CVE-2016-5114
CriticalSummary
In PHP before 5.5.31, 5.6.x before 5.6.17, and 7.x before 7.0.2, there is a flaw in fpm_log.c that misinterprets the return value of snprintf. This can lead to the disclosure of sensitive information from process memory or denial of service via out-of-bounds read and buffer overflow.
Risk Assessment
An attacker may gain access to sensitive data or cause service disruption, potentially leading to application downtime and data loss.
Recommendation
It is recommended to update PHP to the latest version to mitigate this vulnerability and to monitor logs for potential attack attempts.
Original NVD description (English source)
sapi/fpm/fpm/fpm_log.c in PHP before 5.5.31, 5.6.x before 5.6.17, and 7.x before 7.0.2 misinterprets the semantics of the snprintf return value, which allows attackers to obtain sensitive information from process memory or cause a denial of service (out-of-bounds read and buffer overflow) via a long string, as demonstrated by a long URI in a configuration with custom REQUEST_URI logging.