CVE-2016-5114: php

Vulnerability summary

CVE-2016-5114 is a critical (CVSS 9.1) vulnerability in php. EPSS estimates a 4.49% chance of exploitation in the next 30 days, higher than 91.4% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 07-08-2016
   PublishedVulnerability first disclosed.
2. 06-08-2024
   Last modifiedVulnerability information updated.

Description

sapi/fpm/fpm/fpm_log.c in PHP before 5.5.31, 5.6.x before 5.6.17, and 7.x before 7.0.2 misinterprets the semantics of the snprintf return value, which allows attackers to obtain sensitive information from process memory or cause a denial of service (out-of-bounds read and buffer overflow) via a long string, as demonstrated by a long URI in a configuration with custom REQUEST_URI logging.

• CWE-119Improper Restriction of Operations within the Bounds of a Memory BufferThe product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary.
• CWE-125Out-of-bounds ReadThe product reads data past the end, or before the beginning, of the intended buffer.