9.8
CVSSv3

CVE-2016-4071

Published: 20/05/2016 Updated: 07/11/2023
CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10
CVSS v3 Base Score: 9.8 | Impact Score: 5.9 | Exploitability Score: 3.9
VMScore: 755
Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

Vulnerability Summary

Format string vulnerability in the php_snmp_error function in ext/snmp/snmp.c in PHP prior to 5.5.34, 5.6.x prior to 5.6.20, and 7.x prior to 7.0.5 allows remote malicious users to execute arbitrary code via format string specifiers in an SNMP::get call.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

php php 5.6.1

php php 5.6.0

php php 5.6.5

php php 5.6.12

php php 5.6.13

php php 5.6.4

php php 5.6.6

php php 5.6.18

php php 5.6.11

php php 5.6.2

php php 5.6.10

php php 5.6.7

php php 5.6.15

php php 5.6.17

php php 5.6.16

php php 5.6.9

php php 5.6.3

php php 5.6.8

php php 5.6.14

php php 5.6.19

apple mac os x

php php 5.5.0

php php 5.5.19

php php 5.5.25

php php 5.5.16

php php 5.5.1

php php 5.5.31

php php 5.5.5

php php 5.5.21

php php 5.5.17

php php 5.5.14

php php 5.5.7

php php 5.5.29

php php 5.5.12

php php 5.5.6

php php 5.5.3

php php 5.5.23

php php 5.5.8

php php 5.5.27

php php 5.5.24

php php 5.5.15

php php 5.5.11

php php 5.5.13

php php 5.5.4

php php 5.5.33

php php 5.5.26

php php 5.5.10

php php 5.5.30

php php 5.5.22

php php 5.5.32

php php 5.5.18

php php 5.5.20

php php 5.5.2

php php 5.5.9

php php 7.0.4

php php 7.0.3

php php 7.0.1

php php 7.0.2

php php 7.0.0

Vendor Advisories

Synopsis Moderate: rh-php56 security, bug fix, and enhancement update Type/Severity Security Advisory: Moderate Topic An update for rh-php56, rh-php56-php, and rh-php56-php-pear is now available for Red Hat Software CollectionsRed Hat Product Security has rated this update as having a security impact of Mo ...
Several security issues were fixed in PHP ...
Several vulnerabilities were found in PHP, a general-purpose scripting language commonly used for web application development The vulnerabilities are addressed by upgrading PHP to the new upstream version 5620, which includes additional bug fixes Please refer to the upstream changelog for more information: phpnet/ChangeLog-5php#562 ...
The following security-related issues were resolved: Buffer over-write in finfo_open with malformed magic file (CVE-2015-8865)Signedness vulnerability causing heap overflow in libgd (CVE-2016-3074)Integer overflow in php_raw_url_encode (CVE-2016-4070)Format string vulnerability in php_snmp_error() (CVE-2016-4071)Invalid memory write in phar on file ...

Exploits

<?php // PHP <= 704/5533 SNMP format string exploit (32bit) // By Andrew Kramer <andrew at jmpesp dot org> // Should bypass ASLR/NX just fine // This exploit utilizes PHP's internal "%Z" (zval) // format specifier in order to achieve code-execution // We fake an object-type zval in memory and then bounce // through it carefully ...