CVE-2016-6290: Use After Free

Q: What is the severity of CVE-2016-6290?

CVE-2016-6290 has a severity level that allows for denial of service and potential use-after-free vulnerabilities.

Q: How do I fix CVE-2016-6290?

To fix CVE-2016-6290, upgrade PHP to version 5.5.38, 5.6.24, or 7.0.9 or later.

Q: What versions of PHP are affected by CVE-2016-6290?

CVE-2016-6290 affects PHP versions before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9.

Q: Can CVE-2016-6290 lead to security breaches?

Yes, CVE-2016-6290 can potentially allow attackers to cause a denial of service or exploit other unspecified impacts.

Q: Is CVE-2016-6290 specific to any PHP configurations?

CVE-2016-6290 is not limited to specific configurations; it is a vulnerability present in the affected PHP versions regardless of setup.

Published Jul 25, 2016

Updated

ext/session/session.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 does not properly maintain a certain hash data structure, which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via vectors related to session deserialization.

Affected Software

40 affected components

PHP PHP<=5.5.37

PHP PHP=5.6.0-alpha1

PHP PHP=5.6.0-alpha2

PHP PHP=5.6.0-alpha3

PHP PHP=5.6.0-alpha4

PHP PHP=5.6.0-alpha5

PHP PHP=5.6.0-beta1

PHP PHP=5.6.0-beta2

PHP PHP=5.6.0-beta3

PHP PHP=5.6.0-beta4

PHP PHP=5.6.1

PHP PHP=5.6.2

PHP PHP=5.6.3

PHP PHP=5.6.4

PHP PHP=5.6.5

PHP PHP=5.6.6

PHP PHP=5.6.7

PHP PHP=5.6.8

PHP PHP=5.6.9

PHP PHP=5.6.10

PHP PHP=5.6.11

PHP PHP=5.6.12

PHP PHP=5.6.13

PHP PHP=5.6.14

PHP PHP=5.6.15

PHP PHP=5.6.16

PHP PHP=5.6.17

PHP PHP=5.6.18

PHP PHP=5.6.19

PHP PHP=5.6.20

PHP PHP=5.6.21

PHP PHP=5.6.22

PHP PHP=5.6.23

PHP PHP=7.0.0

PHP PHP=7.0.1

PHP PHP=7.0.2

PHP PHP=7.0.3

PHP PHP=7.0.4

PHP PHP=7.0.5

PHP PHP=7.0.8

Event History

Jul 25, 2016

CVE Published

via MITRE·02:00 PM

Data Sourced

via MITRE·02:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2016-6290?

CVE-2016-6290 has a severity level that allows for denial of service and potential use-after-free vulnerabilities.

How do I fix CVE-2016-6290?

To fix CVE-2016-6290, upgrade PHP to version 5.5.38, 5.6.24, or 7.0.9 or later.

What versions of PHP are affected by CVE-2016-6290?