PT-2019-7841
CVE-2016-7398
·
تاريخ النشر
2019-09-06
·
تاريخ التحديث
2019-09-20
الوصف من
CVSS 3.1
9.8
حرجةالمقاييسAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
pecl-http extension versions 3.1.0beta2 and earlier (PHP 7)
pecl-http extension versions 2.6.0beta2 and earlier (PHP 5)
Description
A type confusion issue in the
merge param() function of php http params.c allows attackers to crash PHP and possibly execute arbitrary code via crafted HTTP requests.Recommendations
For pecl-http extension versions 3.1.0beta2 and earlier (PHP 7), update to a version that fixes the issue in the
merge param() function.
For pecl-http extension versions 2.6.0beta2 and earlier (PHP 5), update to a version that fixes the issue in the merge param() function.
As a temporary workaround, consider restricting access to the merge param() function until a patch is available.قابلية الاستغلال
استغلال
إصلاح
التأثيرات
الباحثون
المورّدون
المنتجات المتأثرة
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾