CVE-2016-5769
Last modified
CVE-2016-5769 is a vulnerability of currently unknown severity. Multiple integer overflows in mcrypt.c in the mcrypt extension in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8 allow remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted length value, related to the (1) mcrypt_generic and (2) mdecrypt_generic functions.. EPSS estimates a 8.21% chance of exploitation in the next 30 days.
Description
Multiple integer overflows in mcrypt.c in the mcrypt extension in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8 allow remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted length value, related to the (1) mcrypt_generic and (2) mdecrypt_generic functions.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions | Update |
|---|---|---|---|
| Php | Php | <= 5.5.36 | — |
| Php | Php | 5.6.0 | Alpha1 |
| Php | Php | 5.6.1 | — |
| Php | Php | 5.6.2 | — |
| Php | Php | 5.6.3 | — |
| Php | Php | 5.6.4 | — |
| Php | Php | 5.6.5 | — |
| Php | Php | 5.6.6 | — |
| Php | Php | 5.6.7 | — |
| Php | Php | 5.6.8 | — |
| Php | Php | 5.6.9 | — |
| Php | Php | 5.6.10 | — |
| Php | Php | 5.6.11 | — |
| Php | Php | 5.6.12 | — |
| Php | Php | 5.6.13 | — |
| Php | Php | 5.6.14 | — |
| Php | Php | 5.6.15 | — |
| Php | Php | 5.6.16 | — |
| Php | Php | 5.6.17 | — |
| Php | Php | 5.6.18 | — |
| Php | Php | 5.6.19 | — |
| Php | Php | 5.6.20 | — |
| Php | Php | 5.6.21 | — |
| Php | Php | 5.6.22 | — |
| Php | Php | 7.0.0 | — |
| Php | Php | 7.0.1 | — |
| Php | Php | 7.0.2 | — |
| Php | Php | 7.0.3 | — |
| Php | Php | 7.0.4 | — |
| Php | Php | 7.0.5 | — |
| Php | Php | 7.0.6 | — |
| Php | Php | 7.0.7 | — |
References
- http://php.net/ChangeLog-5.phpPatch, Release Notes
- http://php.net/ChangeLog-7.phpBroken Link
- https://bugs.php.net/bug.php?id=72455Vendor Advisory
- http://php.net/ChangeLog-5.phpPatch, Release Notes
- http://php.net/ChangeLog-7.phpBroken Link
- https://bugs.php.net/bug.php?id=72455Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2016-5769?
How severe is CVE-2016-5769?
How do I fix CVE-2016-5769?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2016
- CVE-2016-5763Vulnerability in Novell Open Enterprise Server (OES2015 SP1 …
- CVE-2016-5764Micro Focus Rumba FTP 4.X client buffer overflow makes it po…
- CVE-2016-5765Administrative Server in Micro Focus Host Access Management …
- CVE-2016-5766Integer overflow in the _gd2GetHeader function in gd_gd2.c i…
- CVE-2016-5767Integer overflow in the gdImageCreate function in gd.c in th…
- CVE-2016-5768Double free vulnerability in the _php_mb_regex_ereg_replace_…
- CVE-2016-5770Integer overflow in the SplFileObject::fread function in spl…9.8
- CVE-2016-5771spl_array.c in the SPL extension in PHP before 5.5.37 and 5.…9.8
- CVE-2016-5772Double free vulnerability in the php_wddx_process_data funct…9.8
- CVE-2016-5773php_zip.c in the zip extension in PHP before 5.5.37, 5.6.x b…
- CVE-2016-5774The HTTPS server in Blue Coat PacketShaper S-Series 11.5.x b…
- CVE-2016-5781Stack-based buffer overflow in WECON LeviStudio allows remot…
Are you affected by CVE-2016-5769?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST