CVE-2016-4537
- Source
- https://cve.org/CVERecord?id=CVE-2016-4537
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2016-4537.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2016-4537
- Downstream
- Related
- Published
- 2016-05-22T01:59:21.963Z
- Modified
- 2026-04-11T12:04:13.225128Z
- Severity
-
- 9.8 (Critical) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- [none]
- Details
-
The bcpowmod function in ext/bcmath/bcmath.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 accepts a negative integer for the scale argument, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted call.
- Database specific
{ "unresolved_ranges": [ { "cpe": "cpe:2.3:o:fedoraproject:fedora:24:*:*:*:*:*:*:*", "source": "CPE_FIELD", "extracted_events": [ { "last_affected": "24" } ] }, { "cpe": "cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:*", "source": "CPE_FIELD", "extracted_events": [ { "last_affected": "42.1" } ] } ] }- References
-
- http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183736.html
- http://lists.opensuse.org/opensuse-updates/2016-05/msg00086.html
- http://lists.opensuse.org/opensuse-updates/2016-06/msg00027.html
- http://www.openwall.com/lists/oss-security/2016/05/05/21
- http://www.securityfocus.com/bid/90173
- https://git.php.net/?p=php-src.git%3Ba=commit%3Bh=d650063a0457aec56364e4005a636dc6c401f9cd
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05240731
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05320149
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722
- http://rhn.redhat.com/errata/RHSA-2016-2750.html
- http://www.debian.org/security/2016/dsa-3602
- https://security.gentoo.org/glsa/201611-22
- http://php.net/ChangeLog-5.php
- http://php.net/ChangeLog-7.php
- https://bugs.php.net/bug.php?id=72093
Affected packages
Git / github.com/php/php-src
Affected ranges
- Type
- GIT
- Repo
- https://github.com/php/php-src
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affected
- Database specific
{ "cpe": [ "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*", "cpe:2.3:a:php:php:5.6.0:*:*:*:*:*:*:*", "cpe:2.3:a:php:php:5.6.1:*:*:*:*:*:*:*", "cpe:2.3:a:php:php:5.6.2:*:*:*:*:*:*:*", "cpe:2.3:a:php:php:5.6.3:*:*:*:*:*:*:*", "cpe:2.3:a:php:php:5.6.4:*:*:*:*:*:*:*", "cpe:2.3:a:php:php:5.6.5:*:*:*:*:*:*:*", "cpe:2.3:a:php:php:5.6.6:*:*:*:*:*:*:*", "cpe:2.3:a:php:php:5.6.7:*:*:*:*:*:*:*", "cpe:2.3:a:php:php:5.6.8:*:*:*:*:*:*:*", "cpe:2.3:a:php:php:5.6.9:*:*:*:*:*:*:*", "cpe:2.3:a:php:php:5.6.10:*:*:*:*:*:*:*", "cpe:2.3:a:php:php:5.6.11:*:*:*:*:*:*:*", "cpe:2.3:a:php:php:5.6.12:*:*:*:*:*:*:*", "cpe:2.3:a:php:php:5.6.13:*:*:*:*:*:*:*", "cpe:2.3:a:php:php:5.6.14:*:*:*:*:*:*:*", "cpe:2.3:a:php:php:5.6.15:*:*:*:*:*:*:*", "cpe:2.3:a:php:php:5.6.16:*:*:*:*:*:*:*", "cpe:2.3:a:php:php:5.6.17:*:*:*:*:*:*:*", "cpe:2.3:a:php:php:5.6.18:*:*:*:*:*:*:*", "cpe:2.3:a:php:php:5.6.19:*:*:*:*:*:*:*", "cpe:2.3:a:php:php:5.6.20:*:*:*:*:*:*:*", "cpe:2.3:a:php:php:7.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:php:php:7.0.1:*:*:*:*:*:*:*", "cpe:2.3:a:php:php:7.0.2:*:*:*:*:*:*:*", "cpe:2.3:a:php:php:7.0.3:*:*:*:*:*:*:*", "cpe:2.3:a:php:php:7.0.4:*:*:*:*:*:*:*", "cpe:2.3:a:php:php:7.0.5:*:*:*:*:*:*:*" ], "source": "CPE_FIELD", "extracted_events": [ { "introduced": "0" }, { "last_affected": "5.5.34" }, { "last_affected": "5.6.0" }, { "last_affected": "5.6.1" }, { "last_affected": "5.6.2" }, { "last_affected": "5.6.3" }, { "last_affected": "5.6.4" }, { "last_affected": "5.6.5" }, { "last_affected": "5.6.6" }, { "last_affected": "5.6.7" }, { "last_affected": "5.6.8" }, { "last_affected": "5.6.9" }, { "last_affected": "5.6.10" }, { "last_affected": "5.6.11" }, { "last_affected": "5.6.12" }, { "last_affected": "5.6.13" }, { "last_affected": "5.6.14" }, { "last_affected": "5.6.15" }, { "last_affected": "5.6.16" }, { "last_affected": "5.6.17" }, { "last_affected": "5.6.18" }, { "last_affected": "5.6.19" }, { "last_affected": "5.6.20" }, { "last_affected": "7.0.0" }, { "last_affected": "7.0.1" }, { "last_affected": "7.0.2" }, { "last_affected": "7.0.3" }, { "last_affected": "7.0.4" }, { "last_affected": "7.0.5" } ] }
Affected versions
Other
POST_64BIT_BRANCH_MERGE
POST_AST_MERGE
POST_PHP7_NSAPI_REMOVAL
POST_PHP7_REMOVALS
POST_PHPNG_MERGE
PRE_64BIT_BRANCH_MERGE
PRE_AST_MERGE
PRE_PHP7_EREG_MYSQL_REMOVALS
PRE_PHP7_NSAPI_REMOVAL
PRE_PHP7_REMOVALS
php-5.*
php-5.5.34
php-5.6.0
php-5.6.0RC1
php-5.6.0RC2
php-5.6.0RC3
php-5.6.0RC4
php-5.6.0alpha1
php-5.6.0alpha2
php-5.6.0alpha3
php-5.6.0beta1
php-5.6.0beta2
php-5.6.0beta3
php-5.6.0beta4
php-5.6.1
php-5.6.10
php-5.6.10RC1
php-5.6.11
php-5.6.11RC1
php-5.6.12
php-5.6.12RC1
php-5.6.13
php-5.6.13RC1
php-5.6.14
php-5.6.14RC1
php-5.6.15
php-5.6.15RC1
php-5.6.16
php-5.6.16RC1
php-5.6.17
php-5.6.17RC1
php-5.6.18
php-5.6.19
php-5.6.19RC1
php-5.6.1RC1
php-5.6.2
php-5.6.20
php-5.6.20RC1
php-5.6.3
php-5.6.3RC1
php-5.6.4
php-5.6.4RC1
php-5.6.5
php-5.6.5RC1
php-5.6.6
php-5.6.6RC1
php-5.6.7
php-5.6.7RC1
php-5.6.8
php-5.6.8RC1
php-5.6.9
php-5.6.9RC1
php-7.*
php-7.0.0
php-7.0.0RC1
php-7.0.0RC2
php-7.0.0RC3
php-7.0.0RC4
php-7.0.0RC5
php-7.0.0RC6
php-7.0.0RC7
php-7.0.0RC8
php-7.0.0alpha1
php-7.0.0alpha2
php-7.0.0beta1
php-7.0.0beta2
php-7.0.0beta3
php-7.0.1
php-7.0.1RC1
php-7.0.2
php-7.0.2RC1
php-7.0.3
php-7.0.4
php-7.0.4RC1
php-7.0.5
php-7.0.5RC1