CVE-2016-6294

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The locale_accept_from_http function in ext/intl/locale/locale_methods.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 does not properly restrict calls to the ICU uloc_acceptLanguageFromHTTP function, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a call with a long argument.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-125

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=aa82e99ed8003c01f1ef4f0940e56b85c5b032d4
http://lists.apple.com/archives/security-announce/2016/Sep/msg00006.html
http://openwall.com/lists/oss-security/2016/07/24/2Mailing List
http://php.net/ChangeLog-5.phpRelease Notes
http://php.net/ChangeLog-7.phpRelease Notes
http://rhn.redhat.com/errata/RHSA-2016-2750.html
http://www.debian.org/security/2016/dsa-3631
http://www.securityfocus.com/bid/92115Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1036430
https://bugs.php.net/72533Exploit, Issue Tracking, Mitigation, Patch, Third Party Advisory
https://security.gentoo.org/glsa/201611-22
https://support.apple.com/HT207170
http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=aa82e99ed8003c01f1ef4f0940e56b85c5b032d4
http://lists.apple.com/archives/security-announce/2016/Sep/msg00006.html
http://openwall.com/lists/oss-security/2016/07/24/2Mailing List
http://php.net/ChangeLog-5.phpRelease Notes
http://php.net/ChangeLog-7.phpRelease Notes
http://rhn.redhat.com/errata/RHSA-2016-2750.html
http://www.debian.org/security/2016/dsa-3631
http://www.securityfocus.com/bid/92115Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1036430
https://bugs.php.net/72533Exploit, Issue Tracking, Mitigation, Patch, Third Party Advisory
https://security.gentoo.org/glsa/201611-22
https://support.apple.com/HT207170

Timeline

Published: Jul 25, 2016
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-62959.8ext/snmp/snmp.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 improperly interacts with the unserialize implementation and CVE-2016-62969.8Integer signedness error in the simplestring_addn function in simplestring.c in xmlrpc-epi through 0.54.2, as used in PHP before 5.5.38, 5.6 CVE-2016-62978.8Integer overflow in the php_stream_zip_opener function in ext/zip/zip_stream.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0 CVE-2016-62985.3The _Rsa15 class in the RSA 1.5 algorithm implementation in jwa.py in jwcrypto before 0.3.2 lacks the Random Filling protection mechanism, w CVE-2016-62997.8The scm plug-in in mock might allow attackers to bypass the intended chroot protection mechanism and gain root privileges via a crafted spec CVE-2016-63017.5The recv_and_process_client_pkt function in networking/ntpd.c in busybox allows remote attackers to cause a denial of service (CPU and bandw CVE-2016-63027.5The tls_decrypt_ticket function in ssl/t1_lib.c in OpenSSL before 1.1.0 does not consider the HMAC size during validation of the ticket leng CVE-2016-63039.8Integer overflow in the MDC2_Update function in crypto/mdc2/mdc2dgst.c in OpenSSL before 1.1.0 allows remote attackers to cause a denial of CVE-2016-63047.5Multiple memory leaks in t1_lib.c in OpenSSL before 1.0.1u, 1.0.2 before 1.0.2i, and 1.1.0 before 1.1.0a allow remote attackers to cause a d CVE-2016-63057.5The ssl3_read_bytes function in record/rec_layer_s3.c in OpenSSL 1.1.0 before 1.1.0a allows remote attackers to cause a denial of service (i CVE-2016-63065.9The certificate parser in OpenSSL before 1.0.1u and 1.0.2 before 1.0.2i might allow remote attackers to cause a denial of service (out-of-bo CVE-2016-63075.9The state-machine implementation in OpenSSL 1.1.0 before 1.1.0a allocates memory before checking for an excessive length, which might allow