FKIE_CVE-2016-6294

Vulnerability from fkie_nvd - Published: 2016-07-25 14:59 - Updated: 2025-04-12 10:46
Severity ?
9.8 (Critical) - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
The locale_accept_from_http function in ext/intl/locale/locale_methods.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 does not properly restrict calls to the ICU uloc_acceptLanguageFromHTTP function, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a call with a long argument.
References
cve@mitre.orghttp://git.php.net/?p=php-src.git%3Ba=commit%3Bh=aa82e99ed8003c01f1ef4f0940e56b85c5b032d4
cve@mitre.orghttp://lists.apple.com/archives/security-announce/2016/Sep/msg00006.html
cve@mitre.orghttp://openwall.com/lists/oss-security/2016/07/24/2Mailing List
cve@mitre.orghttp://php.net/ChangeLog-5.phpRelease Notes
cve@mitre.orghttp://php.net/ChangeLog-7.phpRelease Notes
cve@mitre.orghttp://rhn.redhat.com/errata/RHSA-2016-2750.html
cve@mitre.orghttp://www.debian.org/security/2016/dsa-3631
cve@mitre.orghttp://www.securityfocus.com/bid/92115Third Party Advisory, VDB Entry
cve@mitre.orghttp://www.securitytracker.com/id/1036430
cve@mitre.orghttps://bugs.php.net/72533Exploit, Issue Tracking, Mitigation, Patch, Third Party Advisory
cve@mitre.orghttps://security.gentoo.org/glsa/201611-22
cve@mitre.orghttps://support.apple.com/HT207170
af854a3a-2127-422b-91ae-364da2661108http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=aa82e99ed8003c01f1ef4f0940e56b85c5b032d4
af854a3a-2127-422b-91ae-364da2661108http://lists.apple.com/archives/security-announce/2016/Sep/msg00006.html
af854a3a-2127-422b-91ae-364da2661108http://openwall.com/lists/oss-security/2016/07/24/2Mailing List
af854a3a-2127-422b-91ae-364da2661108http://php.net/ChangeLog-5.phpRelease Notes
af854a3a-2127-422b-91ae-364da2661108http://php.net/ChangeLog-7.phpRelease Notes
af854a3a-2127-422b-91ae-364da2661108http://rhn.redhat.com/errata/RHSA-2016-2750.html
af854a3a-2127-422b-91ae-364da2661108http://www.debian.org/security/2016/dsa-3631
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/92115Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108http://www.securitytracker.com/id/1036430
af854a3a-2127-422b-91ae-364da2661108https://bugs.php.net/72533Exploit, Issue Tracking, Mitigation, Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://security.gentoo.org/glsa/201611-22
af854a3a-2127-422b-91ae-364da2661108https://support.apple.com/HT207170
Impacted products
Vendor Product Version
php php *
php php 5.6.0
php php 5.6.0
php php 5.6.0
php php 5.6.0
php php 5.6.0
php php 5.6.0
php php 5.6.0
php php 5.6.0
php php 5.6.0
php php 5.6.1
php php 5.6.2
php php 5.6.3
php php 5.6.4
php php 5.6.5
php php 5.6.6
php php 5.6.7
php php 5.6.8
php php 5.6.9
php php 5.6.10
php php 5.6.11
php php 5.6.12
php php 5.6.13
php php 5.6.14
php php 5.6.15
php php 5.6.16
php php 5.6.17
php php 5.6.18
php php 5.6.19
php php 5.6.20
php php 5.6.21
php php 5.6.22
php php 5.6.23
php php 7.0.0
php php 7.0.1
php php 7.0.2
php php 7.0.3
php php 7.0.4
php php 7.0.5
php php 7.0.8
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "11DF4C58-F13C-40DC-8821-A7C704CA964C",
              "versionEndIncluding": "5.5.37",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:php:php:5.6.0:alpha1:*:*:*:*:*:*",
              "matchCriteriaId": "5BF4E8FF-A3EC-43E8-A0C1-FD38AFCB77B8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:php:php:5.6.0:alpha2:*:*:*:*:*:*",
              "matchCriteriaId": "54ADECFC-3C07-43BC-B296-6C25AC7F1C95",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:php:php:5.6.0:alpha3:*:*:*:*:*:*",
              "matchCriteriaId": "FE192054-2FBB-4388-A52A-422E20DEA2D7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:php:php:5.6.0:alpha4:*:*:*:*:*:*",
              "matchCriteriaId": "F0195D48-3B42-4AC0-B9C5-436E01C63879",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:php:php:5.6.0:alpha5:*:*:*:*:*:*",
              "matchCriteriaId": "BF0E5D67-ABC1-41A5-94E1-7DD3CDB51D81",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:php:php:5.6.0:beta1:*:*:*:*:*:*",
              "matchCriteriaId": "319E0573-B1AD-40B6-B4BC-8BE67ED3EFDB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:php:php:5.6.0:beta2:*:*:*:*:*:*",
              "matchCriteriaId": "1A7C00EB-87B7-4EB7-A4AC-8665D8C78467",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:php:php:5.6.0:beta3:*:*:*:*:*:*",
              "matchCriteriaId": "21BFCF10-786A-4D1E-9C37-50A1EC6056F1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:php:php:5.6.0:beta4:*:*:*:*:*:*",
              "matchCriteriaId": "95A6D6C8-5F46-4897-A0B0-778631E8CE6A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:php:php:5.6.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "F1F13E2D-A8F7-4B74-8D03-7905C81672C9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:php:php:5.6.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "AE18933A-5FE6-41C7-B1B6-DA3E762C3FB6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:php:php:5.6.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "9AE1289F-03A6-4621-B387-5F5ADAC4AE92",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:php:php:5.6.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "383697F5-D29E-475A-84F3-46B54A928889",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:php:php:5.6.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "786ED182-5D71-4197-9196-12AB5CF05F85",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:php:php:5.6.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "BF90980D-74AD-44AA-A7C5-A0B294CCE4F8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:php:php:5.6.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "48D6B69C-8F27-4F4C-B953-67A7F9C2FBA5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:php:php:5.6.8:*:*:*:*:*:*:*",
              "matchCriteriaId": "B53DC0C3-EA19-4465-B65A-BC7CDB10D8BF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:php:php:5.6.9:*:*:*:*:*:*:*",
              "matchCriteriaId": "BEA4DFC1-6C0C-42FB-9F47-E3E1AA9E47E0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:php:php:5.6.10:*:*:*:*:*:*:*",
              "matchCriteriaId": "D904E21A-4B3B-4D96-850C-0C0315F14E6D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:php:php:5.6.11:*:*:*:*:*:*:*",
              "matchCriteriaId": "C7CEF6D7-8966-45E7-BEBB-12055F5898C6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:php:php:5.6.12:*:*:*:*:*:*:*",
              "matchCriteriaId": "171C1035-414C-4F3A-90F4-1A8ED26E3346",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:php:php:5.6.13:*:*:*:*:*:*:*",
              "matchCriteriaId": "725BBA4E-B3BA-4AFA-A284-E0CDE3EC8FB4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:php:php:5.6.14:*:*:*:*:*:*:*",
              "matchCriteriaId": "F7793408-66A2-4DE7-B5AA-E49E8A2EE043",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:php:php:5.6.15:*:*:*:*:*:*:*",
              "matchCriteriaId": "95840EC0-512D-468D-99B0-17E8CFDD6BE0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:php:php:5.6.16:*:*:*:*:*:*:*",
              "matchCriteriaId": "E1078D15-8073-4C04-82C2-3C8111E18B6C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:php:php:5.6.17:*:*:*:*:*:*:*",
              "matchCriteriaId": "1B2E5E0C-8DD7-4CF8-A7E7-28ED0FD8B0C1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:php:php:5.6.18:*:*:*:*:*:*:*",
              "matchCriteriaId": "3E6EE9E4-9D6E-4CCC-B116-6020DA6884BE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:php:php:5.6.19:*:*:*:*:*:*:*",
              "matchCriteriaId": "F9A23E37-8B94-440A-8014-389AC5389A19",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:php:php:5.6.20:*:*:*:*:*:*:*",
              "matchCriteriaId": "AD5E20AF-724B-4DBD-9AED-920375666B6B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:php:php:5.6.21:*:*:*:*:*:*:*",
              "matchCriteriaId": "FD008BBB-10C9-48E2-97B8-6B86B54FD48E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:php:php:5.6.22:*:*:*:*:*:*:*",
              "matchCriteriaId": "90727984-6853-4348-B3CD-4869788117FD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:php:php:5.6.23:*:*:*:*:*:*:*",
              "matchCriteriaId": "08AA5F56-9D59-436E-BEB8-68A8A73B6D32",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:php:php:7.0.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "DB6890AF-8A0A-46EE-AAD5-CF9AAE14A321",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:php:php:7.0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "6B90B947-7B54-47F3-9637-2F4AC44079EE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:php:php:7.0.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "35848414-BD5D-4164-84DC-61ABBB1C4152",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:php:php:7.0.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "2B1F8402-8551-4F66-A9A7-81D472AB058E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:php:php:7.0.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "7A773E8E-48CD-4D35-A0FD-629BD9334486",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:php:php:7.0.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "FC492340-79AF-4676-A161-079A97EC6F0C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:php:php:7.0.8:*:*:*:*:*:*:*",
              "matchCriteriaId": "751F51CA-9D88-4971-A6EC-8C0B72E8E22B",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The locale_accept_from_http function in ext/intl/locale/locale_methods.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 does not properly restrict calls to the ICU uloc_acceptLanguageFromHTTP function, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a call with a long argument."
    },
    {
      "lang": "es",
      "value": "La funci\u00f3n locale_accept_from_http en ext/intl/locale/locale_methods.c en PHP en versiones anteriores a 5.5.38, 5.6.x en versiones anteriores a 5.6.24 y 7.x en versiones anteriores a 7.0.9 no restringe correctamente llamadas para la funci\u00f3n ICU uloc_acceptLanguageFromHTTP, lo que permite a atacantes remotos provocar una denegaci\u00f3n de servicio (lectura fuera de rango) o posiblemente tener otro impacto no especificado a trav\u00e9s de una llamada con un argumento largo"
    }
  ],
  "id": "CVE-2016-6294",
  "lastModified": "2025-04-12T10:46:40.837",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": true,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 7.5,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.0"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2016-07-25T14:59:07.577",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=aa82e99ed8003c01f1ef4f0940e56b85c5b032d4"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://lists.apple.com/archives/security-announce/2016/Sep/msg00006.html"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Mailing List"
      ],
      "url": "http://openwall.com/lists/oss-security/2016/07/24/2"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Release Notes"
      ],
      "url": "http://php.net/ChangeLog-5.php"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Release Notes"
      ],
      "url": "http://php.net/ChangeLog-7.php"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://rhn.redhat.com/errata/RHSA-2016-2750.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.debian.org/security/2016/dsa-3631"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://www.securityfocus.com/bid/92115"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securitytracker.com/id/1036430"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit",
        "Issue Tracking",
        "Mitigation",
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://bugs.php.net/72533"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://security.gentoo.org/glsa/201611-22"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://support.apple.com/HT207170"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=aa82e99ed8003c01f1ef4f0940e56b85c5b032d4"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://lists.apple.com/archives/security-announce/2016/Sep/msg00006.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List"
      ],
      "url": "http://openwall.com/lists/oss-security/2016/07/24/2"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Release Notes"
      ],
      "url": "http://php.net/ChangeLog-5.php"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Release Notes"
      ],
      "url": "http://php.net/ChangeLog-7.php"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://rhn.redhat.com/errata/RHSA-2016-2750.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.debian.org/security/2016/dsa-3631"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://www.securityfocus.com/bid/92115"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securitytracker.com/id/1036430"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Issue Tracking",
        "Mitigation",
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://bugs.php.net/72533"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://security.gentoo.org/glsa/201611-22"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://support.apple.com/HT207170"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-125"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.