CVE-2016-6296: Buffer Overflow

Q: What is the severity of CVE-2016-6296?

CVE-2016-6296 has a high severity rating due to its potential to cause a denial of service and security risks.

Q: How do I fix CVE-2016-6296?

To fix CVE-2016-6296, upgrade PHP to version 5.5.38, 5.6.24, or 7.0.9 or later.

Q: What systems are affected by CVE-2016-6296?

CVE-2016-6296 affects PHP versions prior to 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9.

Q: What type of vulnerability is CVE-2016-6296?

CVE-2016-6296 is an integer signedness error leading to a heap-based buffer overflow.

Q: Can CVE-2016-6296 be exploited remotely?

Yes, CVE-2016-6296 can be exploited remotely to cause denial of service.

Published Jul 25, 2016

Updated

Integer signedness error in the simplestringaddn function in simplestring.c in xmlrpc-epi through 0.54.2, as used in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9, allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a long first argument to the PHP xmlrpcencoderequest function.

Other sources

Fixed bug (heap-buffer-overflow (write) simplestringaddn simplestring.c). (CVE-2016-6296)

— PHP

Affected Software

41 affected componentsFixes available

PHP PHP<=5.5.37

PHP PHP=5.6.0-alpha1

PHP PHP=5.6.0-alpha2

PHP PHP=5.6.0-alpha3

PHP PHP=5.6.0-alpha4

PHP PHP=5.6.0-alpha5

PHP PHP=5.6.0-beta1

PHP PHP=5.6.0-beta2

PHP PHP=5.6.0-beta3

PHP PHP=5.6.0-beta4

PHP PHP=5.6.1

PHP PHP=5.6.2

PHP PHP=5.6.3

PHP PHP=5.6.4

PHP PHP=5.6.5

PHP PHP=5.6.6

PHP PHP=5.6.7

PHP PHP=5.6.8

PHP PHP=5.6.9

PHP PHP=5.6.10

PHP PHP=5.6.11

PHP PHP=5.6.12

PHP PHP=5.6.13

PHP PHP=5.6.14

PHP PHP=5.6.15

PHP PHP=5.6.16

PHP PHP=5.6.17

PHP PHP=5.6.18

PHP PHP=5.6.19

PHP PHP=5.6.20

PHP PHP=5.6.21

PHP PHP=5.6.22

PHP PHP=5.6.23

PHP PHP=7.0.0

PHP PHP=7.0.1

PHP PHP=7.0.2

PHP PHP=7.0.3

PHP PHP=7.0.4

PHP PHP=7.0.5

PHP PHP=7.0.8

PHP PHP<7.0.9

7.0.9

Event History

Jul 25, 2016

CVE Published

via MITRE·02:00 PM

Data Sourced

via MITRE·02:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2016-6296?

CVE-2016-6296 has a high severity rating due to its potential to cause a denial of service and security risks.

How do I fix CVE-2016-6296?