CVE-2016-5095
HighSummary
Integer overflow in the php_escape_html_entities_ex function in PHP before 5.5.36 and 5.6.x before 5.6.22 allows remote attackers to cause a denial of service or possibly have unspecified other impact by triggering a large output string from a FILTER_SANITIZE_FULL_SPECIAL_CHARS filter_var call.
Risk Assessment
Organizations may be exposed to attacks leading to denial of service, which can affect the availability of web applications.
Recommendation
It is recommended to upgrade PHP to version 5.5.36 or 5.6.22 and later to mitigate this vulnerability.
Other vulnerabilities in PHP
See all- CVE-2026-13081Unknown
This CVE has been rejected. Reason: Red Hat is not the CNA for PHP. CVE was reserved in error; the appropriate CNA should assign CVE IDs for these vulnerabilities.
- CVE-2026-13047Unknown
This CVE has been rejected. Reason: Red Hat is not the CNA for PHP. CVE was reserved in error; the appropriate CNA should assign CVE IDs for these vulnerabilities.
- CVE-2017-12934High
PHP versions 7.0.x before 7.0.21 and 7.1.x before 7.1.7 are prone to a heap use after free while unserializing untrusted data. This issue is related to the zval_get_type function in Zend/zend_types.h.
- CVE-2017-11628High
In PHP versions before 5.6.31, 7.x before 7.0.21, and 7.1.x before 7.1.7, a stack-based buffer overflow in the zend_ini_do_op() function could lead to denial of service or potentially allow executing code. This issue is relevant for PHP applications that accept untrusted input for the parse_ini_string or parse_ini_file function.
- CVE-2017-11142High
In PHP versions before 5.6.31, 7.x before 7.0.17, and 7.1.x before 7.1.3, remote attackers could cause a denial of service attack by injecting long form variables, leading to excessive CPU consumption.
- CVE-2016-5399High
The bzread function in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 allows remote attackers to cause a denial of service (out-of-bounds write) or execute arbitrary code via a crafted bz2 archive.
- CVE-2017-6441High
The _zval_get_long_func_ex function in PHP 7.1.2 has a vulnerability that allows attackers to cause a denial of service through crafted use of 'declare(ticks=' in a PHP script, leading to a NULL pointer dereference and application crash.
- CVE-2017-7272High
PHP versions up to 7.1.11 enable potential SSRF attacks in applications that accept a hostname argument for fsockopen or pfsockopen, expecting the port number to be constrained. Due to the recognition of :port syntax, fsockopen will use the port number specified in the hostname argument instead of the port number in the second argument of the function.
- CVE-2016-10161High
The object_common1 function in PHP before 5.6.30, 7.0.x before 7.0.15, and 7.1.x before 7.1.1 allows remote attackers to cause a denial of service (buffer over-read and application crash) via crafted serialized data that is mishandled in a finish_nested_data call.
- CVE-2016-10158High
The exif_convert_any_to_int function in PHP before 5.6.30, 7.0.x before 7.0.15, and 7.1.x before 7.1.1 allows remote attackers to cause a denial of service (application crash) via crafted EXIF data that triggers an attempt to divide the minimum representable negative integer by -1.
Original NVD description (English source)
Integer overflow in the php_escape_html_entities_ex function in ext/standard/html.c in PHP before 5.5.36 and 5.6.x before 5.6.22 allows remote attackers to cause a denial of service or possibly have unspecified other impact by triggering a large output string from a FILTER_SANITIZE_FULL_SPECIAL_CHARS filter_var call. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-5094.