CVE-2016-5096: Integer Overflow
Published Aug 7, 2016
·Updated
Integer overflow in the fread function in ext/standard/file.c in PHP before 5.5.36 and 5.6.x before 5.6.22 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a large integer in the second argument.
Affected Software
31 affected components
PHP PHP<=5.5.35
PHP PHP=5.6.0-alpha1
PHP PHP=5.6.0-alpha2
PHP PHP=5.6.0-alpha3
PHP PHP=5.6.0-alpha4
PHP PHP=5.6.0-alpha5
PHP PHP=5.6.0-beta1
PHP PHP=5.6.0-beta2
PHP PHP=5.6.0-beta3
PHP PHP=5.6.0-beta4
PHP PHP=5.6.1
PHP PHP=5.6.2
PHP PHP=5.6.3
PHP PHP=5.6.4
PHP PHP=5.6.5
PHP PHP=5.6.6
PHP PHP=5.6.7
PHP PHP=5.6.8
PHP PHP=5.6.9
PHP PHP=5.6.10
PHP PHP=5.6.11
PHP PHP=5.6.12
PHP PHP=5.6.13
PHP PHP=5.6.14
PHP PHP=5.6.15
PHP PHP=5.6.16
PHP PHP=5.6.17
PHP PHP=5.6.18
PHP PHP=5.6.19
PHP PHP=5.6.20
PHP PHP=5.6.21
Remediation
Patch Available
Event History
Aug 7, 2016
CVE Published
via MITRE·10:00 AM
Data Sourced
via MITRE·10:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2016-5096?
CVE-2016-5096 is classified as a high-severity vulnerability that can lead to denial of service.
2
How do I fix CVE-2016-5096?
To fix CVE-2016-5096, upgrade your PHP version to 5.5.36 or 5.6.22 or later.
3
What software versions are affected by CVE-2016-5096?
CVE-2016-5096 affects PHP versions before 5.5.36 and 5.6 versions before 5.6.22.
4
What type of vulnerability is CVE-2016-5096?
CVE-2016-5096 is an integer overflow vulnerability in the fread function.
5
Can CVE-2016-5096 be exploited remotely?
Yes, CVE-2016-5096 can be exploited by remote attackers through manipulation of the fread function's parameters.