CVE-2016-4073
CriticalSummary
Multiple integer overflows in the mbfl_strcut function in PHP before 5.5.34, 5.6.x before 5.6.20, and 7.x before 7.0.5 may allow remote attackers to cause application crashes or potentially execute arbitrary code via a crafted mb_strcut call.
Risk Assessment
This vulnerability could lead to service outages and allow attackers to execute unauthorized code, posing a serious threat to the security of the application and the organization's data.
Recommendation
It is recommended to update PHP to the latest version to mitigate this vulnerability and conduct an application audit to identify potential attack vectors.
Original NVD description (English source)
Multiple integer overflows in the mbfl_strcut function in ext/mbstring/libmbfl/mbfl/mbfilter.c in PHP before 5.5.34, 5.6.x before 5.6.20, and 7.x before 7.0.5 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted mb_strcut call.