CVE-2017-8923

An integer overflow vulnerability in PHP can lead to a buffer overflow when constructing extremely long strings with the ".=" operator. In unusual circumstances, this could be used by an attacker to cause an application to crash or possibly have other consequences.

This issue is only practical to exploit on 32-bit systems, and then only when the memory limit is raised from its default to a value larger than 2 GiB. The default settings make exploitation impossible. For these reasons, PHP upstream developers do not consider this to be a security issue. Red Hat Software Collections and Red Hat Enterprise Linux 7 and later only distribute PHP built for 64-bit systems.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.