KLA10927
Denial of service vulnerabilities in PHP

Aktualisiert: 03/29/2019

Erkennungsdatum ?	01/04/2017
Schweregrad ?	Kritisch
Beschreibung	Multiple serious vulnerabilities have been found in PHP before 5.6.28 and PHP 7.x before 7.0.13. Malicious users can exploit these vulnerabilities to cause a denial of service. Other unspecified impacts are also possible. Below is a complete list of vulnerabilities: NULL pointer dereference in ext/wddx/wddx.c can be exploited remotely via specially designed data in a wddxPacket XML document to cause a denial of service; Stack consumption vulnerability in the GD Graphics Library (libgd) can be exploited remotely via specially designed imagefilltoborder call which forces usage of a negative color value to cause a denial of service; Integer signedness error in the GD Graphics Library (libgd) can be exploited remotely via specially designed imagecreatefromstring call to cause a denial of service. Technical details Vulnerability (2) occurs in the gdImageFillToBorder function in gd.c file from the GD Graphics Library. Vulnerability (3) occurs in the dynamicGetbuf function in gd_io_dp.c from the GD Graphics Library.
Beeinträchtigte Produkte	PHP before 5.6.28 PHP 7.x before 7.0.13
Lösung	Update to the latest versions Download PHP
Ursprüngliche Informationshinweise	PHP 5 ChangeLog PHP 7 ChangeLog
Folgen ?	DoS [?]
CVE-IDS ?	CVE-2016-86707.5Critical CVE-2016-99345.0Critical CVE-2016-99335.0Critical
	Link zum Original
	Informieren Sie sich über die Statistiken der in Ihrer Region verbreiteten Sicherheitslücken

KLA10927Denial of service vulnerabilities in PHP