CVE-2016-6294: Critical severity php vulnerability
The localeacceptfromhttp function in ext/intl/locale/localemethods.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 does not properly restrict calls to the ICU ulocacceptLanguageFromHTTP function, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a call with a long argument.
Other sources
Fixed bug (localeacceptfromhttp out-of-bounds access). (CVE-2016-6294)
— PHP
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2016-6294?
CVE-2016-6294 is classified as a denial of service vulnerability.
How do I fix CVE-2016-6294?
To fix CVE-2016-6294, upgrade PHP to version 5.5.38, 5.6.24, or 7.0.9 or later.
What versions of PHP are affected by CVE-2016-6294?
CVE-2016-6294 affects PHP versions prior to 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9.
What type of attack does CVE-2016-6294 facilitate?
CVE-2016-6294 allows remote attackers to cause a denial of service through out-of-bounds read.
Is CVE-2016-6294 a critical vulnerability?
CVE-2016-6294 is serious due to its ability to cause denial of service, but it does not allow for remote code execution.