CVE-2016-7133

Published on: 09/11/2016 12:00:00 AM UTC

Last Modified on: 03/23/2021 11:27:05 PM UTC

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Certain versions of Php from Php contain the following vulnerability:

Zend/zend_alloc.c in PHP 7.x before 7.0.10, when open_basedir is enabled, mishandles huge realloc operations, which allows remote attackers to cause a denial of service (integer overflow) or possibly have unspecified other impact via a long pathname.

  • CVE-2016-7133 has been assigned by [email protected] to track the vulnerability - currently rated as HIGH severity.

CVSS3 Score: 8.1 - HIGH

Attack
Vector
Attack
Complexity
Privileges
Required
User
Interaction
NETWORK HIGH NONE NONE
Scope Confidentiality
Impact
Integrity
Impact
Availability
Impact
UNCHANGED HIGH HIGH HIGH

CVSS2 Score: 6.8 - MEDIUM

Access
Vector
Access
Complexity
Authentication
NETWORK MEDIUM NONE
Confidentiality
Impact
Integrity
Impact
Availability
Impact
PARTIAL PARTIAL PARTIAL

CVE References

Description Tags Link
oss-security - Re: CVE assignment for PHP 5.6.25 and 7.0.10 - and libcurl Mailing List
openwall.com
text/html
URL Logo MLIST [oss-security] 20160902 Re: CVE assignment for PHP 5.6.25 and 7.0.10 - and libcurl
PHP 'fopen_wrappers.c' Integer Overflow Vulnerability cve.report (archive)
text/html
URL Logo BID 92765
Fix bug #72742 - memory allocator fails to realloc small block to lar… · php/[email protected] · GitHub Issue Tracking
Patch
github.com
text/html
URL Logo CONFIRM github.com/php/php-src/commit/c2a13ced4272f2e65d2773e2ea6ca11c1ce4a911?w=1
PHP: PHP 7 ChangeLog Release Notes
www.php.net
text/html
URL Logo CONFIRM www.php.net/ChangeLog-7.php
PHP :: Sec Bug #72742 :: memory allocator fails to realloc small block to large one Exploit
Issue Tracking
bugs.php.net
text/html
URL Logo CONFIRM bugs.php.net/bug.php?id=72742
PHP: Multiple vulnerabilities (GLSA 201611-22) — Gentoo security security.gentoo.org
text/html
URL Logo GENTOO GLSA-201611-22

Known Affected Configurations (CPE V2.3)

Type Vendor Product Version Update Edition Language
ApplicationPhpPhp7.0.0AllAllAll
ApplicationPhpPhp7.0.1AllAllAll
ApplicationPhpPhp7.0.2AllAllAll
ApplicationPhpPhp7.0.3AllAllAll
ApplicationPhpPhp7.0.4AllAllAll
ApplicationPhpPhp7.0.5AllAllAll
ApplicationPhpPhp7.0.6AllAllAll
ApplicationPhpPhp7.0.7AllAllAll
ApplicationPhpPhp7.0.8AllAllAll
ApplicationPhpPhp7.0.9AllAllAll
ApplicationPhpPhp7.0.0AllAllAll
ApplicationPhpPhp7.0.1AllAllAll
ApplicationPhpPhp7.0.2AllAllAll
ApplicationPhpPhp7.0.3AllAllAll
ApplicationPhpPhp7.0.4AllAllAll
ApplicationPhpPhp7.0.5AllAllAll
ApplicationPhpPhp7.0.6AllAllAll
ApplicationPhpPhp7.0.7AllAllAll
ApplicationPhpPhp7.0.8AllAllAll
ApplicationPhpPhp7.0.9AllAllAll
  • cpe:2.3:a:php:php:7.0.0:*:*:*:*:*:*:*:
  • cpe:2.3:a:php:php:7.0.1:*:*:*:*:*:*:*:
  • cpe:2.3:a:php:php:7.0.2:*:*:*:*:*:*:*:
  • cpe:2.3:a:php:php:7.0.3:*:*:*:*:*:*:*:
  • cpe:2.3:a:php:php:7.0.4:*:*:*:*:*:*:*:
  • cpe:2.3:a:php:php:7.0.5:*:*:*:*:*:*:*:
  • cpe:2.3:a:php:php:7.0.6:*:*:*:*:*:*:*:
  • cpe:2.3:a:php:php:7.0.7:*:*:*:*:*:*:*:
  • cpe:2.3:a:php:php:7.0.8:*:*:*:*:*:*:*:
  • cpe:2.3:a:php:php:7.0.9:*:*:*:*:*:*:*:
  • cpe:2.3:a:php:php:7.0.0:*:*:*:*:*:*:*:
  • cpe:2.3:a:php:php:7.0.1:*:*:*:*:*:*:*:
  • cpe:2.3:a:php:php:7.0.2:*:*:*:*:*:*:*:
  • cpe:2.3:a:php:php:7.0.3:*:*:*:*:*:*:*:
  • cpe:2.3:a:php:php:7.0.4:*:*:*:*:*:*:*:
  • cpe:2.3:a:php:php:7.0.5:*:*:*:*:*:*:*:
  • cpe:2.3:a:php:php:7.0.6:*:*:*:*:*:*:*:
  • cpe:2.3:a:php:php:7.0.7:*:*:*:*:*:*:*:
  • cpe:2.3:a:php:php:7.0.8:*:*:*:*:*:*:*:
  • cpe:2.3:a:php:php:7.0.9:*:*:*:*:*:*:*: