9.8

CVE-2016-5873

Exploit
Buffer overflow in the HTTP URL parsing functions in pecl_http before 3.0.1 might allow remote attackers to execute arbitrary code via non-printable characters in a URL.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Php ≫ Pecl Http Updaterc1 Version <= 3.0.1
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 4.7% 0.906
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 9.8 3.9 5.9
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 7.5 10 6.4
AV:N/AC:L/Au:N/C:P/I:P/A:P
CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

https://security.netapp.com/advisory/ntap-20180112-0001/
http://www.openwall.com/lists/oss-security/2016/06/29/1
Patch
Third Party Advisory
Mailing List
http://www.openwall.com/lists/oss-security/2016/06/29/4
Third Party Advisory
Mailing List
http://www.securityfocus.com/bid/95863
https://bugs.php.net/bug.php?id=71719
Vendor Advisory
Exploit
https://github.com/m6w6/ext-http/commit/3724cd76a28be1d6049b5537232e97ac
Patch
Vendor Advisory
https://pecl.php.net/package/pecl_http/3.0.1
Vendor Advisory
Release Notes
https://security.gentoo.org/glsa/201612-17