CVE-2016-4070: Integer Overflow
DISPUTED Integer overflow in the phprawurlencode function in ext/standard/url.c in PHP before 5.5.34, 5.6.x before 5.6.20, and 7.x before 7.0.5 allows remote attackers to cause a denial of service (application crash) via a long string to the rawurlencode function. NOTE: the vendor says "Not sure if this qualifies as security issue (probably not)."
Other sources
Fixed bug (Integer Overflow in phprawurlencode). (CVE-2016-4070)
— PHP
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2016-4070?
CVE-2016-4070 is a vulnerability in PHP versions before 5.5.34, 5.6.x before 5.6.20, and 7.x before 7.0.5 that allows remote attackers to cause a denial of service (application crash) via a long string to the rawurlencode function.
Who is affected by CVE-2016-4070?
Users of PHP versions before 5.5.34, 5.6.x before 5.6.20, and 7.x before 7.0.5 are affected by this vulnerability.
What is the severity of CVE-2016-4070?
The severity of CVE-2016-4070 is high, with a CVSS score of 7.5.
How can I fix CVE-2016-4070?
To fix CVE-2016-4070, upgrade PHP to version 5.5.34, 5.6.20, or 7.0.5, depending on your PHP version.
Where can I find more information about CVE-2016-4070?
You can find more information about CVE-2016-4070 at the following links: [1] https://www.php.net/ChangeLog-7.php#7.0.5 [2] http://www.openwall.com/lists/oss-security/2016/04/24/1 [3] http://www.php.net/ChangeLog-5.php