There exist a heap-based buffer overflow that allows one to write a user tainted data past an allocated buffer. This vulnerability lies in the following functions: escapeshellarg escapeshellcmd On a default php installation, the memory limit is set to 128MB and this vulnerability is not triggerable. The analysis shows that this is triggerable when memory limit is roughly > 1024mb. Upstream bug: https://bugs.php.net/bug.php?id=71270 Original report with reproducer: http://seclists.org/oss-sec/2016/q1/98 CVE assignment: http://seclists.org/oss-sec/2016/q1/100 Patch: https://github.com/php/php-src/commit/2871c70efaaaa0f102557a17c727fd4d5204dd4b
Created php tracking bugs for this issue: Affects: fedora-all [bug 1298843]
This patch affects PHP 7, so none of the available PHP version in RHEL or RHSCL is affected.
Apparently introduced in: https://github.com/php/php-src/commit/70ddc853fd4757004ac488e6ee892897bb6f395a As noted in comment 2, this did not affect any PHP version as shipped in Red Hat Enterprise Linux and Red Hat Software Collections.