blogsafe.org My Downloads

BlogSafe.org

PHP CVEs

Vulnerabilities in the PHP language itself, and which PHP versions they affect.

← Back to CVE list

CVE-2016-5769

CRITICAL 9.8 CVSS 3.0
Published
August 7, 2016
Last modified
June 17, 2026
NVD status
Modified
Reported by
cve@mitre.org
Weakness
CWE-190
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

Multiple integer overflows in mcrypt.c in the mcrypt extension in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8 allow remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted length value, related to the (1) mcrypt_generic and (2) mdecrypt_generic functions.

Affected products and versions

  • PHP — Up to and including 5.5.36
  • PHP versions 5.6.0alpha1, 5.6.0alpha2, 5.6.0alpha3, 5.6.0alpha4, 5.6.0alpha5, 5.6.0beta1, 5.6.0beta2, 5.6.0beta3, 5.6.0beta4, 5.6.1, 5.6.2, 5.6.3, 5.6.4, 5.6.5, 5.6.6, 5.6.7, 5.6.8, 5.6.9, 5.6.10, 5.6.11, 5.6.12, 5.6.13, 5.6.14, 5.6.15, 5.6.16, 5.6.17, 5.6.18, 5.6.19, 5.6.20, 5.6.21, 5.6.22, 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7

References

  • github.com http://github.com/php/php-src/commit/6c5211a0cef0cc2854eaa387e0eb036e012904d0?w=1
  • lists.apple.com http://lists.apple.com/archives/security-announce/2016/Sep/msg00006.html
  • lists.opensuse.org http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00004.html
  • lists.opensuse.org http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00025.html
  • lists.opensuse.org http://lists.opensuse.org/opensuse-updates/2016-08/msg00003.html
  • php.net http://php.net/ChangeLog-5.php Patch, Release Notes
  • php.net http://php.net/ChangeLog-7.php Broken Link
  • www.debian.org http://www.debian.org/security/2016/dsa-3618
  • www.openwall.com http://www.openwall.com/lists/oss-security/2016/06/23/4 Release Notes
  • www.securityfocus.com http://www.securityfocus.com/bid/91399
  • bugs.php.net https://bugs.php.net/bug.php?id=72455 Vendor Advisory
  • h20566.www2.hpe.com https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05240731
  • support.apple.com https://support.apple.com/HT207170
  • nvd.nist.gov Official NVD record