CVE-2017-11145

In PHP before 5.6.31, 7.x before 7.0.21, and 7.1.x before 7.1.7, an error
in the date extension’s timelib_meridian parsing code could be used by
attackers able to supply date strings to leak information from the
interpreter, related to ext/date/lib/parse_date.c out-of-bounds reads
affecting the php_parse_date function. NOTE: the correct fix is in the
e8b7698f5ee757ce2c8bd10a192a491a498f891c commit, not the
bd77ac90d3bdf31ce2a5251ad92e9e75 gist.

Bugs

• <https://bugs.php.net/bug.php?id=74819&gt;