Multiple integer overflows in the mbfl_strcut function in ext/mbstring/libmbfl/mbfl/mbfilter.c in PHP before 5.5.34, 5.6.x before 5.6.20, and 7.x before 7.0.5 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted mb_strcut call.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux | — | Upgrade php56Upgrade php55 | May 3, 2016 | May 3, 2016 |
| Apple Osx Apachemodphp | — | Upgrade macOS to the latest version | Jun 2, 2016 | May 20, 2016 |
| Debian | — | Upgrade php5Upgrade php7.0 | Apr 28, 2016 | Apr 27, 2016 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Aug 29, 2016 |
| Gentoo Linux | — | Upgrade dev-lang/php. | Oct 30, 2017 | May 20, 2016 |
| Huawei Euleros 2_0_sp2 | — | Upgrade php-odbcUpgrade phpUpgrade php-pgsqlUpgrade php-ldapUpgrade php-commonUpgrade php-pdoUpgrade php-xmlUpgrade php-cliUpgrade php-xmlrpcUpgrade php-recodeUpgrade php-processUpgrade php-soapUpgrade php-gdUpgrade php-mysql | Nov 3, 2020 | May 20, 2016 |
| Huawei Euleros 2_0_sp3 | — | Upgrade php-odbcUpgrade php-xmlrpcUpgrade php-pgsqlUpgrade php-commonUpgrade php-mysqlUpgrade php-soapUpgrade php-pdoUpgrade php-processUpgrade php-recodeUpgrade php-gdUpgrade php-ldapUpgrade php-cliUpgrade phpUpgrade php-xml | Sep 28, 2020 | May 20, 2016 |
| Php | — | Upgrade to PHP version 7.0.5Upgrade to PHP version 5.6.20Upgrade to PHP version 5.5.34 | Jun 3, 2016 | May 20, 2016 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Mar 26, 2016 |
| Suse | — | Upgrade php5-ftpUpgrade php5-mbstringUpgrade php53-gdUpgrade apache2-mod_php5Upgrade php53-bz2Upgrade php53-xmlreaderUpgrade php5-gettextUpgrade php53-pspellUpgrade php53-soapUpgrade php5Upgrade php5-jsonUpgrade php5-pdoUpgrade php53-wddxUpgrade php53-ftpUpgrade php53-fastcgiUpgrade php53-pgsqlUpgrade php5-fastcgiUpgrade php53-posixUpgrade php5-exifUpgrade php5-xslUpgrade php53-xmlwriterUpgrade php5-bcmathUpgrade php5-zipUpgrade php53-gettextUpgrade php5-sysvsemUpgrade php5-opcacheUpgrade php5-opensslUpgrade php5-mcryptUpgrade php5-mysqlUpgrade php5-iconvUpgrade php53-pdoUpgrade php53-odbcUpgrade php5-xmlreaderUpgrade php53-iconvUpgrade php53-sysvsemUpgrade php53-curlUpgrade php5-socketsUpgrade php53-mbstringUpgrade php5-snmpUpgrade php53-pcntlUpgrade php53-socketsUpgrade php53-imapUpgrade php53Upgrade php53-sysvmsgUpgrade php5-wddxUpgrade php53-gmpUpgrade php5-pharUpgrade php5-gmpUpgrade php53-suhosinUpgrade php53-sysvshmUpgrade php5-xmlwriterUpgrade php53-readlineUpgrade php53-calendarUpgrade php53-shmopUpgrade php5-xmlrpcUpgrade php53-tidyUpgrade php53-bcmathUpgrade php53-zipUpgrade php53-pearUpgrade php5-domUpgrade php53-ldapUpgrade php53-jsonUpgrade php5-fileinfoUpgrade php5-sysvshmUpgrade php53-tokenizerUpgrade php53-xmlrpcUpgrade php5-bz2Upgrade php5-sysvmsgUpgrade php5-calendarUpgrade php53-develUpgrade php5-ctypeUpgrade php53-exifUpgrade php5-shmopUpgrade php5-pgsqlUpgrade php53-sqliteUpgrade php5-dbaUpgrade php5-posixUpgrade php53-ctypeUpgrade apache2-mod_php53Upgrade php5-fpmUpgrade php5-ldapUpgrade php5-soapUpgrade php5-sqliteUpgrade php53-opensslUpgrade php5-pcntlUpgrade php53-dbaUpgrade php5-develUpgrade php53-zlibUpgrade php5-intlUpgrade php5-pspellUpgrade php5-curlUpgrade php53-domUpgrade php53-mysqlUpgrade php53-xslUpgrade php5-zlibUpgrade php5-enchantUpgrade php5-odbcUpgrade php5-pearUpgrade php5-tokenizerUpgrade php53-mcryptUpgrade php53-intlUpgrade php53-fileinfoUpgrade php53-snmpUpgrade php5-gdUpgrade php5-suhosin | May 11, 2016 | May 11, 2016 |
| Ubuntu | — | Upgrade php5-fpmUpgrade libapache2-mod-php7.0Upgrade php7.0-cliUpgrade php7.0-cgiUpgrade php5-cliUpgrade libapache2-mod-php5Upgrade php7.0-fpmUpgrade php5-cgi | May 24, 2016 | May 20, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub