CVE-2016-4539: Buffer Overflow
Fixed bug (xmlparseintostruct segmentation fault). (CVE-2016-4539)
Other sources
The xmlparseintostruct function in ext/xml/xml.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 allows remote attackers to cause a denial of service (buffer under-read and segmentation fault) or possibly have unspecified other impact via crafted XML data in the second argument, leading to a parser level of zero.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is CVE-2016-4539?
CVE-2016-4539 is a vulnerability in the xml_parse_into_struct function in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 that allows remote attackers to cause a denial of service or possibly have other impact via crafted XML data.
How severe is CVE-2016-4539?
CVE-2016-4539 is considered a critical vulnerability with a severity score of 9.8.
How can I fix CVE-2016-4539?
To fix CVE-2016-4539, you should update PHP to version 5.5.35, 5.6.21, or 7.0.6 or later.
Where can I find more information about CVE-2016-4539?
You can find more information about CVE-2016-4539 in the PHP ChangeLog for version 7.0.6 and the oss-security mailing list.
What is CWE-119?
CWE-119 is a category of vulnerabilities related to buffer errors, including buffer overflows, buffer underflows, and buffer over-reads.