Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

PHP 7.x before 2017-03-07 misinterprets fsockopen port numbers

CVE-2017-7189 · published 7 years ago
Summary

A security risk exists when PHP 7.x before 2017-03-07 uses fsockopen with untrusted input. This can lead to unexpected connections if a hardcoded port number is used as a security policy. To mitigate this risk, update to PHP 7.x after 2017-03-07 or ensure the port number is not hardcoded.

What to do
  • Update php php to version 7.0.16 or later.
Affected software
Ecosystem VendorProductAffected versions
Ubuntu:Pro:14.04:LTS canonical php5 All versions
Ubuntu:Pro:16.04:LTS canonical php7.0 All versions
Ubuntu:Pro:18.04:LTS canonical php7.2 All versions
Ubuntu:Pro:20.04:LTS canonical php7.4 All versions
Ubuntu:22.04:LTS canonical php8.1 All versions
– php php >= 7.0.0, < 7.0.16
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Original advisory text
main/streams/xp_socket.c in PHP 7.x before 2017-03-07 misparses fsockopen calls, such as by interpreting fsockopen('127.0.0.1:80', 443) as if the address/port were 127.0.0.1:80:443, which is later ...
main/streams/xp_socket.c in PHP 7.x before 2017-03-07 misparses fsockopen calls, such as by interpreting fsockopen('127.0.0.1:80', 443) as if the address/port were 127.0.0.1:80:443, which is later truncated to 127.0.0.1:80. This behavior has a security risk if the explicitly provided port number (i.e., 443 in this example) is hardcoded into an application as a security policy, but the hostname argument (i.e., 127.0.0.1:80 in this example) is obtained from untrusted input.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Exploitation
2% chance of attack within 30 days
Type
CWE-20Improper Input Validation
Timeline
Published10 Jul 2019
Updated29 Oct 2026
First seen28 May 2026
Sources
UBUNTU-CVE-2017-7189 · OSV
CVE-2017-7189 · NVD
CVE-2017-7189 · OSV
Track software like this
Free during beta