CVE-2016-5094
HIGH
8.6
CVSS 3.0
Description
Integer overflow in the php_html_entities function in ext/standard/html.c in PHP before 5.5.36 and 5.6.x before 5.6.22 allows remote attackers to cause a denial of service or possibly have unspecified other impact by triggering a large output string from the htmlspecialchars function.
Affected products and versions
- PHP — Up to and including 5.5.36
- PHP versions 5.6.0alpha1, 5.6.0alpha2, 5.6.0alpha3, 5.6.0alpha4, 5.6.0alpha5, 5.6.0beta1, 5.6.0beta2, 5.6.0beta3, 5.6.0beta4, 5.6.1, 5.6.2, 5.6.3, 5.6.4, 5.6.5, 5.6.6, 5.6.7, 5.6.8, 5.6.9, 5.6.10, 5.6.11, 5.6.12, 5.6.13, 5.6.14, 5.6.15, 5.6.16, 5.6.17, 5.6.18, 5.6.19, 5.6.20, 5.6.21
References
- php.net http://php.net/ChangeLog-5.php Release Notes
- rhn.redhat.com http://rhn.redhat.com/errata/RHSA-2016-2750.html
- www.debian.org http://www.debian.org/security/2016/dsa-3602
- www.openwall.com http://www.openwall.com/lists/oss-security/2016/05/26/3 Release Notes
- www.securityfocus.com http://www.securityfocus.com/bid/90857
- bugs.php.net https://bugs.php.net/bug.php?id=72135
- github.com https://github.com/php/php-src/commit/0da8b8b801f9276359262f1ef8274c7812d3dfda?w=1
- h20566.www2.hpe.com https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05240731
- nvd.nist.gov Official NVD record