CVE-2016-4344
CriticalSummary
Integer overflow in the xml_utf8_encode function in PHP before version 7.0.4 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a long argument to the utf8_encode function, leading to a heap-based buffer overflow.
Risk Assessment
Attackers may exploit this vulnerability to disrupt application functionality, potentially leading to service downtime and financial losses.
Recommendation
It is recommended to upgrade PHP to version 7.0.4 or later to mitigate this vulnerability.
Original NVD description (English source)
Integer overflow in the xml_utf8_encode function in ext/xml/xml.c in PHP before 7.0.4 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a long argument to the utf8_encode function, leading to a heap-based buffer overflow.