PT-2016-3403 · Php+1 · Php+1

Taoguangchen · Published 2016-07-05 · Updated 2022-07-20 · CVE-2016-5770

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PHP versions prior to 5.5.37 PHP versions 5.6.x prior to 5.6.23

Description The issue is caused by an integer overflow in the SplFileObject::fread function, which can be exploited by remote attackers to cause a denial of service or possibly have other unspecified impacts via a large integer argument.

Recommendations For PHP versions prior to 5.5.37, update to version 5.5.37 or later. For PHP versions 5.6.x prior to 5.6.23, update to version 5.6.23 or later.

Exploit

Fix

DoS

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

BDU:2022-02541

CVE-2016-5770

DLA-628-1

DSA-3618-1

MGASA-2016-0238

OPENSUSE-SU-2016_1761-1

RHSA-2016:2750

SUSE-SU-2016:1842-1

Affected Products

Php

Suse

References · 74

• 🔥 https://bugs.php.net/bug.php?id=72262 · Exploit
• https://osv.dev/vulnerability/SUSE-SU-2016:1842-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-02543 · Security Note
• http://debian.org/security/2016/dsa-3618 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-5770 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5770 · Security Note
• https://bdu.fstec.ru/vul/2022-02517 · Security Note
• https://bdu.fstec.ru/vul/2022-02539 · Security Note
• https://security-tracker.debian.org/tracker/DSA-3618-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-updates/2016-08/msg00003.html · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2016-0238 · Vendor Advisory
• http://lists.apple.com/archives/security-announce/2016/Sep/msg00006.html · Vendor Advisory
• https://osv.dev/vulnerability/DSA-3618-1 · Vendor Advisory
• http://php.net/ChangeLog-5.php · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-02541 · Security Note