CVE-2016-6294
CriticalSummary
The locale_accept_from_http function in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 does not properly restrict calls to the ICU uloc_acceptLanguageFromHTTP function. This allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a call with a long argument.
Risk Assessment
Organizations may be exposed to denial of service attacks, which can lead to application downtime. Additionally, unspecified impacts may lead to other serious security issues.
Recommendation
It is recommended to update PHP to the latest version to mitigate this vulnerability. Also, monitor server logs for suspicious calls.
Original NVD description (English source)
The locale_accept_from_http function in ext/intl/locale/locale_methods.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 does not properly restrict calls to the ICU uloc_acceptLanguageFromHTTP function, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a call with a long argument.