CVE-2016-7398

Опубликовано: 06 сент. 2019

Источник: nvd

CVSS3: 9.8

CVSS2: 7.5

EPSS Низкий

Описание

A type confusion vulnerability in the merge_param() function of php_http_params.c in PHP's pecl-http extension 3.1.0beta2 (PHP 7) and earlier as well as 2.6.0beta2 (PHP 5) and earlier allows attackers to crash PHP and possibly execute arbitrary code via crafted HTTP requests.

Ссылки

https://bugs.php.net/bug.php?id=73055
Exploit
Mailing List
Vendor Advisory
https://bugs.php.net/bug.php?id=73055&edit=1
Exploit
Vendor Advisory
https://github.com/m6w6/ext-http/commit/17137d4ab1ce81a2cee0fae842340a344ef3da83
Patch
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/09/msg00022.html
https://bugs.php.net/bug.php?id=73055
Exploit
Mailing List
Vendor Advisory
https://bugs.php.net/bug.php?id=73055&edit=1
Exploit
Vendor Advisory
https://github.com/m6w6/ext-http/commit/17137d4ab1ce81a2cee0fae842340a344ef3da83
Patch
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/09/msg00022.html

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:php:ext-http:*:*:*:*:*:*:*:*

Версия до 2.5.6 (включая)

cpe:2.3:a:php:ext-http:*:*:*:*:*:*:*:*

Версия от 3.0.0 (включая) до 3.0.1 (включая)

cpe:2.3:a:php:ext-http:2.6.0:-:*:*:*:*:*:*

cpe:2.3:a:php:ext-http:2.6.0:beta1:*:*:*:*:*:*

cpe:2.3:a:php:ext-http:2.6.0:beta2:*:*:*:*:*:*

cpe:2.3:a:php:ext-http:2.6.0:rc1:*:*:*:*:*:*

cpe:2.3:a:php:ext-http:3.1.0:*:*:*:*:*:*:*

cpe:2.3:a:php:ext-http:3.1.0:beta1:*:*:*:*:*:*

cpe:2.3:a:php:ext-http:3.1.0:beta2:*:*:*:*:*:*

cpe:2.3:a:php:ext-http:3.1.0:rc1:*:*:*:*:*:*

EPSS

Процентиль: 90%

0.05723

Низкий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-704

Связанные уязвимости

CVE-2016-7398

CVSS3: 9.8

ubuntu

больше 6 лет назад

CVE-2016-7398

CVSS3: 9.8

debian

больше 6 лет назад

A type confusion vulnerability in the merge_param() function of php_ht ...

GHSA-jx2x-3hjr-6vp8

CVSS3: 9.8

github

больше 3 лет назад

EPSS

Процентиль: 90%

0.05723

Низкий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-704