Description
The _zval_get_long_func_ex in Zend/zend_operators.c in PHP 7.1.2 allows attackers to cause a denial of service (NULL pointer dereference and application crash) via crafted use of "declare(ticks=" in a PHP script. NOTE: the vendor disputes the classification of this as a vulnerability, stating "Please do not request CVEs for ordinary bugs. CVEs are relevant for security issues only.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | php7.0 | No fix yet | — |
| Ubuntu Pro 14.04 LTS | php5 | No fix yet | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP2 | php7 | 7.0.7-49.1 | SUSE-SU-2017:1717-1 |
| SLES 12 | php7 | 7.0.7-49.1 | SUSE-SU-2017:1717-1 |
Advisories 1
- SUSE-SU-2017:1717-1 Security update for php7 SUSE / openSUSE Security Updates · May 2, 2025