CVE-2016-7398: Incorrect Type Cast
A type confusion vulnerability in the mergeparam() function of phphttpparams.c in PHP's pecl-http extension 3.1.0beta2 (PHP 7) and earlier as well as 2.6.0beta2 (PHP 5) and earlier allows attackers to crash PHP and possibly execute arbitrary code via crafted HTTP requests.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2016-7398?
CVE-2016-7398 is considered a high severity vulnerability due to its potential to allow arbitrary code execution and crashes in PHP.
How do I fix CVE-2016-7398?
To fix CVE-2016-7398, update to PECL HTTP extension version 3.1.0 or later for PHP 7, and version 2.5.6 or later for PHP 5.
What software is affected by CVE-2016-7398?
CVE-2016-7398 affects PECL HTTP extension versions prior to 3.1.0 for PHP 7 and versions prior to 2.5.6 for PHP 5.
Can CVE-2016-7398 be exploited remotely?
Yes, CVE-2016-7398 can be exploited remotely through crafted HTTP requests.
Is CVE-2016-7398 patched in later versions?
Yes, CVE-2016-7398 has been patched in subsequent releases of the PECL HTTP extension.