CVE Catalog
CVE-2016-4537
CriticalSummary
The bcpowmod function in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 accepts a negative integer for the scale argument, which may lead to denial of service or other unspecified impacts.
Risk Assessment
Remote attackers may exploit this vulnerability to disrupt application functionality, potentially causing service outages.
Recommendation
It is recommended to update PHP to the latest version to mitigate this vulnerability.
Original NVD description (English source)
The bcpowmod function in ext/bcmath/bcmath.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 accepts a negative integer for the scale argument, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted call.