{"id":"CVE-2016-5772","aliases":["CLSA-2020-1605798462","DLA-628-1","DSA-3618-1","EUVD-2016-6707","GHSA-v2qq-h2h4-pjqv","MGASA-2016-0238","RHSA-2016:2750","SUSE-SU-2016:1842-1","SUSE-SU-2016:2013-1","SUSE-SU-2016:2080-1","UBUNTU-CVE-2016-5772","USN-3045-1"],"status":"published","title":"Double free vulnerability in the php_wddx_process_data function in wddx.c in the WDDX extension...","description":"Double free vulnerability in the php_wddx_process_data function in wddx.c in the WDDX extension in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted XML data that is mishandled in a wddx_deserialize call.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-06","score":0.09674,"percentile":0.95523,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-415"],"published":"2016-06-24T00:00:00Z","modified":"2026-10-24T14:05:46Z","fixes":[{"ecosystem":"Ubuntu:14.04:LTS","package":"php5","fixed_in":["5.5.9+dfsg-1ubuntu4.19"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"php7.0","fixed_in":["7.0.8-0ubuntu0.16.04.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"php","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.3-51.el6.cloudlinux"}]}],"bundled":70},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"php-bcmath","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.3-51.el6.cloudlinux"}]}],"bundled":70},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"php-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.3-51.el6.cloudlinux"}]}],"bundled":70},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"php-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.3-51.el6.cloudlinux"}]}],"bundled":70},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"php-dba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.3-51.el6.cloudlinux"}]}],"bundled":70},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"php-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.3-51.el6.cloudlinux"}]}],"bundled":70},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"php-embedded","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.3-51.el6.cloudlinux"}]}],"bundled":70},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"php-enchant","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.3-51.el6.cloudlinux"}]}],"bundled":70},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"php-fpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.3-51.el6.cloudlinux"}]}],"bundled":70},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"php-gd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.3-51.el6.cloudlinux"}]}],"bundled":70},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"php-imap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.3-51.el6.cloudlinux"}]}],"bundled":70},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"php-intl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.3-51.el6.cloudlinux"}]}],"bundled":70},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"php-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.3-51.el6.cloudlinux"}]}],"bundled":70},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"php-mbstring","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.3-51.el6.cloudlinux"}]}],"bundled":70},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"php-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.3-51.el6.cloudlinux"}]}],"bundled":70},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"php-odbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.3-51.el6.cloudlinux"}]}],"bundled":70},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"php-pdo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.3-51.el6.cloudlinux"}]}],"bundled":70},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"php-pgsql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.3-51.el6.cloudlinux"}]}],"bundled":70},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"php-process","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.3-51.el6.cloudlinux"}]}],"bundled":70},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"php-pspell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.3-51.el6.cloudlinux"}]}],"bundled":70},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"php-recode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.3-51.el6.cloudlinux"}]}],"bundled":70},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"php-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.3-51.el6.cloudlinux"}]}],"bundled":70},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"php-soap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.3-51.el6.cloudlinux"}]}],"bundled":70},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"php-tidy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.3-51.el6.cloudlinux"}]}],"bundled":70},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"php-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.3-51.el6.cloudlinux"}]}],"bundled":70},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"php-xmlrpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.3-51.el6.cloudlinux"}]}],"bundled":70},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"php-zts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.3-51.el6.cloudlinux"}]}],"bundled":70},{"source":"osv","ecosystem":"Debian:7","package":"php5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.45-0+deb7u5"}]}],"versions":["5.4.11-1","5.4.15-1","5.4.34-0+deb7u1","5.4.35-0+deb7u1","5.4.35-0+deb7u2","5.4.36-0+deb7u1","5.4.36-0+deb7u3","5.4.38-0+deb7u1","5.4.39-0+deb7u1","5.4.39-0+deb7u2","5.4.4-14","5.4.4-14+deb7u1","5.4.4-14+deb7u10","5.4.4-14+deb7u11","5.4.4-14+deb7u12","5.4.4-14+deb7u13","5.4.4-14+deb7u14","5.4.4-14+deb7u2","5.4.4-14+deb7u3","5.4.4-14+deb7u4","5.4.4-14+deb7u5","5.4.4-14+deb7u7","5.4.4-14+deb7u8","5.4.4-14+deb7u9","5.4.4-15","5.4.4-15.1","5.4.41-0+deb7u1","5.4.44-0+deb7u1","5.4.45-0+deb7u1","5.4.45-0+deb7u2","5.4.45-0+deb7u3","5.4.45-0+deb7u4","5.4.6-1","5.4.6-2","5.4.8-1","5.4.9-1","5.4.9-2","5.4.9-3","5.4.9-4"],"bundled":19},{"source":"osv","ecosystem":"Debian:8","package":"php5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.6.23+dfsg-0+deb8u1"}]}],"versions":["5.6.11+dfsg-1","5.6.12+dfsg-0+deb8u1","5.6.12+dfsg-1","5.6.13+dfsg-0+deb8u1","5.6.13+dfsg-1","5.6.13+dfsg-2","5.6.14+dfsg-0+deb8u1","5.6.14+dfsg-1","5.6.15+dfsg-1","5.6.16+dfsg-1","5.6.16+dfsg-2","5.6.16+dfsg-3","5.6.16+dfsg-4","5.6.17+dfsg-0+deb8u1","5.6.17+dfsg-1","5.6.17+dfsg-3","5.6.18+dfsg-1","5.6.19+dfsg-0+deb8u1","5.6.19+dfsg-1","5.6.19+dfsg-2","5.6.20+dfsg-0+deb8u1","5.6.20+dfsg-1","5.6.21+dfsg-1","5.6.21+dfsg-2","5.6.22+dfsg-0+deb8u1","5.6.22+dfsg-1","5.6.22+dfsg-2","5.6.7+dfsg-1","5.6.9+dfsg-0+deb8u1","5.6.9+dfsg-1"],"bundled":6},{"source":"osv","ecosystem":"Mageia:5","package":"php","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.6.23-1.mga5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-php56","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3-1.el6"}]}],"bundled":80},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-php56-php","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.25-1.el6"}]}],"bundled":80},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-php56-php-bcmath","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.25-1.el6"}]}],"bundled":80},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-php56-php-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.25-1.el6"}]}],"bundled":80},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-php56-php-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.25-1.el6"}]}],"bundled":80},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-php56-php-dba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.25-1.el6"}]}],"bundled":80},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-php56-php-dbg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.25-1.el6"}]}],"bundled":80},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-php56-php-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.25-1.el6"}]}],"bundled":80},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-php56-php-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.25-1.el6"}]}],"bundled":80},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-php56-php-embedded","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.25-1.el6"}]}],"bundled":80},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-php56-php-enchant","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.25-1.el6"}]}],"bundled":80},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-php56-php-fpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.25-1.el6"}]}],"bundled":80},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-php56-php-gd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.25-1.el6"}]}],"bundled":80},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-php56-php-gmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.25-1.el6"}]}],"bundled":80},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-php56-php-imap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.25-1.el6"}]}],"bundled":80},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-php56-php-intl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.25-1.el6"}]}],"bundled":80},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-php56-php-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.25-1.el6"}]}],"bundled":80},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-php56-php-mbstring","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.25-1.el6"}]}],"bundled":80},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-php56-php-mysqlnd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.25-1.el6"}]}],"bundled":80},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-php56-php-odbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.25-1.el6"}]}],"bundled":80},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-php56-php-opcache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.25-1.el6"}]}],"bundled":80},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-php56-php-pdo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.25-1.el6"}]}],"bundled":80},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-php56-php-pear","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.9.5-4.el6"}]}],"bundled":80},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-php56-php-pgsql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.25-1.el6"}]}],"bundled":80},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-php56-php-process","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.25-1.el6"}]}],"bundled":80},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-php56-php-pspell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.25-1.el6"}]}],"bundled":80},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-php56-php-recode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.25-1.el6"}]}],"bundled":80},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-php56-php-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.25-1.el6"}]}],"bundled":80},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-php56-php-soap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.25-1.el6"}]}],"bundled":80},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-php56-php-tidy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.25-1.el6"}]}],"bundled":80},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-php56-php-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.25-1.el6"}]}],"bundled":80},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-php56-php-xmlrpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.25-1.el6"}]}],"bundled":80},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-php56-runtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3-1.el6"}]}],"bundled":80},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-php56-scldevel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3-1.el6"}]}],"bundled":80},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-php56","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3-1.el7"}]}],"bundled":80},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-php56-php","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.25-1.el7"}]}],"bundled":80},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-php56-php-bcmath","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.25-1.el7"}]}],"bundled":80},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-php56-php-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.25-1.el7"}]}],"bundled":80},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-php56-php-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.25-1.el7"}]}],"bundled":80},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-php56-php-dba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.25-1.el7"}]}],"bundled":80},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-php56-php-dbg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.25-1.el7"}]}],"bundled":80},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-php56-php-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.25-1.el7"}]}],"bundled":80},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-php56-php-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.25-1.el7"}]}],"bundled":80},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-php56-php-embedded","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.25-1.el7"}]}],"bundled":80},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-php56-php-enchant","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.25-1.el7"}]}],"bundled":80},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-php56-php-fpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.25-1.el7"}]}],"bundled":80},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-php56-php-gd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.25-1.el7"}]}],"bundled":80},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-php56-php-gmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.25-1.el7"}]}],"bundled":80},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-php56-php-intl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.25-1.el7"}]}],"bundled":80},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-php56-php-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.25-1.el7"}]}],"bundled":80},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-php56-php-mbstring","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.25-1.el7"}]}],"bundled":80},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-php56-php-mysqlnd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.25-1.el7"}]}],"bundled":80},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-php56-php-odbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.25-1.el7"}]}],"bundled":80},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-php56-php-opcache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.25-1.el7"}]}],"bundled":80},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-php56-php-pdo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.25-1.el7"}]}],"bundled":80},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-php56-php-pear","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.9.5-4.el7"}]}],"bundled":80},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-php56-php-pgsql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.25-1.el7"}]}],"bundled":80},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-php56-php-process","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.25-1.el7"}]}],"bundled":80},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-php56-php-pspell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.25-1.el7"}]}],"bundled":80},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-php56-php-recode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.25-1.el7"}]}],"bundled":80},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-php56-php-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.25-1.el7"}]}],"bundled":80},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-php56-php-soap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.25-1.el7"}]}],"bundled":80},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-php56-php-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.25-1.el7"}]}],"bundled":80},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-php56-php-xmlrpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.25-1.el7"}]}],"bundled":80},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-php56-runtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3-1.el7"}]}],"bundled":80},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-php56-scldevel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3-1.el7"}]}],"bundled":80},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"php5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.5.14-68.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP1","package":"php5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.5.14-68.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"php53","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.17-74.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"php53","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.17-74.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"php53","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.17-74.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP2-LTSS","package":"php5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.14-0.7.30.89.1"}]}],"bundled":12},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"php5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.5.9+dfsg-1ubuntu4.19"}]}],"versions":["5.5.3+dfsg-1ubuntu2","5.5.3+dfsg-1ubuntu3","5.5.6+dfsg-1ubuntu1","5.5.6+dfsg-1ubuntu2","5.5.8+dfsg-2ubuntu1","5.5.9+dfsg-1ubuntu1","5.5.9+dfsg-1ubuntu2","5.5.9+dfsg-1ubuntu3","5.5.9+dfsg-1ubuntu4","5.5.9+dfsg-1ubuntu4.1","5.5.9+dfsg-1ubuntu4.2","5.5.9+dfsg-1ubuntu4.3","5.5.9+dfsg-1ubuntu4.4","5.5.9+dfsg-1ubuntu4.5","5.5.9+dfsg-1ubuntu4.6","5.5.9+dfsg-1ubuntu4.7","5.5.9+dfsg-1ubuntu4.9","5.5.9+dfsg-1ubuntu4.11","5.5.9+dfsg-1ubuntu4.12","5.5.9+dfsg-1ubuntu4.13","5.5.9+dfsg-1ubuntu4.14","5.5.9+dfsg-1ubuntu4.16","5.5.9+dfsg-1ubuntu4.17"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"php7.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.8-0ubuntu0.16.04.1"}]}],"versions":["7.0.1-5","7.0.1-6","7.0.2-1","7.0.2-3","7.0.2-4","7.0.2-5","7.0.3-2","7.0.3-3","7.0.3-9ubuntu1","7.0.4-5ubuntu1","7.0.4-5ubuntu2","7.0.4-7ubuntu1","7.0.4-7ubuntu2","7.0.4-7ubuntu2.1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"php5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.5.9+dfsg-1ubuntu4.19"}]}],"versions":["5.5.3+dfsg-1ubuntu2","5.5.3+dfsg-1ubuntu3","5.5.6+dfsg-1ubuntu1","5.5.6+dfsg-1ubuntu2","5.5.8+dfsg-2ubuntu1","5.5.9+dfsg-1ubuntu1","5.5.9+dfsg-1ubuntu2","5.5.9+dfsg-1ubuntu3","5.5.9+dfsg-1ubuntu4","5.5.9+dfsg-1ubuntu4.1","5.5.9+dfsg-1ubuntu4.2","5.5.9+dfsg-1ubuntu4.3","5.5.9+dfsg-1ubuntu4.4","5.5.9+dfsg-1ubuntu4.5","5.5.9+dfsg-1ubuntu4.6","5.5.9+dfsg-1ubuntu4.7","5.5.9+dfsg-1ubuntu4.9","5.5.9+dfsg-1ubuntu4.11","5.5.9+dfsg-1ubuntu4.12","5.5.9+dfsg-1ubuntu4.13","5.5.9+dfsg-1ubuntu4.14","5.5.9+dfsg-1ubuntu4.16","5.5.9+dfsg-1ubuntu4.17"],"bundled":25},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"php7.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.8-0ubuntu0.16.04.2"}]}],"versions":["7.0.1-5","7.0.1-6","7.0.2-1","7.0.2-3","7.0.2-4","7.0.2-5","7.0.3-2","7.0.3-3","7.0.3-9ubuntu1","7.0.4-5ubuntu1","7.0.4-5ubuntu2","7.0.4-7ubuntu1","7.0.4-7ubuntu2","7.0.4-7ubuntu2.1","7.0.8-0ubuntu0.16.04.1"],"bundled":25}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"opensuse","product":"leap"},{"vendor":"opensuse","product":"opensuse"},{"vendor":"php","product":"php"},{"vendor":"suse","product":"linux_enterprise_debuginfo"},{"vendor":"suse","product":"linux_enterprise_server"},{"vendor":"suse","product":"linux_enterprise_software_development_kit"}],"references":[{"url":"http://github.com/php/php-src/commit/a44c89e8af7c2410f4bfc5e097be2a5d0639a60c?w=1","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"http://lists.apple.com/archives/security-announce/2016/Sep/msg00006.html","tags":["vendor-advisory","x_refsource_APPLE","x_transferred","Broken Link","Mailing List","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00004.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-updates/2016-08/msg00003.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-2750.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"http://php.net/ChangeLog-5.php","tags":["x_refsource_CONFIRM","x_transferred","Patch","Release Notes","Vendor Advisory","fix"]},{"url":"https://bugs.php.net/bug.php?id=72340","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Issue Tracking","Vendor Advisory","report"]},{"url":"http://www.openwall.com/lists/oss-security/2016/06/23/4","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Patch","Third Party Advisory","fix"]},{"url":"http://www.debian.org/security/2016/dsa-3618","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"http://php.net/ChangeLog-7.php","tags":["x_refsource_CONFIRM","x_transferred","Release Notes","Vendor Advisory","advisory"]},{"url":"https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05240731","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://support.apple.com/HT207170","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.securityfocus.com/bid/91398","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00025.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-5772","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-v2qq-h2h4-pjqv"},{"url":"https://errata.cloudlinux.com/els6/CLSA-2020-1605798462.html","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2016-0238.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=18765","tags":["report"]},{"url":"http://php.net/ChangeLog-5.php#5.6.23","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2016:2750","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1207198","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1207202","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1228283","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1237223","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1260716","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1285399","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1285408","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1287614","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1287623","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1287629","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1287636","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1287671","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1287690","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1287711","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1297710","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1297717","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1305536","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1305543","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1315312","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1315328","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1321893","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1323074","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1323103","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1323106","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1323108","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1323114","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1323118","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1330418","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1330420","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1332454","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1332860","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1332865","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1332872","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1332877","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1336772","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1336775","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1338896","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1338907","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1338912","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1339590","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1339949","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1340433","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1340738","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1347772","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1351068","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1351069","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1351168","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1351171","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1351173","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1351175","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1351179","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1351603","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1358395","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1359698","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1359710","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1359718","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1359756","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1359800","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1359811","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1359815","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1359822","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1359828","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1360322","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1374697","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1374698","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1374699","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1374701","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1374704","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1374705","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1374707","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1374708","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1374711","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_2750.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-7456","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-7456","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-7456","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-9767","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-9767","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-9767","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-2325","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-2325","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-2325","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-2326","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-2326","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-2326","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-2327","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-2327","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-2327","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-2328","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-2328","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-2328","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-3210","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-3210","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-3210","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-3217","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-3217","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-3217","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-5073","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-5073","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-5073","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-8381","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-8381","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-8381","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-8383","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-8383","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-8383","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-8384","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-8384","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-8384","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-8385","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-8385","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-8385","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-8386","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-8386","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-8386","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-8388","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-8388","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-8388","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-8391","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-8391","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-8391","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-8392","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-8392","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-8392","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-8395","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-8395","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-8395","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-8835","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-8835","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-8835","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-8865","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-8865","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-8865","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-8866","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-8866","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-8866","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-8867","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-8867","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-8867","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-8873","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-8873","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-8873","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-8874","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-8874","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-8874","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-8876","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-8876","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-8876","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-8877","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-8877","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-8877","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-8879","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-8879","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-8879","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-8935","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1348927","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-8935","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-8935","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-1903","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-1903","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-1903","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-2554","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-2554","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-2554","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-3074","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-3074","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-3074","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-3141","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-3141","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-3141","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-3142","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-3142","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-3142","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-4070","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-4070","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-4070","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-4071","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-4071","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-4071","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-4072","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-4072","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-4072","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-4073","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-4073","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-4073","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-4342","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-4342","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-4342","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-4343","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-4343","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-4343","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-4473","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-4473","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-4473","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-4537","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-4537","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-4537","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-4538","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-4538","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-4538","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-4539","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-4539","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-4539","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-4540","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-4540","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-4540","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-4541","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-4541","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-4541","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-4542","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-4542","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-4542","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-4543","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-4543","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-4543","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-4544","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-4544","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-4544","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-5093","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-5093","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-5093","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-5094","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-5094","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-5094","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-5096","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-5096","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-5096","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-5114","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-5114","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-5114","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-5399","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-5399","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-5399","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-5766","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-5766","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-5766","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-5767","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-5767","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-5767","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-5768","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-5768","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-5768","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-5770","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-5770","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-5770","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-5771","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-5771","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-5771","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-5772","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-5772","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-5773","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-5773","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-5773","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-6128","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-6128","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-6128","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-6207","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-6207","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-6207","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-6288","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-6288","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-6288","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-6289","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-6289","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-6289","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-6290","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-6290","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-6290","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-6291","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-6291","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-6291","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-6292","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-6292","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-6292","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-6294","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-6294","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-6294","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-6295","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-6295","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-6295","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-6296","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-6296","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-6296","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-6297","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-6297","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-6297","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-7124","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-7124","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-7124","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-7125","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-7125","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-7125","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-7126","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-7126","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-7126","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-7127","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-7127","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-7127","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-7128","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-7128","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-7128","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-7129","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-7129","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-7129","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-7130","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-7130","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-7130","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-7131","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-7131","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-7131","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-7132","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-7132","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-7132","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20161842-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/986004","tags":["report"]},{"url":"https://bugzilla.suse.com/986244","tags":["report"]},{"url":"https://bugzilla.suse.com/986246","tags":["report"]},{"url":"https://bugzilla.suse.com/986386","tags":["report"]},{"url":"https://bugzilla.suse.com/986388","tags":["report"]},{"url":"https://bugzilla.suse.com/986391","tags":["report"]},{"url":"https://bugzilla.suse.com/986392","tags":["report"]},{"url":"https://bugzilla.suse.com/986393","tags":["report"]},{"url":"https://bugzilla.suse.com/988486","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8935","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5385","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5766","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5767","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5768","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5769","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5770","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5771","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5772","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20162013-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20162080-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/991426","tags":["report"]},{"url":"https://bugzilla.suse.com/991427","tags":["report"]},{"url":"https://bugzilla.suse.com/991428","tags":["report"]},{"url":"https://bugzilla.suse.com/991429","tags":["report"]},{"url":"https://bugzilla.suse.com/991430","tags":["report"]},{"url":"https://bugzilla.suse.com/991433","tags":["report"]},{"url":"https://bugzilla.suse.com/991437","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5399","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6288","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6289","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6290","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6291","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6296","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6297","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2016-5772","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3045-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2015-4116","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-8873","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-8876","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-8935","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-5093","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-5094","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-5095","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-5096","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-5114","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-5385","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-5399","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-5768","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-5769","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-5771","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-5773","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-6288","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-6289","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-6290","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-6291","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-6292","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-6294","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-6295","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-6296","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-6297","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2016-5772","description":"Double free vulnerability in the php_wddx_process_data function in wddx.c in the WDDX extension in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted XML data that is mishandled in a wddx_deserialize call.","status":"published","published":"2016-08-07T10:00:00Z","modified":"2024-08-06T01:15:09.073Z","updated_at":"2026-11-02T14:33:31.117878Z"}],"euvd":[{"id":"EUVD-2016-6707","description":"Double free vulnerability in the php_wddx_process_data function in wddx.c in the WDDX extension in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted XML data that is mishandled in a wddx_deserialize call.","status":"published","published":"2016-08-07T10:00:00Z","modified":"2024-08-06T01:15:09Z","updated_at":"2026-11-03T02:22:42.006781Z"}],"ghsa":[{"id":"GHSA-v2qq-h2h4-pjqv","title":"Double free vulnerability in the php_wddx_process_data function in wddx.c in the WDDX extension...","description":"Double free vulnerability in the php_wddx_process_data function in wddx.c in the WDDX extension in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted XML data that is mishandled in a wddx_deserialize call.","status":"published","published":"2022-05-14T03:56:18Z","modified":"2023-01-27T05:02:22Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-415"],"updated_at":"2026-11-02T14:42:03.063922Z"}],"nvd":[{"id":"CVE-2016-5772","description":"Double free vulnerability in the php_wddx_process_data function in wddx.c in the WDDX extension in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted XML data that is mishandled in a wddx_deserialize call.","status":"published","published":"2016-08-07T10:59:20.68Z","modified":"2026-06-17T00:50:01.523Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-415"],"updated_at":"2026-11-02T14:03:28.854267Z"}],"osv":[{"id":"CVE-2016-5772","description":"Double free vulnerability in the php_wddx_process_data function in wddx.c in the WDDX extension in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted XML data that is mishandled in a wddx_deserialize call.","status":"published","published":"2016-08-07T10:59:20.68Z","modified":"2026-10-24T14:05:46.383970537Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:02.776224Z"},{"id":"RHSA-2016:2750","title":"Red Hat Security Advisory: rh-php56 security, bug fix, and enhancement update","status":"published","published":"2024-09-13T14:38:00Z","modified":"2026-08-05T10:04:10Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:03.734507Z"},{"id":"UBUNTU-CVE-2016-5772","description":"Double free vulnerability in the php_wddx_process_data function in wddx.c in the WDDX extension in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted XML data that is mishandled in a wddx_deserialize call.","status":"published","published":"2016-06-24T00:00:00Z","modified":"2026-04-22T10:52:54.792809Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:12.642042Z"},{"id":"CLSA-2020-1605798462","title":"Fix of 227 CVE","description":"- Fix bug #69720: Null pointer dereference in phar_get_fp_offset()\n- Fix bug #70728: Type Confusion Vulnerability in PHP_to_XMLRPC_worker()\n- Fix bug #70661: Use After Free Vulnerability in WDDX Packet Deserialization\n- Fix bug #70741: Session WDDX Packet Deserialization Type Confusion Vulnerability\n- Fix bug #71459: Integer overflow in iptcembed()\n- Fix bug #71039: exec functions ignore length but look for NULL termination\n- Fix bug #71354: Heap corruption in tar/zip/phar parser.\n- Fix bug #71391: NULL Pointer Dereference in phar_tar_setupmetadata()\n- Fix bug #71323: Output of stream_get_meta_data can be falsified by its input\n- Fix bug #71498: Out-of-Bound Read in phar_parse_zipfile()\n- Fix bug #71587: Use-After-Free / Double-Free in WDDX Deserialize\n- Fix bug #71860: Invalid memory write in phar on filename with \\0 in name\n- Fix bug #71798: Integer Overflow in php_raw_url_encode\n- Fix bug #72837: integer overflow in bzdecompress caused heap corruption\n- Fix bug #72681: PHP Session Data Injection Vulnerability\n- Fix bug #72807: integer overflow in curl_escape caused heap corruption\n- Fix bug #72838: Integer overflow lead to heap corruption in sql_regcase\n- Fix bug #72697: select_colors write out-of-bounds\n- Fix bug #72730: imagegammacorrect allows arbitrary write access\n- Fix bug #72836: integer overflow in base64_decode caused heap corruption\n- Fix bug #72848: integer overflow in quoted_printable_encode caused heap corruption\n- Fix bug #72849: integer overflow in urlencode caused heap corruption\n- Fix bug #72850: integer overflow in php_uuencode caused heap corruption\n- Fix bug #72771: ftps:// wrapper is vulnerable to protocol downgrade attack\n- Fix bug #72749: wddx_deserialize allows illegal memory access\n- Fix bug #72750: wddx_deserialize null dereference\n- Fix bug #72790: wddx_deserialize null dereference with invalid xml\n- Fix bug #72799: wddx_deserialize null dereference in php_wddx_pop_element\n- Fix bug #73189: Memcpy negative size parameter php_resolve_path\n- Fix bug #73150: missing NULL check in dom_document_save_html\n- Fix bug #73284: heap overflow in php_ereg_replace function\n- Fix bug #73218: stack-buffer-overflow through \u0026quot;ResourceBundle\u0026quot; methods\n- Fix bug #73208: integer overflow in imap_8bit caused heap corruption\n- Fix bug #73082: string length overflow in mb_encode_* function\n- Fix bug #73174: heap overflow in php_pcre_replace_impl\n- Fix bug #73276: crash in openssl_random_pseudo_bytes function\n- Fix bug #73275: crash in openssl_encrypt function\n- Fix bug #73017: memory corruption in wordwrap function\n- Fix bug #73240: Write out of bounds at number_format\n- Fix bug #73073: CachingIterator null dereference when convert to string\n- Fix bug #73293: NULL pointer dereference in SimpleXMLElement::asXML()\n- Fix bug #73356: crash in bzcompress function\n- Fix bug #72696: imagefilltoborder stackoverflow on truecolor images\n- Fix bug #73418: Integer Overflow in \u0026quot;_php_imap_mail\u0026quot; leads Heap Overflow\n- Fix bug #73144: Use-after-free in ArrayObject Deserialization\n- Fix bug #73192: parse_url return wrong hostname\n- Fix bug #73331: NULL Pointer Dereference in WDDX Packet Deserialization with PDORow\n- Fix bug #73452: Segfault (Regression for #69152)\n- Fix bug #73631: Invalid read when wddx decodes empty boolean element\n- Fix bug #67587: Redirection loop on nginx with FPM\n- Fix bug #71465: PHAR doesn't know about litespeed\n- Fix bug #73737: FPE when parsing a tag format\n- Fix bug #73868: Fix DOS vulnerability in gdImageCreateFromGd2Ctx()\n- Fix bug #73869: Signed Integer Overflow gd_io.c\n- Fix bug #73773: Seg fault when loading hostile phar\n- Fix bug #70436: Use After Free Vulnerability in unserialize()\n- Fix bug #74603: PHP INI Parsing Stack Buffer Overflow Vulnerability\n- Fix bug #72535: arcfour encryption stream filter crashes php\n- Fix bug #72434: ZipArchive class Use After Free Vulnerability in PHP's\n  GC algorithm and unseria\n- Fix bug #72455: Heap Overflow due to integer overflows\n- Fix bug #74782: Reflected XSS in .phar 404 page\n- Fix bug #71335: Type Confusion in WDDX Packet Deserialization\n- Fix bug #76130: Heap Buffer Overflow (READ: 1786) in exif_iif_add_value\n- Fix bug #76249: stream filter convert.iconv leads to infinite loop on\n  invalid sequence\n- Fix bug #76248: Malicious LDAP-Server Response causes Crash\n- Fix bug #76129: fix for CVE-2018-5712 may not be complete\n- Fix bug #75981: stack-buffer-overflow while parsing HTTP response\n- Fix bug #74385: Locale::parseLocale() broken with some arguments\n- Fix bug #76335: \u0026quot;link(): Bad file descriptor\u0026quot; with non-ASCII path\n- Fix bug #76383: array_map on $GLOBALS returns IS_INDIRECT\n- Fix bug #73342: Vulnerability in php-fpm by changing stdin to non-blocking\n- Fix bug #76505: array_merge_recursive() is duplicating sub-array keys\n- Fix bug #76532: Integer overflow and excessive memory usage in mb_strimwidth\n- Fix bug #76548: pg_fetch_result did not fetch the next row\n- Fix bug #76488: Memory leak when fetching a BLOB field\n- Fix bug #76665: SQLite3Stmt::bindValue() with SQLITE3_FLOAT doesn't juggle\n- Fix bug #75402: Possible Memory Leak using PDO::CURSOR_SCROLL option\n- Fix bug #76517: --with-gettext= causes configure to misjudges there is no getcwd\n- Fix bug #72443: Installing shared extensions: cp: cannot stat 'modules/*':\n  No such file or dire\n- Fix bug #68175: RegexIterator pregFlags are NULL instead of 0\n- Fix bug #55146: iconv_mime_decode_headers() skips some headers\n- Fix bug #63839: iconv_mime_decode_headers function is skipping headers\n- Fix bug #60494: iconv_mime_decode does ignore special characters\n- Fix bug #68180: iconv_mime_decode can return extra characters in a header\n- Fix bug #73457: Wrong error message when fopen FTP wrapped fails to open\n  data connection\n- Fix bug #74454: Wrong exception being thrown when using ReflectionMethod\n- Fix bug #74764: Bindto IPv6 works with file_get_contents but fails with\n  stream_socket_client\n- Fix bug #75273: php_zlib_inflate_filter() may not update bytes_consumed\n- Fix bug #75696: posix_getgrnam fails to print details of group\n- Fix bug #76480: Use curl_multi_wait() so that timeouts are respected\n- Fix bug #76800: foreach inconsistent if array modified during loop\n- Fix bug #76886: Can't build xmlrpc with expat\n- Fix bug #76901: method_exists on SPL iterator passthrough method corrupts memory\n- Fix bug #77242: heap out of bounds read in xmlrpc_decode()\n- Fix bug #77247: heap buffer overflow in phar_detect_phar_fname_ext\n- Fix bug #77270: imagecolormatch Out Of Bounds Write on Heap\n- Fix bug #77370: Buffer overflow on mb regex functions - fetch_token\n- Fix bug #77380: Global out of bounds read in xmlrpc base64 code\n- Fix bug #77630: rename() across the device may allow unwanted access\n  during processing\n- Fix bug #77494: Disabling class causes segfault on member access\n- Fix bug #77431: openFile() silently truncates after a null byte\n- Fix bug #51068: DirectoryIterator glob:// don't support current path\n  relative queries\n- Fix bug #77396: Null Pointer Dereference in phar_create_or_parse_filename\n- Fix bug #77540: Invalid Read on exif_process_SOFn\n- Fix bug #77390: feof might hang on TLS streams in case of fragmented TLS records\n- Fix bug #77586: phar_tar_writeheaders_int() buffer overflow\n- Fix bug #77546: iptcembed broken function\n- Fix bug #77563: Uninitialized read in exif_process_IFD_in_MAKERNOTE\n- Fix bug #76557: heap-buffer-overflow (READ of size 48) while reading exif data\n- Fix bug #77024: SplFileObject::__toString() may return array\n- Fix bug #77945: Segmentation fault when constructing SoapClient with WSDL_CACHE_BOTH\n- Fix bug #77697: Crash on Big_Endian platform\n- Fix bug #77943: imageantialias($image, false); does not work\n- Fix bug #77944: Wrong meta pdo_type for bigint on LLP64\n- Fix bug #76717: var_export() does not create a parsable value for PHP_INT_MIN\n- Fix bug #77921: static.php.net doesn't work anymore\n- Fix bug #77934: php-fpm kill -USR2 not working\n- Fix bug #77700: Writing truecolor images as GIF ignores interlace flag\n- Fix bug #77765: FTP stream wrapper should set the directory as executable\n- Fix bug #50020: DateInterval:createDateFromString() silently fails\n- Fix bug #77742: bcpow() implementation related to gcc compiler optimization\n- Fix bug #77967: Bypassing open_basedir restrictions via file uris\n- Fix bug #77973: Uninitialized read in gdImageCreateFromXbm\n- Fix bug #77988: heap-buffer-overflow on php_jpg_get16\n- Fix bug #78192: SegFault when reuse statement after schema has changed\n- Fix bug #77124: FTP with SSL memory leak\n- Fix bug #78256: heap-buffer-overflow on exif_process_user_comment\n- Fix bug #78222: heap-buffer-overflow on exif_scan_thumbnail\n- Fix bug #77946: Bad cURL resources returned by curl_multi_info_read()\n- Fix bug #78333: Exif crash (bus error) due to wrong alignment and invalid cast\n- Fix bug #69100: Bus error from stream_copy_to_stream (file -\u0026gt; SSL stream)\n  with invalid length\n- Fix bug #76342: file_get_contents waits twice specified timeout\n- Fix bug #76859: stream_get_line skips data if used with data-generating filter\n- Fix bug #78579: mb_decode_numericentity: args number inconsistency\n- Fix bug #78910: Heap-buffer-overflow READ in exif\n- Fix bug #78878: Buffer underflow in bc_shift_addsub\n- Fix bug #78793: Use-after-free in exif parsing under memory sanitizer\n- Fix bug #78863: DirectoryIterator class silently truncates after a null byte\n- Fix bug #79099: OOB read in php_strip_tags_ex\n- Fix bug #79082: Files added to tar with Phar::buildFromIterator have\n  all-access permissions\n- Fix bug #79329: get_headers() silently truncates after a null byte\n- Fix bug #79282: Use-of-uninitialized-value in exif\n- Fix bug #61597: SimpleXMLElement doesn't include both @attributes and\n  textContent in properties\n- Fix bug #74940: DateTimeZone loose comparison always true until properties\n  are initialized.\n- Fix bug #79296: ZipArchive::open fails on empty file (libzip 1.6.0)\n- Fix bug #79330: shell_exec() silently truncates after a null byte\n- Fix bug #79364: When copy empty array, next key is unspecified.\n- Fix bug #79396: DateTime hour incorrect during DST jump forward using setTime\n- Fix bug #79410: system() swallows last chunk if it is exactly 4095 bytes\n  without newline\n- Fix bug #79424: php_zip_glob uses gl_pathc after call to globfree\n- Fix bug #79465: OOB Read in urldecode() (CVE-2020-7067)\n- Fix bug #78221: DOMNode::normalize() doesn't remove empty text nodes\n- Fix bug #78875: Long filenames cause OOM and temp files are not cleaned\n  (CVE-2019-11048)\n- Fix bug #78876: Long variables in multipart/form-data cause OOM and temp\n  files are not cleaned (CVE-2019-11048)\n- Fix bug #79514: Memory leaks while including unexistent file\n- Fix bug #79528: Different object of the same xml between 7.4.5 and 7.4.4\n- Fix bug #62890: default_socket_timeout=-1 causes connection to timeout\n- Fix bug #70362: Can't copy() large 'data://' with open_basedir\n- Fix bug #73527: Invalid memory access in php_filter_strip\n- Fix bug #74267: segfault with streams and invalid data\n- Fix bug #79787: mb_strimwidth does not trim string\n- Fix bug #79877: getimagesize function silently truncates after a null byte\n- Fix bug #68447: grapheme_extract take an extra trailing character\n- Fix bug #68825: Inconsistent exception in DirectoryIterator::getLinkTarget()\n- Fix bug #74145: wddx parsing empty boolean tag leads to SIGSEGV (CVE-2017-11143)\n- Fix bug #74651: negative-size-param (-1) in memcpy in zif_openssl_seal()\n  (CVE-2017-11144)\n- Fix bug #74435: Buffer over-read into uninitialized memory (CVE-2017-7890)\n- Fix bug #73093: Unserialize Exception object can lead to infinite loop\n  (CVE-2016-7478)\n- Fix bug #72520: Stack-based buffer overflow vulnerability in php_stream_zip_opener\n  (CVE-2016-6297)\n- Fix bug #73825: Heap out of bounds read on unserialize in finish_nested_data()\n  (CVE-2016-10161)\n- Fix bug #60491: Session module is adoptive (CVE-2011-4718)\n- Fix bug #69253: ZIP Integer Overflow leads to writing past heap boundary\n  (CVE-2015-2331)\n- Fix bug #69418: CVE-2006-7243 fix regressions in 5.4+ (CVE-2015-4025)\n- Fix bug #68598: pcntl_exec() should not allow null char (CVE-2015-4026)\n- Fix bug #69207: move_uploaded_file allows nulls in path (CVE-2015-2348)\n- Fix bug #69218: potential remote code execution with apache 2.4 apache2handler\n  (CVE-2015-3330)\n- Fix bug #69719: Incorrect handling of paths with NULs, related to bug 69353\n  (CVE-2015-4598)\n- Fix bug #69353: Missing null byte checks for paths in various PHP extensions\n  (CVE-2015-3411)\n- Fix bugs #70168, #70169, #70166, #70155: Use After Free Vulnerability in\n  unserialize() with\n  SplObjectStorage, SplDoublyLinkedList, SPLArrayObject, SPLArrayObject (CVE-2015-6831)\n- Fix bug #70019: Files extracted from archive may be placed outside of\n  destination directory (CVE-2015-6833)\n- Fix bug #70388: SOAP serialize_function_call() type confusion / RCE (CVE-2015-6836)\n- Fix bug #69782: NULL pointer dereference (CVE-2015-6837, CVE-2015-6838)\n- Fix bug #70433: Uninitialized pointer in phar_make_dirstream when zip entry\n  filename is \"/\" (CVE-2015-7804)\n- Fix bug #69923: Buffer overflow and stack smashing error in phar_fix_filepath\n  (CVE-2015-5590)\n- Fix bug #71488: Stack overflow when decompressing tar archives (CVE-2016-2554)\n- Fix bug #72061: Out-of-bounds reads in zif_grapheme_stripos with negative offset\n  (CVE-2016-4541, CVE-2016-4540)\n- Fix bug #72094: Out of bounds heap read access in exif header processing\n  (CVE-2016-4542)\n- Fix bug #72093: bcpowmod accepts negative scale and corrupts _one_ definition\n  (CVE-2016-4537)\n- Fix bug #71331: Uninitialized pointer in phar_make_dirstream() (CVE-2016-4343)\n- Fix bug #72241: get_icu_value_internal out-of-bounds read (CVE-2016-5093)\n- Fix bug #72135: Integer Overflow in php_html_entities() (CVE-2016-5094)\n- Fix bug #72114: Integer underflow / arbitrary null write in fread/gzread\n  (CVE-2016-5096)\n- Fix bug #72339: Integer Overflow in _gd2GetHeader() resulting in heap overflow\n  (CVE-2016-5766)\n- Fix bug #72340: Double Free Courruption in wddx_deserialize (CVE-2016-5772)\n- Fix bug #72613: Inadequate error handling in bzread() (CVE-2016-5399)\n- Fix bug #70480: php_url_parse_ex() buffer overflow read (CVE-2016-6288)\n- Fix bug #72513: Stack-based buffer overflow vulnerability in virtual_file_ex\n  (CVE-2016-6289)\n- Fix bug #72562: Use After Free in unserialize() with Unexpected Session\n  Deserialization (CVE-2016-6290)\n- Fix bug #72603: Out of bound read in exif_process_IFD_in_MAKERNOTE (CVE-2016-6291)\n- Fix bug #72533: locale_accept_from_http out-of-bounds access (CVE-2016-6294)\n- Fix bug #69975: PHP segfaults when accessing nvarchar(max) defined columns\n  (CVE-2015-8879)\n- Fix bug #72606: heap-buffer-overflow (write) simplestring_addn simplestring.c\n  (CVE-2016-6296)\n- Fix bug #72293: Heap overflow in mysqlnd related to BIT fields (CVE-2016-7412)\n- Fix bug #72860: wddx_deserialize use-after-free (CVE-2016-7413)\n- Fix bug #72928: Out of bound when verify signature of zip phar in phar_parse_zipfile\n  (CVE-2016-7414)\n- Fix bug #73007: SEH buffer overflow msgfmt_format_message (CVE-2016-7416)\n- Fix bug #73029: Missing type check when unserializing SplArray (CVE-2016-7417)\n- Fix bug #73065: Out-Of-Bounds Read in php_wddx_push_element of wddx.c (CVE-2016-7418)\n- Fix bug #73280: Stack Buffer Overflow in GD dynamicGetbuf (CVE-2016-8670)\n- Fix bug #73764: Crash while loading hostile phar archive (CVE-2016-10159)\n- Fix bug #73768: Memory corruption when loading hostile phar (CVE-2016-10160)\n- Fix bug #72627: Memory Leakage In exif_process_IFD_in_TIFF (CVE-2016-7128)\n- Fix bug #70350: ZipArchive::extractTo allows for directory traversal when\n  creating directories (CVE-2014-9767)\n- Fix bug #70081: SoapClient info leak / null pointer dereference via multiple\n  type confusions (CVE-2015-8835)\n- Fix bug #70121: unserialize() could lead to unexpected methods execution / NULL\n  pointer deref (CVE-2015-8876)\n- Fix bug #71906: AddressSanitizer: negative-size-param (-1) in mbfl_strcut\n  (CVE-2016-4073)\n- Fix bug #70014: openssl_random_pseudo_bytes() is not cryptographically secure\n  (CVE-2015-8867)\n- Fix bug #77371: heap buffer overflow in mb regex functions - compile_string_node\n  (CVE-2019-9023)\n- Fix bug #77381: heap buffer overflow in multibyte match_at (CVE-2019-9023)\n- Fix bug #77382: heap buffer overflow due to incorrect length in expand_case_fold_string\n  (CVE-2019-9023)\n- Fix bug #77385: buffer overflow in fetch_token (CVE-2019-9023)\n- Fix bug #77394: Buffer overflow in multibyte case folding - unicode (CVE-2019-9023)\n- Fix vulnerabilities with oniguruma: CVE-2017-9226, CVE-2017-9224, CVE-2017-9227,\n  CVE-2017-9228, CVE-2019-13224\n- Fix general vulneravilities: CVE-2014-9653, CVE-2015-0235, CVE-2015-3152,\n  CVE-2016-3074\n- Fix bug #79699: PHP parses encoded cookie names so malicious `__Host-` cookies\n  can be sent (CVE-2020-7070)\n- Fix bug #80007: Potential type confusion in unixtojd() parameter parsing","status":"published","published":"2020-10-15T12:00:00Z","modified":"2026-10-21T10:47:12.66349831Z","updated_at":"2026-11-02T15:43:39.801198Z"},{"id":"DLA-628-1","title":"php5 - security update","status":"published","published":"2016-09-18T00:00:00Z","modified":"2026-03-09T02:09:10.764984Z","updated_at":"2026-11-02T15:46:13.207219Z"},{"id":"DSA-3618-1","title":"php5 - security update","status":"published","published":"2016-07-14T00:00:00Z","modified":"2026-03-09T02:08:42.459981Z","updated_at":"2026-11-02T15:46:16.199525Z"},{"id":"MGASA-2016-0238","title":"Updated php packages fix security vulnerability","description":"php-mbstring _php_mb_regex_ereg_replace_exec() - double free\n(CVE-2016-5768).\n\nphp-mcrypt heap Overflow due to integer overflows (CVE-2016-5769).\n\nphp-SPL int/size_t confusion in SplFileObject::fread (CVE-2016-5770).\n\nphp-SPL Use After Free Vulnerability in PHP's GC algorithm and unserialize\n(CVE-2016-5771).\n\nphp-WDDX Double Free Courruption in wddx_deserialize (CVE-2016-5772).\n\nphp-zip ZipArchive class Use After Free Vulnerability in PHP's GC\nalgorithm and unserialize (CVE-2016-5773).\n\nThe php package has been updated to version 5.6.23, fixing these issues\nand several other bugs.  See the upstream ChangeLog for details.\n","status":"published","published":"2016-07-05T15:47:08Z","modified":"2026-04-16T06:23:22.018004577Z","updated_at":"2026-11-02T15:49:40.103088Z"},{"id":"SUSE-SU-2016:1842-1","title":"Security update for php5","description":"This update for php5 fixes the following issues:\n\n* It is possible to launch a web server with 'php -S localhost:8080'\n  It used to be possible to set an arbitrary $HTTP_PROXY environment variable\n  for request handlers -- like CGI scripts -- by including a specially crafted\n  HTTP header in the request (CVE-2016-5385). As a result, these server\n  components would potentially direct all their outgoing HTTP traffic through a\n  malicious proxy server. This patch fixes the issue: the updated php server\n  ignores such HTTP headers and never sets $HTTP_PROXY for sub-processes.\n  (bnc#988486)\n* There was multiple cases where a remote attacker could trigger a double free\n  and, given specific PHP code using callbacks, trigger code execution vectors.\n  (bnc#986246,bnc#986244,CVE-2016-5768,CVE-2016-5772)\n* It was possible to inject header or content information (XSS) when a user was \n  using internet explorer as the browser. (bnc#986004, CVE-2015-8935)\n* In several cases it was possible for a integer overflow to trigger an \n  excessive memory allocation (bnc#986392, bnc#986388, bnc#986386, bnc#986393, \n  CVE-2016-5770, CVE-2016-5769, CVE-2016-5766, CVE-2016-5767)\n* It was possible for an attacker to abuse the garbage collector to free a \n  target array. At this point an attacker could craft a fake zval object and \n  exploit the PHP process by taking over the EIP/RIP. (bnc#986391,\n  CVE-2016-5771)","status":"published","published":"2016-07-20T18:56:58Z","modified":"2026-02-04T03:51:33.684715Z","updated_at":"2026-11-02T15:53:43.438985Z"},{"id":"SUSE-SU-2016:2013-1","title":"Security update for php53","description":"php53 was updated to fix five security issues.\n\nThese security issues were fixed:\n- CVE-2016-5769: mcrypt: Heap Overflow due to integer overflows (bsc#986388).\n- CVE-2015-8935: XSS in header() with Internet Explorer (bsc#986004).\n- CVE-2016-5772: Double Free Courruption in wddx_deserialize (bsc#986244).\n- CVE-2016-5766: Integer Overflow in _gd2GetHeader() resulting in heap overflow (bsc#986386).\n- CVE-2016-5767: Integer Overflow in gdImagePaletteToTrueColor() resulting in heap overflow (bsc#986393).\n","status":"published","published":"2016-08-09T11:35:10Z","modified":"2025-05-02T04:04:53.983487Z","updated_at":"2026-11-02T15:53:43.438985Z"},{"id":"SUSE-SU-2016:2080-1","title":"Security update for php5","description":"\nphp5 was updated to fix the following security issues:\n\n- CVE-2016-6297: Stack-based buffer overflow vulnerability in php_stream_zip_opener (bsc#991426).\n- CVE-2016-6291: Out-of-bounds access in exif_process_IFD_in_MAKERNOTE (bsc#991427).\n- CVE-2016-6289: Integer overflow leads to buffer overflow in virtual_file_ex (bsc#991428).\n- CVE-2016-6290: Use after free in unserialize() with Unexpected Session Deserialization (bsc#991429).\n- CVE-2016-5399: Improper error handling in bzread() (bsc#991430).\n- CVE-2016-6288: Buffer over-read in php_url_parse_ex (bsc#991433).\n- CVE-2016-6296: Heap buffer overflow vulnerability in simplestring_addn in simplestring.c (bsc#991437).\n- CVE-2016-5769: Mcrypt: Heap Overflow due to integer overflows (bsc#986388).\n- CVE-2015-8935: XSS in header() with Internet Explorer (bsc#986004).\n- CVE-2016-5772: Double free corruption in wddx_deserialize (bsc#986244).\n- CVE-2016-5766: Integer Overflow in _gd2GetHeader() resulting in heap overflow (bsc#986386).\n- CVE-2016-5767: Integer Overflow in gdImagePaletteToTrueColor() resulting in heap overflow (bsc#986393).\n","status":"published","published":"2016-08-16T07:26:11Z","modified":"2025-05-02T04:04:54.047151Z","updated_at":"2026-11-02T15:53:43.438985Z"},{"id":"USN-3045-1","title":"php5, php7.0 vulnerabilities","description":"It was discovered that PHP incorrectly handled certain SplMinHeap::compare\noperations. A remote attacker could use this issue to cause PHP to crash,\nresulting in a denial of service, or possibly execute arbitrary code. This\nissue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2015-4116)\n\nIt was discovered that PHP incorrectly handled recursive method calls. A\nremote attacker could use this issue to cause PHP to crash, resulting in a\ndenial of service. This issue only affected Ubuntu 12.04 LTS and Ubuntu\n14.04 LTS. (CVE-2015-8873)\n\nIt was discovered that PHP incorrectly validated certain Exception objects\nwhen unserializing data. A remote attacker could use this issue to cause\nPHP to crash, resulting in a denial of service, or possibly execute\narbitrary code. This issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04\nLTS. (CVE-2015-8876)\n\nIt was discovered that PHP header() function performed insufficient\nfiltering for Internet Explorer. A remote attacker could possibly use this\nissue to perform a XSS attack. This issue only affected Ubuntu 12.04 LTS\nand Ubuntu 14.04 LTS. (CVE-2015-8935)\n\nIt was discovered that PHP incorrectly handled certain locale operations.\nAn attacker could use this issue to cause PHP to crash, resulting in a\ndenial of service. This issue only affected Ubuntu 12.04 LTS and Ubuntu\n14.04 LTS. (CVE-2016-5093)\n\nIt was discovered that the PHP php_html_entities() function incorrectly\nhandled certain string lengths. A remote attacker could use this issue to\ncause PHP to crash, resulting in a denial of service, or possibly execute\narbitrary code. This issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04\nLTS. (CVE-2016-5094, CVE-2016-5095)\n\nIt was discovered that the PHP fread() function incorrectly handled certain\nlengths. An attacker could use this issue to cause PHP to crash, resulting\nin a denial of service, or possibly execute arbitrary code. This issue only\naffected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2016-5096)\n\nIt was discovered that the PHP FastCGI Process Manager (FPM) SAPI\nincorrectly handled memory in the access logging feature. An attacker could\nuse this issue to cause PHP to crash, resulting in a denial of service, or\npossibly expose sensitive information. This issue only affected Ubuntu\n12.04 LTS and Ubuntu 14.04 LTS. (CVE-2016-5114)\n\nIt was discovered that PHP would not protect applications from contents of\nthe HTTP_PROXY environment variable when based on the contents of the Proxy\nheader from HTTP requests. A remote attacker could possibly use this issue\nin combination with scripts that honour the HTTP_PROXY variable to redirect\noutgoing HTTP requests. (CVE-2016-5385)\n\nHans Jerry Illikainen discovered that the PHP bzread() function incorrectly\nperformed error handling. A remote attacker could use this issue to cause\nPHP to crash, resulting in a denial of service, or possibly execute\narbitrary code. (CVE-2016-5399)\n\nIt was discovered that certain PHP multibyte string functions incorrectly\nhandled memory. A remote attacker could use this issue to cause PHP to\ncrash, resulting in a denial of service, or possibly execute arbitrary\ncode. This issue only affected Ubuntu 14.04 LTS. (CVE-2016-5768)\n\nIt was discovered that the PHP Mcrypt extension incorrectly handled memory.\nA remote attacker could use this issue to cause PHP to crash, resulting in\na denial of service, or possibly execute arbitrary code. This issue only\naffected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2016-5769)\n\nIt was discovered that the PHP garbage collector incorrectly handled\ncertain objects when unserializing malicious data. A remote attacker could\nuse this issue to cause PHP to crash, resulting in a denial of service, or\npossibly execute arbitrary code. This issue was only addressed in Ubuntu\nUbuntu 14.04 LTS. (CVE-2016-5771, CVE-2016-5773)\n\nIt was discovered that PHP incorrectly handled memory when unserializing\nmalicious xml data. A remote attacker could use this issue to cause PHP to\ncrash, resulting in a denial of service, or possibly execute arbitrary\ncode. This issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS.\n(CVE-2016-5772)\n\nIt was discovered that the PHP php_url_parse_ex() function incorrectly\nhandled string termination. A remote attacker could use this issue to cause\nPHP to crash, resulting in a denial of service, or possibly execute\narbitrary code. This issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04\nLTS. (CVE-2016-6288)\n\nIt was discovered that PHP incorrectly handled path lengths when extracting\ncertain Zip archives. A remote attacker could use this issue to cause PHP\nto crash, resulting in a denial of service, or possibly execute arbitrary\ncode. (CVE-2016-6289)\n\nIt was discovered that PHP incorrectly handled session deserialization. A\nremote attacker could use this issue to cause PHP to crash, resulting in a\ndenial of service, or possibly execute arbitrary code. (CVE-2016-6290)\n\nIt was discovered that PHP incorrectly handled exif headers when processing\ncertain JPEG images. A remote attacker could use this issue to cause PHP to\ncrash, resulting in a denial of service, or possibly execute arbitrary\ncode. (CVE-2016-6291, CVE-2016-6292)\n\nIt was discovered that PHP incorrectly handled certain locale operations. A\nremote attacker could use this issue to cause PHP to crash, resulting in a\ndenial of service, or possibly execute arbitrary code. (CVE-2016-6294)\n\nIt was discovered that the PHP garbage collector incorrectly handled\ncertain objects when unserializing SNMP data. A remote attacker could use\nthis issue to cause PHP to crash, resulting in a denial of service, or\npossibly execute arbitrary code. This issue only affected Ubuntu 14.04 LTS\nand Ubuntu 16.04 LTS. (CVE-2016-6295)\n\nIt was discovered that the PHP xmlrpc_encode_request() function incorrectly\nhandled certain lengths. An attacker could use this issue to cause PHP to\ncrash, resulting in a denial of service, or possibly execute arbitrary\ncode. (CVE-2016-6296)\n\nIt was discovered that the PHP php_stream_zip_opener() function incorrectly\nhandled memory. An attacker could use this issue to cause PHP to crash,\nresulting in a denial of service, or possibly execute arbitrary code.\n(CVE-2016-6297)\n","status":"published","published":"2016-08-02T15:44:36Z","modified":"2026-04-27T15:17:29.053921439Z","updated_at":"2026-11-02T16:58:10.303275Z"}]}}