Description

Integer overflow in the str_pad function in ext/standard/string.c in PHP before 7.0.4 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a long string, leading to a heap-based buffer overflow.

Remediation

References

CVE-2016-4346

Related Vulnerabilities

Coppermine Improper Authentication Vulnerability (CVE-2005-3979)

Ruby Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability (CVE-2018-6914)

WordPress Plugin Content Blocks (Custom Post Widget) Local File Inclusion (3.3.0)

WordPress Plugin Companion Revision Manager-Revision Control Unspecified Vulnerability (1.3)

WordPress Plugin PropertyHive Remote Code Execution (1.4.25)

Severity

Critical

Classification

CVE-2016-4346 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities