CVE-2016-7133: Integer Overflow
Zend/zendalloc.c in PHP 7.x before 7.0.10, when openbasedir is enabled, mishandles huge realloc operations, which allows remote attackers to cause a denial of service (integer overflow) or possibly have unspecified other impact via a long pathname.
Other sources
Fixed bug (memory allocator fails to realloc small block to large one). (CVE-2016-7133)
— PHP
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2016-7133?
CVE-2016-7133 has a severity level classified as medium, primarily causing denial of service due to integer overflow.
How do I fix CVE-2016-7133?
To fix CVE-2016-7133, you should upgrade PHP to version 7.0.10 or later.
Which versions of PHP are affected by CVE-2016-7133?
CVE-2016-7133 affects PHP versions 7.0.0 through 7.0.9.
What type of attack is facilitated by CVE-2016-7133?
CVE-2016-7133 allows remote attackers to exploit integer overflow through crafted long pathnames.
Is there any other impact from CVE-2016-7133 besides denial of service?
While primarily enabling denial of service, CVE-2016-7133 could potentially allow for unspecified additional impacts.