CVE-2016-5769
CriticalSummary
Multiple integer overflows in mcrypt.c in the mcrypt extension in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8 allow remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted length value, related to the mcrypt_generic and mdecrypt_generic functions.
Risk Assessment
The organization may experience application crashes and potential attacks that could lead to service unavailability. Buffer overflows may also lead to unauthorized access to the system.
Recommendation
It is recommended to update PHP to the latest version to mitigate this vulnerability. Additionally, monitor applications using mcrypt for potential attack attempts.
Original NVD description (English source)
Multiple integer overflows in mcrypt.c in the mcrypt extension in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8 allow remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted length value, related to the (1) mcrypt_generic and (2) mdecrypt_generic functions.