CVE-2016-6296
CriticalSummary
An integer signedness error in the simplestring_addn function in xmlrpc-epi through version 0.54.2, used in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9, allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a long first argument to the PHP xmlrpc_encode_request function.
Risk Assessment
Organizations may be exposed to attacks that lead to denial of service, affecting the availability of applications and services. Additionally, there is a risk of unspecified impacts that could affect system security.
Recommendation
It is recommended to update PHP to the latest version to mitigate this vulnerability. Also, monitor applications using xmlrpc-epi for potential attack attempts.
Original NVD description (English source)
Integer signedness error in the simplestring_addn function in simplestring.c in xmlrpc-epi through 0.54.2, as used in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9, allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a long first argument to the PHP xmlrpc_encode_request function.