CVE-2016-6296
CRITICAL
9.8
CVSS 3.0
Description
Integer signedness error in the simplestring_addn function in simplestring.c in xmlrpc-epi through 0.54.2, as used in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9, allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a long first argument to the PHP xmlrpc_encode_request function.
Affected products and versions
- PHP — Up to and including 5.5.37
- PHP versions 5.6.0alpha1, 5.6.0alpha2, 5.6.0alpha3, 5.6.0alpha4, 5.6.0alpha5, 5.6.0beta1, 5.6.0beta2, 5.6.0beta3, 5.6.0beta4, 5.6.1, 5.6.2, 5.6.3, 5.6.4, 5.6.5, 5.6.6, 5.6.7, 5.6.8, 5.6.9, 5.6.10, 5.6.11, 5.6.12, 5.6.13, 5.6.14, 5.6.15, 5.6.16, 5.6.17, 5.6.18, 5.6.19, 5.6.20, 5.6.21, 5.6.22, 5.6.23, 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.8
References
- git.php.net http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=e6c48213c22ed50b2b987b479fcc1ac709394caa
- lists.apple.com http://lists.apple.com/archives/security-announce/2016/Sep/msg00006.html
- openwall.com http://openwall.com/lists/oss-security/2016/07/24/2 Mailing List
- php.net http://php.net/ChangeLog-5.php Release Notes
- php.net http://php.net/ChangeLog-7.php Release Notes
- rhn.redhat.com http://rhn.redhat.com/errata/RHSA-2016-2750.html
- www.debian.org http://www.debian.org/security/2016/dsa-3631
- www.securityfocus.com http://www.securityfocus.com/bid/92095 Third Party Advisory, VDB Entry
- www.securitytracker.com http://www.securitytracker.com/id/1036430
- www.ubuntu.com http://www.ubuntu.com/usn/USN-3059-1
- bugs.php.net https://bugs.php.net/72606 Exploit, Issue Tracking
- lists.debian.org https://lists.debian.org/debian-lts-announce/2019/11/msg00029.html
- security.gentoo.org https://security.gentoo.org/glsa/201611-22
- support.apple.com https://support.apple.com/HT207170
- nvd.nist.gov Official NVD record