NVD

CVE-2017-11146 Detail

Rejected

CVE has been marked "REJECT" in the CVE List. These CVEs are stored in the NVD, but do not show up in search results.

Description

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not an independently fixable security issue relative to CVE-2017-11145. Notes: none

Metrics

NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed.

CVSS 4.0 Severity and Vector Strings:

NIST: NVD

N/A

NVD assessment not yet provided.

CVSS 3.x Severity and Vector Strings:

NIST: NVD

Base Score: N/A

NVD assessment not yet provided.

CVSS 2.0 Severity and Vector Strings:

National Institute of Standards and Technology

NIST: NVD

Base Score: N/A

NVD assessment not yet provided.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

Hyperlink	Resource

Weakness Enumeration

CWE-ID	CWE Name	Source

Change History

5 change records found show changes

CVE Modified by MITRE 7/23/2017 9:29:00 PM

Action	Type	Old Value	New Value
Removed	CPE Configuration	Record truncated, showing 500 of 1394 characters. View Entire Change Record OR cpe:2.3:a:php:php:5.6.30::::::: (and previous) cpe:2.3:a:php:php:7.0.0::::::: cpe:2.3:a:php:php:7.0.1::::::: cpe:2.3:a:php:php:7.0.2::::::: cpe:2.3:a:php:php:7.0.3::::::: cpe:2.3:a:php:php:7.0.4::::::: cpe:2.3:a:php:php:7.0.5::::::: cpe:2.3:a:php:php:7.0.6::::::: cpe:2.3:a:php:php:7.0.7::::::: cpe:2.3:a:php:php:7.0.8::::::: cpe:2.3:a:php:php:7.0.9::::::*
Removed	CVSS V2	(AV:N/AC:L/Au:N/C:P/I:N/A:N)
Removed	CVSS V3	AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Removed	CWE	CWE-200
Changed	Description	In PHP through 5.6.31, 7.x through 7.0.21, and 7.1.x through 7.1.7, lack of bounds checks in the date extension's timelib_meridian parsing code could be used by attackers able to supply date strings to leak information from the interpreter, related to ext/date/lib/parse_date.c out-of-bounds reads affecting the php_parse_date function. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-11145.	REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not an independently fixable security issue relative to CVE-2017-11145. Notes: none.
Changed	Display Vulnerability	true	false
Removed	Reference	http://openwall.com/lists/oss-security/2017/07/10/6 [Mailing List, Third Party Advisory]
Removed	Reference	http://www.securityfocus.com/bid/99612 [No Types Assigned]
Removed	Reference	https://bugs.php.net/bug.php?id=74819 [Third Party Advisory]
Removed	Reference	https://gist.github.com/anonymous/bd77ac90d3bdf31ce2a5251ad92e9e75 [Patch, Third Party Advisory]

Initial Analysis by NIST 7/17/2017 12:23:01 PM

Action	Type	Old Value	New Value
Added	CPE Configuration		Record truncated, showing 500 of 1394 characters. View Entire Change Record OR cpe:2.3:a:php:php:5.6.30::::::: (and previous) cpe:2.3:a:php:php:7.0.0::::::: cpe:2.3:a:php:php:7.0.1::::::: cpe:2.3:a:php:php:7.0.2::::::: cpe:2.3:a:php:php:7.0.3::::::: cpe:2.3:a:php:php:7.0.4::::::: cpe:2.3:a:php:php:7.0.5::::::: cpe:2.3:a:php:php:7.0.6::::::: cpe:2.3:a:php:php:7.0.7::::::: cpe:2.3:a:php:php:7.0.8::::::: cpe:2.3:a:php:php:7.0.9::::::*
Added	CVSS V2		(AV:N/AC:L/Au:N/C:P/I:N/A:N)
Added	CVSS V3		AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Added	CWE		CWE-200
Changed	Reference Type	http://openwall.com/lists/oss-security/2017/07/10/6 No Types Assigned	http://openwall.com/lists/oss-security/2017/07/10/6 Mailing List, Third Party Advisory
Changed	Reference Type	https://bugs.php.net/bug.php?id=74819 No Types Assigned	https://bugs.php.net/bug.php?id=74819 Third Party Advisory
Changed	Reference Type	https://gist.github.com/anonymous/bd77ac90d3bdf31ce2a5251ad92e9e75 No Types Assigned	https://gist.github.com/anonymous/bd77ac90d3bdf31ce2a5251ad92e9e75 Patch, Third Party Advisory

Quick Info

CVE Dictionary Entry:
CVE-2017-11146
NVD Published Date:
07/10/2017
NVD Last Modified:
11/06/2023
Source:
MITRE

You are viewing this page in an unauthorized frame window.

Information Technology Laboratory

National Vulnerability Database

National Vulnerability Database

CVE-2017-11146 Detail

Description

Metrics

References to Advisories, Solutions, and Tools

Weakness Enumeration

Change History

CVE Modified by MITRE 11/06/2023 9:38:10 PM

CVE Modified by MITRE 7/23/2017 9:29:00 PM

CVE Rejected by MITRE 7/23/2017 9:03:02 PM

CVE Modified by MITRE 7/18/2017 9:29:02 PM

Initial Analysis by NIST 7/17/2017 12:23:01 PM

Quick Info