Improper input validation in PHP - CVE-2016-10712

Vulnerability identifier: #VU10948

CSH Severity: Low

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2016-10712

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote unauthenticated attacker to obtain potentially sensitive information on the target system.

The weakness exists in the stream_get_meta_data function due to improper input validation. A remote attacker can send a specially crafted file and control metadata.

PHP
php5 (Ubuntu package)
php7.0 (Ubuntu package)
php7.1 (Ubuntu package)
SUSE Linux

Update to versions 5.5.32 or later, 5.6.18 or later and 7.0.3 or later.

php5 (Ubuntu package) - update to 5.5.9+dfsg-1ubuntu4.24
php7.0 (Ubuntu package) - update to 7.0.28-0ubuntu0.16.04.1
php7.1 (Ubuntu package) - update to 7.1.15-0ubuntu0.17.10.1

• https://bugs.php.net/bug.php?id=71323

• Information disclosure in PHP
• OpenSUSE Linux update for php5
• SUSE Linux update for php5
• SUSE Linux update for php53
• Ubuntu update for PHP