CVE-2016-4538
CriticalSummary
The bcpowmod function in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 modifies certain data structures without considering whether they are copies of the global variables _zero_, _one_, or _two_. This may allow remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted call.
Risk Assessment
Organizations may be exposed to attacks that lead to denial of service, affecting the availability of applications and services. Potential unspecified impacts may also threaten system integrity.
Recommendation
It is recommended to update PHP to the latest version to mitigate this vulnerability. Additionally, applications should be monitored for unusual behaviors that may indicate attempted attacks.
Original NVD description (English source)
The bcpowmod function in ext/bcmath/bcmath.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 modifies certain data structures without considering whether they are copies of the _zero_, _one_, or _two_ global variable, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted call.