CVE-2016-7398

NameCVE-2016-7398
DescriptionA type confusion vulnerability in the merge_param() function of php_http_params.c in PHP's pecl-http extension 3.1.0beta2 (PHP 7) and earlier as well as 2.6.0beta2 (PHP 5) and earlier allows attackers to crash PHP and possibly execute arbitrary code via crafted HTTP requests.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
ReferencesDLA-1929-1
NVD severityhigh (attack range: remote)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
php-pecl-http (PTS)jessie2.0.4-1vulnerable
jessie (security)2.0.4-1+deb8u1fixed
stretch3.1.0+2.6.0-4fixed
buster3.2.0+2.6.0-2fixed
bullseye, sid3.2.1+2.6.0-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
php-pecl-httpsource(unstable)3.1.0+2.6.0-1high
php-pecl-httpsourcejessie2.0.4-1+deb8u1highDLA-1929-1

Notes

https://bugs.php.net/bug.php?id=73055
https://github.com/m6w6/ext-http/commit/17137d4ab1ce81a2cee0fae842340a344ef3da83

Search for package or bug name: Reporting problems