Description

Double free vulnerability in the _php_mb_regex_ereg_replace_exec function in php_mbregex.c in the mbstring extension in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) by leveraging a callback exception.

Remediation

References

CVE-2016-5768

Related Vulnerabilities

MediaWiki Incorrect Permission Assignment for Critical Resource Vulnerability (CVE-2020-35625)

WordPress Plugin Shield Security-Smart Bot Blocking & Intrusion Prevention Security Local File Inclusion (18.5.9)

WordPress Plugin WordPress.com Custom CSS Cross-Site Scripting (1.5)

WordPress Plugin WordPress Bitcoin Payments-Blockonomics Cross-Site Scripting (3.2)

WordPress Plugin CommentLuv Cross-Site Scripting (2.92.3)

Severity

Critical

Classification

CVE-2016-5768 CWE-415 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities