MITRE disputed

** DISPUTED ** Integer overflow in the php_raw_url_encode function in ext/standard/url.c in PHP before 5.5.34, 5.6.x before 5.6.20, and 7.x before 7.0.5 allows remote attackers to cause a denial of service (application crash) via a long string to the rawurlencode function. NOTE: the vendor says "Not sure if this qualifies as security issue (probably not)."

Integer overflow in the php_raw_url_encode function in ext/standard/url.c in PHP before 5.5.34, 5.6.x before 5.6.20, and 7.x before 7.0.5 allows remote attackers to cause a denial of service (application crash) via a long string to the rawurlencode function. NOTE: the vendor says "Not sure if this qualifies as security issue (probably not).

MITRE https://git.php.net/?p=php-src.git%3Ba=commit%3Bh=95433e8e339dbb6b5d5541473c1661db6ba2c451 [No types assigned]

MITRE https://git.php.net/?p=php-src.git;a=commit;h=95433e8e339dbb6b5d5541473c1661db6ba2c451

http://rhn.redhat.com/errata/RHSA-2016-2750.html [No Types Assigned]

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722 [No Types Assigned]

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00031.html [No Types Assigned]

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00033.html [No Types Assigned]

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00056.html [No Types Assigned]

http://www.debian.org/security/2016/dsa-3560 [No Types Assigned]

http://www.ubuntu.com/usn/USN-2952-1 [No Types Assigned]

http://www.ubuntu.com/usn/USN-2952-2 [No Types Assigned]

http://www.securityfocus.com/bid/85801 [No Types Assigned]

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05320149

Desbordamiento de entero en la función php_raw_url_encode en ext/styard/url.c en PHP en versiones anteriores a 5.5.34, 5.6.x en versiones anteriores a 5.6.20 y 7.x en versiones anteriores a 7.0.5 permite a atacantes remotos causar una denegación de servicio (caída de aplicación) a través de una cadena larga para la función rawurlencode. NOTA: el vendedor afirma "No seguro si esto califica como problema de seguridad (probablemente no)".

** DISPUTADA ** Desbordamiento de entero en la función php_raw_url_encode en ext/styard/url.c en PHP en versiones anteriores a 5.5.34, 5.6.x en versiones anteriores a 5.6.20 y 7.x en versiones anteriores a 7.0.5 permite a atacantes remotos causar una denegación de servicio (caída de aplicación) a través de una cadena larga para la función rawurlencode. NOTA: el vendedor afirma "No seguro si esto califica como problema de seguridad (probablemente no)".

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05240731

Configuration 1
     OR
          *cpe:2.3:a:php:php:7.0.1:*:*:*:*:*:*:*
          *cpe:2.3:a:php:php:7.0.4:*:*:*:*:*:*:*
          *cpe:2.3:a:php:php:7.0.0:*:*:*:*:*:*:*
          *cpe:2.3:a:php:php:7.0.2:*:*:*:*:*:*:*
          *cpe:2.3:a:php:php:7.0.3:*:*:*:*:*:*:*
          *cpe:2.3:a:php:php:5.6.18:*:*:*:*:*:*:*
          *cpe:2.3:a:php:php:5.6.9:*:*:*:*:*:*:*
          *cpe:2.3:a:php:php:5.6.8:*:*:*:*:*:*:*
          *cpe:2.3:a:php:php:5.6.7:*:*:*:*:*:*:*
          *cpe:2.3:a:php:php:5.6.6

(AV:N/AC:L/Au:N/C:N/I:N/A:P)

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-189

https://bugs.php.net/bug.php?id=71798 No Types Assigned

https://bugs.php.net/bug.php?id=71798 Exploit