CVE-2016-5768

Double free vulnerability in the _php_mb_regex_ereg_replace_exec function in php_mbregex.c in the mbstring extension in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) by leveraging a callback exception.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 94%
Affected Products (NVD)
VendorProductVersion
phpphp
𝑥
≤ 5.5.36
phpphp
5.6.0:alpha1
phpphp
5.6.0:alpha2
phpphp
5.6.0:alpha3
phpphp
5.6.0:alpha4
phpphp
5.6.0:alpha5
phpphp
5.6.0:beta1
phpphp
5.6.0:beta2
phpphp
5.6.0:beta3
phpphp
5.6.0:beta4
phpphp
5.6.1
phpphp
5.6.2
phpphp
5.6.3
phpphp
5.6.4
phpphp
5.6.5
phpphp
5.6.6
phpphp
5.6.7
phpphp
5.6.8
phpphp
5.6.9
phpphp
5.6.10
phpphp
5.6.11
phpphp
5.6.12
phpphp
5.6.13
phpphp
5.6.14
phpphp
5.6.15
phpphp
5.6.16
phpphp
5.6.17
phpphp
5.6.18
phpphp
5.6.19
phpphp
5.6.20
phpphp
5.6.21
phpphp
5.6.22
phpphp
7.0.0
phpphp
7.0.1
phpphp
7.0.2
phpphp
7.0.3
phpphp
7.0.4
phpphp
7.0.5
phpphp
7.0.6
phpphp
7.0.7
𝑥
= Vulnerable software versions
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
php5
precise
not-affected
trusty
Fixed 5.5.9+dfsg-1ubuntu4.19
released
wily
ignored
xenial
dne
php7.0
precise
dne
trusty
dne
wily
dne
xenial
Fixed 7.0.8-0ubuntu0.16.04.1
released
Red Hat logo
Red Hat Enterprise Linux Releases
Red Hat Product
Release
php
RHEL 7
0:5.4.16-42.el7
fixed
php-bcmath
RHEL 7
0:5.4.16-42.el7
fixed
php-cli
RHEL 7
0:5.4.16-42.el7
fixed
php-common
RHEL 7
0:5.4.16-42.el7
fixed
php-dba
RHEL 7
0:5.4.16-42.el7
fixed
php-devel
RHEL 7
0:5.4.16-42.el7
fixed
php-embedded
RHEL 7
0:5.4.16-42.el7
fixed
php-enchant
RHEL 7
0:5.4.16-42.el7
fixed
php-fpm
RHEL 7
0:5.4.16-42.el7
fixed
php-gd
RHEL 7
0:5.4.16-42.el7
fixed
php-intl
RHEL 7
0:5.4.16-42.el7
fixed
php-ldap
RHEL 7
0:5.4.16-42.el7
fixed
php-mbstring
RHEL 7
0:5.4.16-42.el7
fixed
php-mysql
RHEL 7
0:5.4.16-42.el7
fixed
php-mysqlnd
RHEL 7
0:5.4.16-42.el7
fixed
php-odbc
RHEL 7
0:5.4.16-42.el7
fixed
php-pdo
RHEL 7
0:5.4.16-42.el7
fixed
php-pgsql
RHEL 7
0:5.4.16-42.el7
fixed
php-process
RHEL 7
0:5.4.16-42.el7
fixed
php-pspell
RHEL 7
0:5.4.16-42.el7
fixed
php-recode
RHEL 7
0:5.4.16-42.el7
fixed
php-snmp
RHEL 7
0:5.4.16-42.el7
fixed
php-soap
RHEL 7
0:5.4.16-42.el7
fixed
php-xml
RHEL 7
0:5.4.16-42.el7
fixed
php-xmlrpc
RHEL 7
0:5.4.16-42.el7
fixed
Amazon Linux logo
Amazon Linux Releases
Amazon Package
Release
php55
Amazon Linux 1
0:5.5.38-1.116.amzn1
fixed
php55-bcmath
Amazon Linux 1
0:5.5.38-1.116.amzn1
fixed
php55-cli
Amazon Linux 1
0:5.5.38-1.116.amzn1
fixed
php55-common
Amazon Linux 1
0:5.5.38-1.116.amzn1
fixed
php55-dba
Amazon Linux 1
0:5.5.38-1.116.amzn1
fixed
php55-debuginfo
Amazon Linux 1
0:5.5.38-1.116.amzn1
fixed
php55-devel
Amazon Linux 1
0:5.5.38-1.116.amzn1
fixed
php55-embedded
Amazon Linux 1
0:5.5.38-1.116.amzn1
fixed
php55-enchant
Amazon Linux 1
0:5.5.38-1.116.amzn1
fixed
php55-fpm
Amazon Linux 1
0:5.5.38-1.116.amzn1
fixed
php55-gd
Amazon Linux 1
0:5.5.38-1.116.amzn1
fixed
php55-gmp
Amazon Linux 1
0:5.5.38-1.116.amzn1
fixed
php55-imap
Amazon Linux 1
0:5.5.38-1.116.amzn1
fixed
php55-intl
Amazon Linux 1
0:5.5.38-1.116.amzn1
fixed
php55-ldap
Amazon Linux 1
0:5.5.38-1.116.amzn1
fixed
php55-mbstring
Amazon Linux 1
0:5.5.38-1.116.amzn1
fixed
php55-mcrypt
Amazon Linux 1
0:5.5.38-1.116.amzn1
fixed
php55-mssql
Amazon Linux 1
0:5.5.38-1.116.amzn1
fixed
php55-mysqlnd
Amazon Linux 1
0:5.5.38-1.116.amzn1
fixed
php55-odbc
Amazon Linux 1
0:5.5.38-1.116.amzn1
fixed
php55-opcache
Amazon Linux 1
0:5.5.38-1.116.amzn1
fixed
php55-pdo
Amazon Linux 1
0:5.5.38-1.116.amzn1
fixed
php55-pgsql
Amazon Linux 1
0:5.5.38-1.116.amzn1
fixed
php55-process
Amazon Linux 1
0:5.5.38-1.116.amzn1
fixed
php55-pspell
Amazon Linux 1
0:5.5.38-1.116.amzn1
fixed
php55-recode
Amazon Linux 1
0:5.5.38-1.116.amzn1
fixed
php55-snmp
Amazon Linux 1
0:5.5.38-1.116.amzn1
fixed
php55-soap
Amazon Linux 1
0:5.5.38-1.116.amzn1
fixed
php55-tidy
Amazon Linux 1
0:5.5.38-1.116.amzn1
fixed
php55-xml
Amazon Linux 1
0:5.5.38-1.116.amzn1
fixed
php55-xmlrpc
Amazon Linux 1
0:5.5.38-1.116.amzn1
fixed
php56
Amazon Linux 1
0:5.6.24-1.126.amzn1
fixed
php56-bcmath
Amazon Linux 1
0:5.6.24-1.126.amzn1
fixed
php56-cli
Amazon Linux 1
0:5.6.24-1.126.amzn1
fixed
php56-common
Amazon Linux 1
0:5.6.24-1.126.amzn1
fixed
php56-dba
Amazon Linux 1
0:5.6.24-1.126.amzn1
fixed
php56-dbg
Amazon Linux 1
0:5.6.24-1.126.amzn1
fixed
php56-debuginfo
Amazon Linux 1
0:5.6.24-1.126.amzn1
fixed
php56-devel
Amazon Linux 1
0:5.6.24-1.126.amzn1
fixed
php56-embedded
Amazon Linux 1
0:5.6.24-1.126.amzn1
fixed
php56-enchant
Amazon Linux 1
0:5.6.24-1.126.amzn1
fixed
php56-fpm
Amazon Linux 1
0:5.6.24-1.126.amzn1
fixed
php56-gd
Amazon Linux 1
0:5.6.24-1.126.amzn1
fixed
php56-gmp
Amazon Linux 1
0:5.6.24-1.126.amzn1
fixed
php56-imap
Amazon Linux 1
0:5.6.24-1.126.amzn1
fixed
php56-intl
Amazon Linux 1
0:5.6.24-1.126.amzn1
fixed
php56-ldap
Amazon Linux 1
0:5.6.24-1.126.amzn1
fixed
php56-mbstring
Amazon Linux 1
0:5.6.24-1.126.amzn1
fixed
php56-mcrypt
Amazon Linux 1
0:5.6.24-1.126.amzn1
fixed
php56-mssql
Amazon Linux 1
0:5.6.24-1.126.amzn1
fixed
php56-mysqlnd
Amazon Linux 1
0:5.6.24-1.126.amzn1
fixed
php56-odbc
Amazon Linux 1
0:5.6.24-1.126.amzn1
fixed
php56-opcache
Amazon Linux 1
0:5.6.24-1.126.amzn1
fixed
php56-pdo
Amazon Linux 1
0:5.6.24-1.126.amzn1
fixed
php56-pgsql
Amazon Linux 1
0:5.6.24-1.126.amzn1
fixed
php56-process
Amazon Linux 1
0:5.6.24-1.126.amzn1
fixed
php56-pspell
Amazon Linux 1
0:5.6.24-1.126.amzn1
fixed
php56-recode
Amazon Linux 1
0:5.6.24-1.126.amzn1
fixed
php56-snmp
Amazon Linux 1
0:5.6.24-1.126.amzn1
fixed
php56-soap
Amazon Linux 1
0:5.6.24-1.126.amzn1
fixed
php56-tidy
Amazon Linux 1
0:5.6.24-1.126.amzn1
fixed
php56-xml
Amazon Linux 1
0:5.6.24-1.126.amzn1
fixed
php56-xmlrpc
Amazon Linux 1
0:5.6.24-1.126.amzn1
fixed
Common Weakness Enumeration
References
http://github.com/php/php-src/commit/5b597a2e5b28e2d5a52fc1be13f425f08f47cb62?w=1
http://lists.apple.com/archives/security-announce/2016/Sep/msg00006.html
http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00004.html
http://lists.opensuse.org/opensuse-updates/2016-08/msg00003.html
http://php.net/ChangeLog-5.php
http://php.net/ChangeLog-7.php
http://rhn.redhat.com/errata/RHSA-2016-2598.html
http://rhn.redhat.com/errata/RHSA-2016-2750.html
http://www.debian.org/security/2016/dsa-3618
http://www.openwall.com/lists/oss-security/2016/06/23/4
http://www.securityfocus.com/bid/91396
https://bugs.php.net/bug.php?id=72402
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05240731
https://support.apple.com/HT207170
http://github.com/php/php-src/commit/5b597a2e5b28e2d5a52fc1be13f425f08f47cb62?w=1
http://lists.apple.com/archives/security-announce/2016/Sep/msg00006.html
http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00004.html
http://lists.opensuse.org/opensuse-updates/2016-08/msg00003.html
http://php.net/ChangeLog-5.php
http://php.net/ChangeLog-7.php
http://rhn.redhat.com/errata/RHSA-2016-2598.html
http://rhn.redhat.com/errata/RHSA-2016-2750.html
http://www.debian.org/security/2016/dsa-3618
http://www.openwall.com/lists/oss-security/2016/06/23/4
http://www.securityfocus.com/bid/91396
https://bugs.php.net/bug.php?id=72402
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05240731
https://support.apple.com/HT207170