CVE-2016-7134
CriticalSummary
In PHP 7.x before version 7.0.10, there is an integer overflow issue in libcurl that can lead to allocation errors and heap-based buffer overflows. Remote attackers can exploit this vulnerability by sending a long string to the curl_escape function.
Risk Assessment
This vulnerability can lead to denial of service, affecting application availability. There is also a risk of unspecified impact on the system, which may threaten data integrity.
Recommendation
It is recommended to upgrade PHP to version 7.0.10 or later to mitigate this vulnerability. Additionally, monitoring and restricting input to the curl_escape function is advisable.
Original NVD description (English source)
ext/curl/interface.c in PHP 7.x before 7.0.10 does not work around a libcurl integer overflow, which allows remote attackers to cause a denial of service (allocation error and heap-based buffer overflow) or possibly have unspecified other impact via a long string that is mishandled in a curl_escape call.