CVE-2017-16642: Canonical Ubuntu Linux

High severity, CVSS 7.5. EPSS: 26.4% chance of exploitation in the next 30 days.

In PHP before 5.6.32, 7.x before 7.0.25, and 7.1.x before 7.1.11, an error in the date extension's timelib_meridian handling of 'front of' and 'back of' directives could be used by attackers able to supply date strings to leak information from the interpreter, related to ext/date/lib/parse_date.c out-of-bounds reads affecting the php_parse_date function. NOTE: this is a different issue than CVE-2017-11145.

Affected products

• Canonical Ubuntu Linux: version 14.04 only
• Debian Debian Linux: version 8.0 only; version 9.0 only
• Netapp Clustered Data Ontap: affected versions not specified
• Netapp Storage Automation Store: affected versions not specified
• PHP PHP: before 5.6.32 (fixed in 5.6.32); from 7.0.0, before 7.0.25 (fixed in 7.0.25); from 7.1.0, before 7.1.11 (fixed in 7.1.11)

Published 2017-11-07. Last modified 2026-06-17.