CVE-2016-4070 : Integer overflow in the php_raw_url_encode function in ext/standard/url.c in PHP

Integer overflow in the php_raw_url_encode function in ext/standard/url.c in PHP before 5.5.34, 5.6.x before 5.6.20, and 7.x before 7.0.5 allows remote attackers to cause a denial of service (application crash) via a long string to the rawurlencode function. NOTE: the vendor says "Not sure if this qualifies as security issue (probably not).

Published 2016-05-20 11:00:14

Updated 2024-08-06 01:15:26

Source MITRE

View at NVD, CVE.org

Vulnerability category: OverflowDenial of service

Products affected by CVE-2016-4070

PHP » PHP
Versions up to, including, (<=) 5.5.33
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 5.6.0 Update Alpha4
cpe:2.3:a:php:php:5.6.0:alpha4:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 5.6.0 Update Alpha5
cpe:2.3:a:php:php:5.6.0:alpha5:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 5.6.0 Update Beta2
cpe:2.3:a:php:php:5.6.0:beta2:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 5.6.13
cpe:2.3:a:php:php:5.6.13:*:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 5.6.14
cpe:2.3:a:php:php:5.6.14:*:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 5.6.0 Update Alpha2
cpe:2.3:a:php:php:5.6.0:alpha2:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 5.6.0 Update Alpha3
cpe:2.3:a:php:php:5.6.0:alpha3:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 7.0.3
cpe:2.3:a:php:php:7.0.3:*:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 7.0.4
cpe:2.3:a:php:php:7.0.4:*:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 5.6.11
cpe:2.3:a:php:php:5.6.11:*:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 5.6.12
cpe:2.3:a:php:php:5.6.12:*:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 5.6.19
cpe:2.3:a:php:php:5.6.19:*:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 5.6.2
cpe:2.3:a:php:php:5.6.2:*:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 5.6.7
cpe:2.3:a:php:php:5.6.7:*:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 5.6.8
cpe:2.3:a:php:php:5.6.8:*:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 5.6.9
cpe:2.3:a:php:php:5.6.9:*:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 5.6.0 Update Alpha1
cpe:2.3:a:php:php:5.6.0:alpha1:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 7.0.1
cpe:2.3:a:php:php:7.0.1:*:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 7.0.2
cpe:2.3:a:php:php:7.0.2:*:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 5.6.1
cpe:2.3:a:php:php:5.6.1:*:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 5.6.10
cpe:2.3:a:php:php:5.6.10:*:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 5.6.17
cpe:2.3:a:php:php:5.6.17:*:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 5.6.18
cpe:2.3:a:php:php:5.6.18:*:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 5.6.5
cpe:2.3:a:php:php:5.6.5:*:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 5.6.6
cpe:2.3:a:php:php:5.6.6:*:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 5.6.0 Update Beta1
cpe:2.3:a:php:php:5.6.0:beta1:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 7.0.0
cpe:2.3:a:php:php:7.0.0:*:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 5.6.0 Update Beta3
cpe:2.3:a:php:php:5.6.0:beta3:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 5.6.0 Update Beta4
cpe:2.3:a:php:php:5.6.0:beta4:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 5.6.15
cpe:2.3:a:php:php:5.6.15:*:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 5.6.16
cpe:2.3:a:php:php:5.6.16:*:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 5.6.3
cpe:2.3:a:php:php:5.6.3:*:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 5.6.4
cpe:2.3:a:php:php:5.6.4:*:*:*:*:*:*:*
Matching versions

Threat overview for CVE-2016-4070

Top countries where our scanners detected CVE-2016-4070

Top open port discovered on systems with this issue 80

IPs affected by CVE-2016-4070 463,366

Threat actors abusing to this issue? Yes

Find out if you^* are affected by CVE-2016-4070!

^*Directly or indirectly through your vendors, service providers and 3rd parties. Powered by attack surface intelligence from SecurityScorecard.

Exploit prediction scoring system (EPSS) score for CVE-2016-4070

EPSS FAQ

24.23%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 97 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2016-4070

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
5.0	MEDIUM	AV:N/AC:L/Au:N/C:N/I:N/A:P	10.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: None Integrity Impact: None Availability Impact: Partial
7.5	HIGH	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	3.9	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: High

CWE ids for CVE-2016-4070

CWE-189

Assigned by: nvd@nist.gov (Primary)

References for CVE-2016-4070

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722

HPSBMU03691 rev.1 - HPE Insight Control, Multiple Remote Vulnerabilities

CVEs referencing this url
http://www.openwall.com/lists/oss-security/2016/04/24/1

oss-security - Re: CVE request: PHP issues fixed in 7.0.5, 5.6.20 and 5.5.34 releases

CVEs referencing this url
https://git.php.net/?p=php-src.git%3Ba=commit%3Bh=95433e8e339dbb6b5d5541473c1661db6ba2c451
http://www.ubuntu.com/usn/USN-2952-1

USN-2952-1: PHP vulnerabilities | Ubuntu security notices

CVEs referencing this url
https://bugs.php.net/bug.php?id=71798

PHP :: Sec Bug #71798 :: Integer Overflow in php_raw_url_encode
Exploit
https://git.php.net/?p=php-src.git;a=commit;h=95433e8e339dbb6b5d5541473c1661db6ba2c451

208.43.231.11 Git - php-src.git/commit
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00033.html

[security-announce] SUSE-SU-2016:1277-1: important: Security update for

CVEs referencing this url
http://www.ubuntu.com/usn/USN-2952-2

USN-2952-2: PHP regression | Ubuntu security notices

CVEs referencing this url
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05320149

HPSBMU03653 rev.1 - HPE System Management Homepage (SMH), Remote Arbitrary Code Execution, Cross-Site Scripting (XSS), Denial of Service (DoS), Unauthorized Disclosure of Information

CVEs referencing this url
http://www.debian.org/security/2016/dsa-3560

Debian -- Security Information -- DSA-3560-1 php5

CVEs referencing this url
http://lists.apple.com/archives/security-announce/2016/May/msg00004.html

Apple - Lists.apple.com

CVEs referencing this url
http://www.php.net/ChangeLog-7.php

PHP: PHP 7 ChangeLog

CVEs referencing this url
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00056.html

[security-announce] openSUSE-SU-2016:1373-1: important: Security update

CVEs referencing this url
https://support.apple.com/HT206567

About the security content of OS X El Capitan v10.11.5 and Security Update 2016-003 - Apple Support

CVEs referencing this url
http://www.php.net/ChangeLog-5.php

PHP: PHP 5 ChangeLog

CVEs referencing this url
http://www.securityfocus.com/bid/85801

PHP 'php_raw_url_encode()' Function Integer Overflow Vulnerability
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05240731

HPSBNS03635 rev.1 - HPE NonStop Servers OSS Script Languages running Perl and PHP, Multiple Local and Remote Vulnerabilities

CVEs referencing this url
http://rhn.redhat.com/errata/RHSA-2016-2750.html

RHSA-2016:2750 - Security Advisory - Red Hat Customer Portal

CVEs referencing this url
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00031.html

[security-announce] openSUSE-SU-2016:1274-1: important: Security update

CVEs referencing this url