blogsafe.org My Downloads

BlogSafe.org

PHP CVEs

Vulnerabilities in the PHP language itself, and which PHP versions they affect.

← Back to CVE list

CVE-2016-5768

CRITICAL 9.8 CVSS 3.0
Published
August 7, 2016
Last modified
June 17, 2026
NVD status
Modified
Reported by
cve@mitre.org
Weakness
CWE-415
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

Double free vulnerability in the _php_mb_regex_ereg_replace_exec function in php_mbregex.c in the mbstring extension in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) by leveraging a callback exception.

Affected products and versions

  • PHP — Up to and including 5.5.36
  • PHP versions 5.6.0alpha1, 5.6.0alpha2, 5.6.0alpha3, 5.6.0alpha4, 5.6.0alpha5, 5.6.0beta1, 5.6.0beta2, 5.6.0beta3, 5.6.0beta4, 5.6.1, 5.6.2, 5.6.3, 5.6.4, 5.6.5, 5.6.6, 5.6.7, 5.6.8, 5.6.9, 5.6.10, 5.6.11, 5.6.12, 5.6.13, 5.6.14, 5.6.15, 5.6.16, 5.6.17, 5.6.18, 5.6.19, 5.6.20, 5.6.21, 5.6.22, 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7

References

  • github.com http://github.com/php/php-src/commit/5b597a2e5b28e2d5a52fc1be13f425f08f47cb62?w=1
  • lists.apple.com http://lists.apple.com/archives/security-announce/2016/Sep/msg00006.html
  • lists.opensuse.org http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00004.html
  • lists.opensuse.org http://lists.opensuse.org/opensuse-updates/2016-08/msg00003.html
  • php.net http://php.net/ChangeLog-5.php Patch, Release Notes
  • php.net http://php.net/ChangeLog-7.php Release Notes
  • rhn.redhat.com http://rhn.redhat.com/errata/RHSA-2016-2598.html
  • rhn.redhat.com http://rhn.redhat.com/errata/RHSA-2016-2750.html
  • www.debian.org http://www.debian.org/security/2016/dsa-3618
  • www.openwall.com http://www.openwall.com/lists/oss-security/2016/06/23/4 Release Notes
  • www.securityfocus.com http://www.securityfocus.com/bid/91396
  • bugs.php.net https://bugs.php.net/bug.php?id=72402 Exploit, Vendor Advisory
  • h20566.www2.hpe.com https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05240731
  • support.apple.com https://support.apple.com/HT207170
  • nvd.nist.gov Official NVD record