CVE-2016-5768: Double Free

Q: What is the severity of CVE-2016-5768?

CVE-2016-5768 is considered a critical vulnerability that can allow remote attackers to execute arbitrary code or cause denial of service.

Q: How do I fix CVE-2016-5768?

To fix CVE-2016-5768, you should upgrade to PHP version 5.5.37, 5.6.23, or 7.0.8 or later.

Q: Which versions of PHP are affected by CVE-2016-5768?

CVE-2016-5768 affects PHP versions prior to 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8.

Q: What is the impact of CVE-2016-5768 on PHP applications?

The impact of CVE-2016-5768 includes potential execution of arbitrary code and application crashes.

Q: Are there any workarounds for CVE-2016-5768?

Currently, it is recommended to apply the updates as there are no effective workarounds for CVE-2016-5768.

Published Aug 7, 2016

Updated

Double free vulnerability in the phpmbregexeregreplaceexec function in phpmbregex.c in the mbstring extension in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) by leveraging a callback exception.

Other sources

Fixed bug (phpmbregexeregreplaceexec - double free). (CVE-2016-5768)

— PHP

Affected Software

41 affected componentsFixes available

PHP PHP<=5.5.36

PHP PHP=5.6.0-alpha1

PHP PHP=5.6.0-alpha2

PHP PHP=5.6.0-alpha3

PHP PHP=5.6.0-alpha4

PHP PHP=5.6.0-alpha5

PHP PHP=5.6.0-beta1

PHP PHP=5.6.0-beta2

PHP PHP=5.6.0-beta3

PHP PHP=5.6.0-beta4

PHP PHP=5.6.1

PHP PHP=5.6.2

PHP PHP=5.6.3

PHP PHP=5.6.4

PHP PHP=5.6.5

PHP PHP=5.6.6

PHP PHP=5.6.7

PHP PHP=5.6.8

PHP PHP=5.6.9

PHP PHP=5.6.10

PHP PHP=5.6.11

PHP PHP=5.6.12

PHP PHP=5.6.13

PHP PHP=5.6.14

PHP PHP=5.6.15

PHP PHP=5.6.16

PHP PHP=5.6.17

PHP PHP=5.6.18

PHP PHP=5.6.19

PHP PHP=5.6.20

PHP PHP=5.6.21

PHP PHP=5.6.22

PHP PHP=7.0.0

PHP PHP=7.0.1

PHP PHP=7.0.2

PHP PHP=7.0.3

PHP PHP=7.0.4

PHP PHP=7.0.5

PHP PHP=7.0.6

PHP PHP=7.0.7

PHP PHP<7.0.8

7.0.8

Remediation

Patch Available

http://php.net/ChangeLog-5.php

Event History

Aug 7, 2016

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2016-5768?