CVE-2016-5769: Buffer Overflow

Q: What is the severity of CVE-2016-5769?

CVE-2016-5769 has a severity rating that allows remote attackers to cause a denial of service through heap-based buffer overflow.

Q: How do I fix CVE-2016-5769?

To fix CVE-2016-5769, update PHP to version 5.5.37, 5.6.23, or 7.0.8 or later.

Q: What versions of PHP are affected by CVE-2016-5769?

CVE-2016-5769 affects PHP versions prior to 5.5.37, 5.6.23, and 7.0.8.

Q: What type of vulnerability is CVE-2016-5769?

CVE-2016-5769 is an integer overflow vulnerability that can lead to heap-based buffer overflow.

Q: Can CVE-2016-5769 be exploited remotely?

Yes, CVE-2016-5769 can be exploited remotely, allowing attackers to crash the application.

Published Aug 7, 2016

Updated

Multiple integer overflows in mcrypt.c in the mcrypt extension in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8 allow remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted length value, related to the (1) mcryptgeneric and (2) mdecryptgeneric functions.

Other sources

Fixed bug (Heap Overflow due to integer overflows). (CVE-2016-5769)

— PHP

Affected Software

41 affected componentsFixes available

PHP PHP<=5.5.36

PHP PHP=5.6.0-alpha1

PHP PHP=5.6.0-alpha2

PHP PHP=5.6.0-alpha3

PHP PHP=5.6.0-alpha4

PHP PHP=5.6.0-alpha5

PHP PHP=5.6.0-beta1

PHP PHP=5.6.0-beta2

PHP PHP=5.6.0-beta3

PHP PHP=5.6.0-beta4

PHP PHP=5.6.1

PHP PHP=5.6.2

PHP PHP=5.6.3

PHP PHP=5.6.4

PHP PHP=5.6.5

PHP PHP=5.6.6

PHP PHP=5.6.7

PHP PHP=5.6.8

PHP PHP=5.6.9

PHP PHP=5.6.10

PHP PHP=5.6.11

PHP PHP=5.6.12

PHP PHP=5.6.13

PHP PHP=5.6.14

PHP PHP=5.6.15

PHP PHP=5.6.16

PHP PHP=5.6.17

PHP PHP=5.6.18

PHP PHP=5.6.19

PHP PHP=5.6.20

PHP PHP=5.6.21

PHP PHP=5.6.22

PHP PHP=7.0.0

PHP PHP=7.0.1

PHP PHP=7.0.2

PHP PHP=7.0.3

PHP PHP=7.0.4

PHP PHP=7.0.5

PHP PHP=7.0.6

PHP PHP=7.0.7

PHP PHP<7.0.8

7.0.8

Remediation

Patch Available

http://php.net/ChangeLog-5.php

Event History

Aug 7, 2016

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2016-5769?