CVE-2016-3171: Code Injection

Q: What is the severity of CVE-2016-3171?

CVE-2016-3171 has been classified with Medium severity.

Q: How do I fix CVE-2016-3171?

To fix CVE-2016-3171, upgrade to Drupal 6.38 or later.

Q: What are the affected versions for CVE-2016-3171?

CVE-2016-3171 affects Drupal versions prior to 6.38 when used with certain versions of PHP.

Q: Can CVE-2016-3171 lead to remote code execution?

Yes, CVE-2016-3171 allows remote attackers to execute arbitrary code through session data truncation.

Q: Is my PHP version related to CVE-2016-3171?

Yes, CVE-2016-3171 is particularly relevant for environments running PHP versions earlier than 5.4.45, 5.5.29, or 5.6.13.

Published Feb 15, 2016

Updated

Drupal 6.x before 6.38, when used with PHP before 5.4.45, 5.5.x before 5.5.29, or 5.6.x before 5.6.13, might allow remote attackers to execute arbitrary code via vectors related to session data truncation.

Other sources

Session data truncation can lead to unserialization of user provided data

Affected Software

206 affected componentsFixes available

composer/drupal/core>=8.0, <8.0.4

composer/drupal/drupal>=8.0, <8.0.4

composer/drupal/drupal>=6.0<6.38

6.38

composer/drupal/core>=6.0<6.38

6.38

All of the following

Any of the following

PHP PHP<=5.4.44

PHP PHP=5.5.0

PHP PHP=5.5.0-alpha1

PHP PHP=5.5.0-alpha2

PHP PHP=5.5.0-alpha3

PHP PHP=5.5.0-alpha4

PHP PHP=5.5.0-alpha5

PHP PHP=5.5.0-alpha6

PHP PHP=5.5.0-beta1

PHP PHP=5.5.0-beta2

PHP PHP=5.5.0-beta3

PHP PHP=5.5.0-beta4

PHP PHP=5.5.0-rc1

PHP PHP=5.5.0-rc2

PHP PHP=5.5.1

PHP PHP=5.5.2

PHP PHP=5.5.10

PHP PHP=5.5.11

PHP PHP=5.5.12

PHP PHP=5.5.13

PHP PHP=5.5.14

PHP PHP=5.5.18

PHP PHP=5.5.19

PHP PHP=5.5.20

PHP PHP=5.5.21

PHP PHP=5.5.22

PHP PHP=5.5.23

PHP PHP=5.5.24

PHP PHP=5.5.25

PHP PHP=5.5.26

PHP PHP=5.5.27

PHP PHP=5.5.28

PHP PHP=5.6.0-alpha1

PHP PHP=5.6.0-alpha2

PHP PHP=5.6.0-alpha3

PHP PHP=5.6.0-alpha4

PHP PHP=5.6.0-alpha5

PHP PHP=5.6.0-beta1

PHP PHP=5.6.0-beta2

PHP PHP=5.6.0-beta3

PHP PHP=5.6.0-beta4

PHP PHP=5.6.1

PHP PHP=5.6.2

PHP PHP=5.6.3

PHP PHP=5.6.4

PHP PHP=5.6.5

PHP PHP=5.6.6

PHP PHP=5.6.7

PHP PHP=5.6.8

PHP PHP=5.6.9

PHP PHP=5.6.10

PHP PHP=5.6.11

PHP PHP=5.6.12

Any of the following

Drupal Drupal=6.0

Drupal Drupal=6.0-beta1

Drupal Drupal=6.0-beta2

Drupal Drupal=6.0-beta3

Drupal Drupal=6.0-beta4

Drupal Drupal=6.0-dev

Drupal Drupal=6.0-rc1

Drupal Drupal=6.0-rc2

Drupal Drupal=6.0-rc3

Drupal Drupal=6.0-rc4

Drupal Drupal=6.1

Drupal Drupal=6.2

Drupal Drupal=6.3

Drupal Drupal=6.4

Drupal Drupal=6.5

Drupal Drupal=6.6

Drupal Drupal=6.7

Drupal Drupal=6.8

Drupal Drupal=6.9

Drupal Drupal=6.10

Drupal Drupal=6.11

Drupal Drupal=6.12

Drupal Drupal=6.13

Drupal Drupal=6.14

Drupal Drupal=6.15

Drupal Drupal=6.16

Drupal Drupal=6.17

Drupal Drupal=6.18

Drupal Drupal=6.19

Drupal Drupal=6.20

Drupal Drupal=6.21

Drupal Drupal=6.22

Drupal Drupal=6.23

Drupal Drupal=6.24

Drupal Drupal=6.25

Drupal Drupal=6.26

Drupal Drupal=6.27

Drupal Drupal=6.28

Drupal Drupal=6.29

Drupal Drupal=6.30

Drupal Drupal=6.31

Drupal Drupal=6.32

Drupal Drupal=6.33

Drupal Drupal=6.34

Drupal Drupal=6.35

Drupal Drupal=6.36

Drupal Drupal=6.37

Debian Debian Linux=7.0

Debian Debian Linux=8.0