Vulnerability Database

300,445

Total vulnerabilities in the database

CVE-2017-12933

The finish_nested_data function in ext/standard/var_unserializer.re in PHP before 5.6.31, 7.0.x before 7.0.21, and 7.1.x before 7.1.7 is prone to a buffer over-read while unserializing untrusted data. Exploitation of this issue can have an unspecified impact on the integrity of PHP.

  • Published: Aug 18, 2017
  • Updated: Nov 9, 2025
  • CVE: CVE-2017-12933
  • Severity: High
  • Exploit:

CVSS v2:

  • Severity: High
  • Score: 7.5
  • AV:N/AC:L/Au:N/C:P/I:P/A:P

CWEs:

Software From Fixed in
php / php 7.1.0 7.1.0.x
php / php 7.1.6 7.1.6.x
php / php 7.0.11 7.0.11.x
php / php 7.0.4 7.0.4.x
php / php 7.1.3 7.1.3.x
php / php 7.1.5 7.1.5.x
php / php 7.0.19 7.0.19.x
php / php 7.0.3 7.0.3.x
php / php 7.0.1 7.0.1.x
php / php 7.1.2 7.1.2.x
php / php 7.0.12 7.0.12.x
php / php 7.0.13 7.0.13.x
php / php 7.0.16 7.0.16.x
php / php 7.0.7 7.0.7.x
php / php 7.0.14 7.0.14.x
php / php 7.0.20 7.0.20.x
php / php 7.0.15 7.0.15.x
php / php - 5.6.30.x
php / php 7.0.18 7.0.18.x
php / php 7.0.2 7.0.2.x
php / php 7.0.9 7.0.9.x
php / php 7.0.8 7.0.8.x
php / php 7.0.17 7.0.17.x
php / php 7.0.5 7.0.5.x
php / php 7.0.10 7.0.10.x
php / php 7.0.0 7.0.0.x
php / php 7.0.6 7.0.6.x
php / php 7.1.1 7.1.1.x
php / php 7.1.4 7.1.4.x