CVE-2016-5114: Buffer Overflow
sapi/fpm/fpm/fpmlog.c in PHP before 5.5.31, 5.6.x before 5.6.17, and 7.x before 7.0.2 misinterprets the semantics of the snprintf return value, which allows attackers to obtain sensitive information from process memory or cause a denial of service (out-of-bounds read and buffer overflow) via a long string, as demonstrated by a long URI in a configuration with custom REQUESTURI logging.
Other sources
Fixed bug (fpmlog.c memory leak and buffer overflow). (CVE-2016-5114)
— PHP
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2016-5114?
CVE-2016-5114 has a high severity rating due to its potential to expose sensitive information and cause denial of service.
How do I fix CVE-2016-5114?
To fix CVE-2016-5114, upgrade to PHP version 5.5.31, 5.6.17, or 7.0.2 or later.
What types of attacks can CVE-2016-5114 enable?
CVE-2016-5114 can enable attackers to read sensitive process memory or trigger a buffer overflow.
Which PHP versions are affected by CVE-2016-5114?
CVE-2016-5114 affects PHP versions earlier than 5.5.31, 5.6.x before 5.6.17, and earlier than 7.0.2.
Is CVE-2016-5114 considered a critical vulnerability?
Yes, CVE-2016-5114 is considered critical due to its potential for significant exploitation risks.