Description
Multiple integer overflows in mcrypt.c in the mcrypt extension in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8 allow remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted length value, related to the (1) mcrypt_generic and (2) mdecrypt_generic functions.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9Attack Vector: Network
Complexity: Low
Privileges: None
User Interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High
Affected Packages3 packages
🔴Vulnerability Details
3GHSAGHSA-5jqx-3p4m-wv4h: Multiple integer overflows in mcrypt↗2022-05-17 OSVphp5, php7.0 vulnerabilities↗2016-08-02 OSVCVE-2016-5769: Multiple integer overflows in mcrypt↗2016-06-24 📋Vendor Advisories
3AppleCVE-2016-5769: macOS Sierra 10.12↗2016-09-20 UbuntuPHP vulnerabilities↗2016-08-02 Red Hatphp: Integer Overflows in mcrypt_generic() and mdecrypt_generic() resulting in heap overflows↗2016-06-23 💬Community
2BugzillaCVE-2016-5769 php: Integer Overflows in mcrypt_generic() and mdecrypt_generic() resulting in heap overflows↗2016-06-29 BugzillaCVE-2016-5766 CVE-2016-5767 CVE-2016-5768 CVE-2016-5769 CVE-2016-5770 CVE-2016-5771 CVE-2016-5772 CVE-2016-5773 php: various flaws [fedora-all]↗2016-06-29