CVE-2016-7398 A type confusion vulnerability in the merge_param() function of php_http_params.c in PHP's pecl-http extension 3.1.0beta2 (PHP 7) and earlier as well as 2.6.0beta2 (PHP 5) and earlier allows attackers...
CriticalCVSS 9.8
EPSS 6.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
A type confusion vulnerability in the merge_param() function of php_http_params.c in PHP's pecl-http extension 3.1.0beta2 (PHP 7) and earlier as well as 2.6.0beta2 (PHP 5) and earlier allows attackers to crash PHP and possibly execute arbitrary code via crafted HTTP requests.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/php-pecl-http(Debian:12) | < 3.1.0+2.6.0-1 | 3.1.0+2.6.0-1 |
| debian/php-pecl-http(Debian:13) | < 3.1.0+2.6.0-1 | 3.1.0+2.6.0-1 |
| debian/php-pecl-http(Debian:14) | < 3.1.0+2.6.0-1 | 3.1.0+2.6.0-1 |
| php ext-http | <= 2.5.6 | No fix listed |
| php ext-http | >= 3.0.0, <= 3.0.1 | No fix listed |
| php ext-http | = 2.6.0 | No fix listed |
| php ext-http | = 2.6.0-beta1 | No fix listed |
| php ext-http | = 2.6.0-beta2 | No fix listed |
| php ext-http | = 2.6.0-rc1 | No fix listed |
| php ext-http | = 3.1.0 | No fix listed |
| php ext-http | = 3.1.0-beta1 | No fix listed |
| php ext-http | = 3.1.0-beta2 | No fix listed |
| php ext-http | = 3.1.0-rc1 | No fix listed |
References
- Debian Security Tracker CVE-2016-7398 vendor-advisory
- bugs.php.net exploit mailing-list vendor-advisory
- bugs.php.net exploit vendor-advisory
- github.com patch third-party-advisory
- [debian-lts-announce] 20190920 [SECURITY] [DLA 1929-1] php-pecl-http security update mailing-list