1.28.amzn1 |
| amazon linux 1 | php70-process | 7.0.29-1.28.amzn1 |
| amazon linux 1 | php70-pspell | 7.0.29-1.28.amzn1 |
| amazon linux 1 | php70-recode | 7.0.29-1.28.amzn1 |
| amazon linux 1 | php70-snmp | 7.0.29-1.28.amzn1 |
| amazon linux 1 | php70-soap | 7.0.29-1.28.amzn1 |
| amazon linux 1 | php70-tidy | 7.0.29-1.28.amzn1 |
| amazon linux 1 | php70-xml | 7.0.29-1.28.amzn1 |
| amazon linux 1 | php70-xmlrpc | 7.0.29-1.28.amzn1 |
| amazon linux 1 | php70-zip | 7.0.29-1.28.amzn1 |
| amazon linux 1 | php71 | 7.1.15-1.31.amzn1 |
| amazon linux 1 | php71-bcmath | 7.1.15-1.31.amzn1 |
| amazon linux 1 | php71-cli | 7.1.15-1.31.amzn1 |
| amazon linux 1 | php71-common | 7.1.15-1.31.amzn1 |
| amazon linux 1 | php71-dba | 7.1.15-1.31.amzn1 |
| amazon linux 1 | php71-dbg | 7.1.15-1.31.amzn1 |
| amazon linux 1 | php71-debuginfo | 7.1.15-1.31.amzn1 |
| amazon linux 1 | php71-devel | 7.1.15-1.31.amzn1 |
| amazon linux 1 | php71-embedded | 7.1.15-1.31.amzn1 |
| amazon linux 1 | php71-enchant | 7.1.15-1.31.amzn1 |
| amazon linux 1 | php71-fpm | 7.1.15-1.31.amzn1 |
| amazon linux 1 | php71-gd | 7.1.15-1.31.amzn1 |
| amazon linux 1 | php71-gmp | 7.1.15-1.31.amzn1 |
| amazon linux 1 | php71-imap | 7.1.15-1.31.amzn1 |
| amazon linux 1 | php71-intl | 7.1.15-1.31.amzn1 |
| amazon linux 1 | php71-json | 7.1.15-1.31.amzn1 |
| amazon linux 1 | php71-ldap | 7.1.15-1.31.amzn1 |
| amazon linux 1 | php71-mbstring | 7.1.15-1.31.amzn1 |
| amazon linux 1 | php71-mcrypt | 7.1.15-1.31.amzn1 |
| amazon linux 1 | php71-mysqlnd | 7.1.15-1.31.amzn1 |
| amazon linux 1 | php71-odbc | 7.1.15-1.31.amzn1 |
| amazon linux 1 | php71-opcache | 7.1.15-1.31.amzn1 |
| amazon linux 1 | php71-pdo | 7.1.15-1.31.amzn1 |
| amazon linux 1 | php71-pdo-dblib | 7.1.15-1.31.amzn1 |
| amazon linux 1 | php71-pgsql | 7.1.15-1.31.amzn1 |
| amazon linux 1 | php71-process | 7.1.15-1.31.amzn1 |
| amazon linux 1 | php71-pspell | 7.1.15-1.31.amzn1 |
| amazon linux 1 | php71-recode | 7.1.15-1.31.amzn1 |
| amazon linux 1 | php71-snmp | 7.1.15-1.31.amzn1 |
| amazon linux 1 | php71-soap | 7.1.15-1.31.amzn1 |
| amazon linux 1 | php71-tidy | 7.1.15-1.31.amzn1 |
| amazon linux 1 | php71-xml | 7.1.15-1.31.amzn1 |
| amazon linux 1 | php71-xmlrpc | 7.1.15-1.31.amzn1 |
| debian 7 | php5 | 5.4.45-0+deb7u13 |
| debian 8 | php5 | 5.6.36+dfsg-0+deb8u1 |
| debian 9 | php7.0 | 7.0.30-0+deb9u1 |
| Oracle Linux 7 | php | 5.4.16-48.el7 |
| Oracle Linux 7 | php-bcmath | 5.4.16-48.el7 |
| Oracle Linux 7 | php-cli | 5.4.16-48.el7 |
| Oracle Linux 7 | php-common | 5.4.16-48.el7 |
| Oracle Linux 7 | php-dba | 5.4.16-48.el7 |
| Oracle Linux 7 | php-devel | 5.4.16-48.el7 |
| Oracle Linux 7 | php-embedded | 5.4.16-48.el7 |
| Oracle Linux 7 | php-enchant | 5.4.16-48.el7 |
| Oracle Linux 7 | php-fpm | 5.4.16-48.el7 |
| Oracle Linux 7 | php-gd | 5.4.16-48.el7 |
| Oracle Linux 7 | php-intl | 5.4.16-48.el7 |
| Oracle Linux 7 | php-ldap | 5.4.16-48.el7 |
| Oracle Linux 7 | php-mbstring | 5.4.16-48.el7 |
| Oracle Linux 7 | php-mysql | 5.4.16-48.el7 |
| Oracle Linux 7 | php-mysqlnd | 5.4.16-48.el7 |
| Oracle Linux 7 | php-odbc | 5.4.16-48.el7 |
| Oracle Linux 7 | php-pdo | 5.4.16-48.el7 |
| Oracle Linux 7 | php-pgsql | 5.4.16-48.el7 |
| Oracle Linux 7 | php-process | 5.4.16-48.el7 |
| Oracle Linux 7 | php-pspell | 5.4.16-48.el7 |
| Oracle Linux 7 | php-recode | 5.4.16-48.el7 |
| Oracle Linux 7 | php-snmp | 5.4.16-48.el7 |
| Oracle Linux 7 | php-soap | 5.4.16-48.el7 |
| Oracle Linux 7 | php-xml | 5.4.16-48.el7 |
| Oracle Linux 7 | php-xmlrpc | 5.4.16-48.el7 |
| Red Hat | php | no fix listed |
| Red Hat | php-bcmath | no fix listed |
| Red Hat | php-cli | no fix listed |
| Red Hat | php-common | no fix listed |
| Red Hat | php-dba | no fix listed |
| Red Hat | php-devel | no fix listed |
| Red Hat | php-embedded | no fix listed |
| Red Hat | php-enchant | no fix listed |
| Red Hat | php-fpm | no fix listed |
| Red Hat | php-gd | no fix listed |
| Red Hat | php-imap | no fix listed |
| Red Hat | php-intl | no fix listed |
| Red Hat | php-ldap | no fix listed |
| Red Hat | php-mbstring | no fix listed |
| Red Hat | php-mysql | no fix listed |
| Red Hat | php-odbc | no fix listed |
| Red Hat | php-pdo | no fix listed |
| Red Hat | php-pgsql | no fix listed |
| Red Hat | php-process | no fix listed |
| Red Hat | php-pspell | no fix listed |
| Red Hat | php-recode | no fix listed |
| Red Hat | php-snmp | no fix listed |
| Red Hat | php-soap | no fix listed |
| Red Hat | php-tidy | no fix listed |
| Red Hat | php-xml | no fix listed |
| Red Hat | php-xmlrpc | no fix listed |
| Red Hat | php-zts | no fix listed |
| ubuntu 14.04 | php5 | 5.5.9+dfsg-1ubuntu4.24 |
| ubuntu 14.04-ESM | php5 | 5.5.9+dfsg-1ubuntu4.24 |
| ubuntu 16.04 | php7.0 | 7.0.28-0ubuntu0.16.04.1 |
| ubuntu 16.04-ESM | php7.0 | 7.0.28-0ubuntu0.16.04.1 |
| ubuntu 17.10 | php7.1 | 7.1.15-0ubuntu0.17.10.1 |
| ubuntu 18.04 | php7.2 | 7.2.3-1ubuntu1 |
| ubuntu 18.04-ESM | php7.2 | 7.2.3-1ubuntu1 |
References
- http://php.net/ChangeLog-7.php
- http://www.securityfocus.com/bid/103204
- http://www.securitytracker.com/id/1041607
- https://access.redhat.com/errata/RHSA-2019:2519
- https://access.redhat.com/security/cve/CVE-2018-7584
- https://bugs.php.net/bug.php?id=75981
- https://github.com/php/php-src/commit/523f230c831d7b33353203fa34aee4e92ac12bba
- https://linux.oracle.com/cve/CVE-2018-7584.html
All 21 references
- https://linux.oracle.com/errata/ELSA-2020-1112.html
- https://lists.debian.org/debian-lts-announce/2018/03/msg00030.html
- https://lists.debian.org/debian-lts-announce/2018/06/msg00005.html
- https://nvd.nist.gov/vuln/detail/CVE-2018-7584
- https://ubuntu.com/security/notices/USN-3600-1
- https://ubuntu.com/security/notices/USN-3600-2
- https://usn.ubuntu.com/3600-1/
- https://usn.ubuntu.com/3600-2/
- https://www.cve.org/CVERecord?id=CVE-2018-7584
- https://www.debian.org/security/2018/dsa-4240
- https://www.exploit-db.com/exploits/44846/
- https://www.tenable.com/security/tns-2018-03
- https://www.tenable.com/security/tns-2018-12