The php_str_replace_in_subject function in ext/standard/string.c in PHP 7.x before 7.0.0 allows remote attackers to execute arbitrary code via a crafted value in the third argument to the str_ireplace function.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Php | Php | 7.0.0 (including) | 7.0.0 (including) |
| Php | Php | 7.0.0-alpha1 (including) | 7.0.0-alpha1 (including) |
| Php | Php | 7.0.0-alpha2 (including) | 7.0.0-alpha2 (including) |
| Php | Php | 7.0.0-beta1 (including) | 7.0.0-beta1 (including) |
| Php | Php | 7.0.0-beta2 (including) | 7.0.0-beta2 (including) |
| Php | Php | 7.0.0-beta3 (including) | 7.0.0-beta3 (including) |
| Php | Php | 7.0.0-rc1 (including) | 7.0.0-rc1 (including) |
| Php | Php | 7.0.0-rc2 (including) | 7.0.0-rc2 (including) |
| Php | Php | 7.0.0-rc3 (including) | 7.0.0-rc3 (including) |
| Php | Php | 7.0.0-rc4 (including) | 7.0.0-rc4 (including) |
| Php | Php | 7.0.0-rc5 (including) | 7.0.0-rc5 (including) |
| Php | Php | 7.0.0-rc6 (including) | 7.0.0-rc6 (including) |
| Php | Php | 7.0.0-rc7 (including) | 7.0.0-rc7 (including) |
| Php | Php | 7.0.0-rc8 (including) | 7.0.0-rc8 (including) |