blogsafe.org My Downloads

BlogSafe.org

PHP CVEs

Vulnerabilities in the PHP language itself, and which PHP versions they affect.

← Back to CVE list

CVE-2016-5093

HIGH 8.6 CVSS 3.0
Published
August 7, 2016
Last modified
June 17, 2026
NVD status
Modified
Reported by
cve@mitre.org
Weakness
CWE-125
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

Description

The get_icu_value_internal function in ext/intl/locale/locale_methods.c in PHP before 5.5.36, 5.6.x before 5.6.22, and 7.x before 7.0.7 does not ensure the presence of a '\0' character, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted locale_get_primary_language call.

Affected products and versions

  • PHP — Up to and including 5.5.35
  • PHP versions 5.6.0alpha1, 5.6.0alpha2, 5.6.0alpha3, 5.6.0alpha4, 5.6.0alpha5, 5.6.0beta1, 5.6.0beta2, 5.6.0beta3, 5.6.0beta4, 5.6.1, 5.6.2, 5.6.3, 5.6.4, 5.6.5, 5.6.6, 5.6.7, 5.6.8, 5.6.9, 5.6.10, 5.6.11, 5.6.12, 5.6.13, 5.6.14, 5.6.15, 5.6.16, 5.6.17, 5.6.18, 5.6.19, 5.6.20, 5.6.21, 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6

References

  • php.net http://php.net/ChangeLog-5.php Patch, Release Notes
  • php.net http://php.net/ChangeLog-7.php Patch, Release Notes
  • rhn.redhat.com http://rhn.redhat.com/errata/RHSA-2016-2750.html
  • www.debian.org http://www.debian.org/security/2016/dsa-3602
  • www.openwall.com http://www.openwall.com/lists/oss-security/2016/05/26/3 Release Notes
  • www.securityfocus.com http://www.securityfocus.com/bid/90946
  • bugs.php.net https://bugs.php.net/bug.php?id=72241 Exploit
  • github.com https://github.com/php/php-src/commit/97eff7eb57fc2320c267a949cffd622c38712484?w=1 Patch
  • h20566.www2.hpe.com https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05240731
  • nvd.nist.gov Official NVD record