Ubuntu.comUB:CVE-2016-6296CVE-2016-6296
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
7.5 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
0.021 Low
EPSS
Percentile
88.9%
Integer signedness error in the simplestring_addn function in
simplestring.c in xmlrpc-epi through 0.54.2, as used in PHP before 5.5.38,
5.6.x before 5.6.24, and 7.x before 7.0.9, allows remote attackers to cause
a denial of service (heap-based buffer overflow) or possibly have
unspecified other impact via a long first argument to the PHP
xmlrpc_encode_request function.
Bugs
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| ubuntu | 12.04 | noarch | php5 | < 5.3.10-1ubuntu3.24 | UNKNOWN |
| ubuntu | 14.04 | noarch | php5 | < 5.5.9+dfsg-1ubuntu4.19 | UNKNOWN |
| ubuntu | 16.04 | noarch | php7.0 | < 7.0.8-0ubuntu0.16.04.2 | UNKNOWN |
| ubuntu | 12.04 | noarch | xmlrpc-epi | < 0.54.2-1+deb7u1ubuntu0.12.04.1 | UNKNOWN |
| ubuntu | 14.04 | noarch | xmlrpc-epi | < 0.54.2-1+deb7u1ubuntu0.14.04.2 | UNKNOWN |
| ubuntu | 16.04 | noarch | xmlrpc-epi | < 0.54.2-1.1ubuntu0.1 | UNKNOWN |
Related
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
7.5 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
0.021 Low
EPSS
Percentile
88.9%