CVE-2016-4538: Input Validation
Fixed bug (bcpowmod accepts negative scale and corrupts one definition). (CVE-2016-4537, CVE-2016-4538)
Other sources
The bcpowmod function in ext/bcmath/bcmath.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 modifies certain data structures without considering whether they are copies of the zero, one, or two global variable, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted call.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID for this bug?
The vulnerability ID for this bug is CVE-2016-4538.
What is the severity level of CVE-2016-4538?
The severity level of CVE-2016-4538 is critical.
How does CVE-2016-4538 impact PHP versions?
CVE-2016-4538 impacts PHP versions before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6.
What is the Fix for CVE-2016-4538?
The fix for CVE-2016-4538 is to upgrade to PHP version 5.5.35, 5.6.21, or 7.0.6.
Where can I find more information about CVE-2016-4538?
More information about CVE-2016-4538 can be found at the following references: [1], [2], [3].