CVE-2017-11145: In PHP before 5.6.31, 7.x before 7.0.21, and 7.1.x before 7.1.7, an error in the date extension's timelib_m...

Security readout for executives and security teams

This flaw is in PHP's date parsing code. If an attacker can provide date strings to a vulnerable PHP runtime, the parser may read beyond intended memory and leak interpreter information. The issue is fixed in PHP 5.6.31, 7.0.21, and 7.1.7. Exposure is most likely in applications running vulnerable PHP versions where untrusted user input reaches PHP date parsing functions. Downstream packaged PHP in Debian, Red Hat, NetApp, or similar vendor environments should be checked against vendor advisories. Treat this as a targeted remediation item for legacy PHP estates, not an emergency based on the provided evidence. Prioritize internet-facing or externally integrated applications that still run affected PHP versions. Mitigation focus: Upgrade PHP to 5.6.31, 7.0.21, 7.1.7, or a later supported release.; Apply relevant distribution or vendor security updates for packaged PHP.; Check downstream appliance or platform advisories before assuming bundled PHP is fixed..

Prepared

Jun 13, 2026, 04:25 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.