CVE-2016-5095: Integer Overflow

Q: What is the severity of CVE-2016-5095?

CVE-2016-5095 has a severity rating that could lead to denial of service as a result of an integer overflow in PHP.

Q: How do I fix CVE-2016-5095?

To resolve CVE-2016-5095, upgrade to PHP versions 5.5.36 or later, or to PHP 5.6.22 or later.

Q: What versions of PHP are affected by CVE-2016-5095?

CVE-2016-5095 affects PHP versions prior to 5.5.36 and versions of 5.6.x before 5.6.22.

Q: What type of exploitation is possible with CVE-2016-5095?

CVE-2016-5095 can be exploited by remote attackers to cause a denial of service.

Q: Is there a patch available for CVE-2016-5095?

Yes, the patch for CVE-2016-5095 is included in newer releases of PHP after the vulnerable versions.

Published Aug 7, 2016

Updated

Integer overflow in the phpescapehtmlentitiesex function in ext/standard/html.c in PHP before 5.5.36 and 5.6.x before 5.6.22 allows remote attackers to cause a denial of service or possibly have unspecified other impact by triggering a large output string from a FILTERSANITIZEFULLSPECIALCHARS filtervar call. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-5094.

Affected Software

31 affected components

PHP PHP<=5.5.35

PHP PHP=5.6.0-alpha1

PHP PHP=5.6.0-alpha2

PHP PHP=5.6.0-alpha3

PHP PHP=5.6.0-alpha4

PHP PHP=5.6.0-alpha5

PHP PHP=5.6.0-beta1

PHP PHP=5.6.0-beta2

PHP PHP=5.6.0-beta3

PHP PHP=5.6.0-beta4

PHP PHP=5.6.1

PHP PHP=5.6.2

PHP PHP=5.6.3

PHP PHP=5.6.4

PHP PHP=5.6.5

PHP PHP=5.6.6

PHP PHP=5.6.7

PHP PHP=5.6.8

PHP PHP=5.6.9

PHP PHP=5.6.10

PHP PHP=5.6.11

PHP PHP=5.6.12

PHP PHP=5.6.13

PHP PHP=5.6.14

PHP PHP=5.6.15

PHP PHP=5.6.16

PHP PHP=5.6.17

PHP PHP=5.6.18

PHP PHP=5.6.19

PHP PHP=5.6.20

PHP PHP=5.6.21

Event History

Aug 7, 2016

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2016-5095?

CVE-2016-5095 has a severity rating that could lead to denial of service as a result of an integer overflow in PHP.

How do I fix CVE-2016-5095?

To resolve CVE-2016-5095, upgrade to PHP versions 5.5.36 or later, or to PHP 5.6.22 or later.

What versions of PHP are affected by CVE-2016-5095?