CVE-2018-7584: canonical ubuntu_linux
Vulnerability summary
CVE-2018-7584 is a critical (CVSS 9.8) vulnerability in canonical ubuntu_linux. EPSS estimates a 87.35% chance of exploitation in the next 30 days, higher than 99.7% of scored vulnerabilities. 1 public exploit is recorded.
Public exploit (exploit-database, 06-06-2018)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 6 · Related 2Timeline
- 01-03-2018PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
In PHP through 5.6.33, 7.0.x before 7.0.28, 7.1.x through 7.1.14, and 7.2.x through 7.2.2, there is a stack-based buffer under-read while parsing an HTTP response in the php_stream_url_wrap_http_ex function in ext/standard/http_fopen_wrapper.c. This subsequently results in copying a large string.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · AlpineEcosystem advisory · calculated9.8CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · UbuntuEcosystem advisory · calculated9.8CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
87.35%
Chance of exploitation in the next 30 days
Percentile
100%
Versus all other CVEs
30-day change
No change 0.00 pp
From 87.35% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundPHP 7.2.2 - 'php_stream_url_wrap_http_ex' Buffer Overflow
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Suse6 products
- php5&distro=SUSE Linux Enterprise Module for Web and Scripting 12< 5.5.14-109.24.1
- php5&distro=SUSE Linux Enterprise Software Development Kit 12 SP2< 5.5.14-109.24.1
- php5&distro=SUSE Linux Enterprise Software Development Kit 12 SP3< 5.5.14-109.24.1
- php7&distro=SUSE Linux Enterprise Module for Web and Scripting 12< 7.0.7-50.32.1
- php7&distro=SUSE Linux Enterprise Software Development Kit 12 SP2< 7.0.7-50.32.1
Ubuntu3 products
- php5< 5.5.9+dfsg-1ubuntu4.24
- php7.0< 7.0.28-0ubuntu0.16.04.1
- php7.2< 7.2.3-1ubuntu1
Alpine2 products
- php5< 5.6.34-r0
- php7< 7.0.28-r0 | < 7.1.15-r0
Debian2 products
- php5< 5.4.45-0+deb7u13
- debian_linuxEOL7.0 | 8.0 | 9.0
Mageia2 products
- php< 5.6.34-1.mga5
- php< 5.6.34-1.mga6
Canonical1 product
- ubuntu_linuxEOL12.04 | 14.04 | 16.04 | 17.10
Php1 product
- php≤ 5.6.33 | ≥ 7.0.0, < 7.0.28 | ≥ 7.1.0, ≤ 7.1.14 | ≥ 7.2.0, ≤ 7.2.2
7 vendors · 17 products
References
27 links
- lists.debian.org/debian-lts-announce/2018/03/msg00030.htmlMailing ListX Refsource MLISTThird Party Advisory
Show all 27 references
- lists.debian.org/debian-lts-announce/2018/06/msg00005.htmlMailing ListX Refsource MLISTThird Party Advisory