CVE-2016-6296 Integer overflow in n/a
Remote attackers can cause denial of service or potential code execution via integer overflow in xmlrpc-epi used by PHP.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2016-6296?
CVE-2016-6296 is a critical vulnerability in Php Php, published on 25 Jul 2016. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Integer signedness error in the simplestring_addn function in simplestring.c in xmlrpc-epi through 0.54.2, as used in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9, allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a long first argument to the PHP xmlrpc_encode_request function.
Weakness: CWE-119
Which versions are affected by CVE-2016-6296?
It affects 1 product.
Products include Php Php.
How do I fix CVE-2016-6296?
Upgrade to a fixed version.
Is CVE-2016-6296 being exploited?
There is no known exploitation of CVE-2016-6296 in the wild and no public exploit code.
Other vulnerabilities in Php Php
Sources
Also known as DEBIAN-CVE-2016-6296, DLA-2011-1, DLA-569-1, GHSA-5gfp-g883-wjfx, UBUNTU-CVE-2016-6296, USN-3059-1.