Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
ubuntucveUbuntu.comUB:CVE-2018-17082
HistorySep 16, 2018 - 12:00 a.m.

CVE-2018-17082

2018-09-1600:00:00
ubuntu.com
ubuntu.com
14

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

0.003 Low

EPSS

Percentile

69.5%

JSON

The Apache2 component in PHP before 5.6.38, 7.0.x before 7.0.32, 7.1.x
before 7.1.22, and 7.2.x before 7.2.10 allows XSS via the body of a
“Transfer-Encoding: chunked” request, because the bucket brigade is
mishandled in the php_handler function in
sapi/apache2handler/sapi_apache2.c.

Bugs

Notes

Author Note
mdeslaur While not mentioned in the USN, the fix for this issue was included.
OSVersionArchitecturePackageVersionFilename
ubuntu14.04noarchphp5< 5.5.9+dfsg-1ubuntu4.26UNKNOWN
ubuntu16.04noarchphp7.0< 7.0.32-0ubuntu0.16.04.1UNKNOWN
ubuntu18.04noarchphp7.2< 7.2.10-0ubuntu0.18.04.1UNKNOWN

Related

suse 3
nessus 24
alpinelinux 1
prion 1
openvas 17
hackerone 1
redhatcve 1
fedora 3
veracode 1
amazon 1
osv 3
f5 1
cve 1
debiancve 1
debian 2
ibm 2
checkpoint_advisories 1
gentoo 1
redhat 1
rosalinux 1
suse
suse
Security update for php7 (moderate)
2018-10-06 18:16:05
Security update for php5 (moderate)
2018-10-06 18:11:29
Security update for php7 (moderate)
2018-09-28 12:12:31
nessus
nessus
openSUSE Security Update : php5 (openSUSE-2018-1130)
2018-10-09 00:00:00
Fedora 29 : php (2018-791c3cfe21)
2019-01-03 00:00:00
SUSE SLES11 Security Update : php53 (SUSE-SU-2018:3018-1)
2018-10-09 00:00:00
alpinelinux
alpinelinux
CVE-2018-17082
2018-09-16 15:29:00
prion
prion
Design/Logic Flaw
2018-09-16 15:29:00
openvas
openvas
Fedora Update for php FEDORA-2018-25100b492c
2018-09-24 00:00:00
openSUSE: Security Advisory for php7 (openSUSE-SU-2018:2929-1)
2018-09-28 00:00:00
Fedora Update for php FEDORA-2018-b6072889db
2018-09-23 00:00:00
hackerone
hackerone
Internet Bug Bounty: Improper handling of Chunked data request in sapi_apache2.c leads to Reflected XSS
2018-09-15 04:40:29
redhatcve
redhatcve
CVE-2018-17082
2019-10-09 11:43:46
fedora
fedora
[SECURITY] Fedora 28 Update: php-7.2.10-1.fc28
2018-09-22 20:52:00
[SECURITY] Fedora 29 Update: php-7.2.10-1.fc29
2018-09-21 05:45:30
[SECURITY] Fedora 27 Update: php-7.1.22-1.fc27
2018-09-23 19:13:35
veracode
veracode
Cross-site Scripting (XSS)
2019-08-20 00:10:41
amazon
amazon
Medium: php56, php70, php71, php72
2018-10-17 21:56:00
osv
osv
php5 - security update
2018-09-19 00:00:00
CVE-2018-17082
2018-09-16 15:29:00
php7.0 - security update
2018-12-10 00:00:00
f5
f5
K89095152 : PHP vulnerability CVE-2018-17082
2018-11-12 00:00:00
cve
cve
CVE-2018-17082
2018-09-16 15:29:00
debiancve
debiancve
CVE-2018-17082
2018-09-16 15:29:00
debian
debian
[SECURITY] [DLA 1509-1] php5 security update
2018-09-20 03:42:19
[SECURITY] [DSA 4353-1] php7.0 security update
2018-12-10 21:40:39
ibm
ibm
Security Bulletin: IBM BladeCenter Advanced Management Module (AMM) is affected by vulnerability in PHP (CVE-2018-17082)
2019-04-11 22:50:01
Security Bulletin: IBM Flex System Chassis Management Module (CMM) is affected by vulnerabilities in PHP (CVE-2018-17082 CVE-2018-14883 CVE-2018-14851 CVE-2017-9118)
2023-12-07 22:45:03
checkpoint_advisories
checkpoint_advisories
Apache2 PHP Component Chunked Transfer Encoding Policy Bypass (CVE-2013-5705; CVE-2018-17082)
2014-10-01 00:00:00
gentoo
gentoo
PHP: Multiple vulnerabilities
2018-12-02 00:00:00
redhat
redhat
(RHSA-2019:2519) Moderate: rh-php71-php security, bug fix, and enhancement update
2019-08-19 08:09:18
rosalinux
rosalinux
Advisory ROSA-SA-2021-1950
2021-07-02 17:57:45

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

0.003 Low

EPSS

Percentile

69.5%

JSON
Related for UB:CVE-2018-17082
suse3nessus24alpinelinux1prion1openvas17hackerone1redhatcve1fedora3veracode1amazon1osv3f51cve1debiancve1debian2ibm2checkpoint_advisories1gentoo1redhat1rosalinux1