Bug 1298839 – CVE-2016-1904 php: heap buffer overflow in escapeshell functions

Bugzilla will be upgraded to version 5.0 on a still to be determined date in the near future. The original upgrade date has been delayed.

Bug 1298839 - (CVE-2016-1904) CVE-2016-1904 php: heap buffer overflow in escapeshell functions

Summary:	CVE-2016-1904 php: heap buffer overflow in escapeshell functions

Status:	CLOSED NOTABUG

Aliases:	CVE-2016-1904

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	All Linux

Priority	medium Severity medium
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:
Whiteboard:	impact=moderate,public=20160114,repor...
Keywords:	Security

Depends On:	1298843
Blocks:	1298833
	Show dependency tree / graph

Reported:	2016-01-15 04:07 EST by Andrej Nemec
Modified:	2016-01-22 15:21 EST (History)
CC List:	14 users (show)

See Also:
Fixed In Version:
Doc Type:	Bug Fix
Doc Text:
Story Points:	---
Clone Of:
Environment:
Last Closed:	2016-01-22 15:21:16 EST
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

External Trackers
Tracker	ID	Priority	Status	Summary	Last Updated
PHP Bug Tracker	71270	None	None	None	2016-01-22 15:10 EST

Groups: None (edit)

Description Andrej Nemec 2016-01-15 04:07:46 EST

There exist a heap-based buffer overflow that allows one to write a user
tainted data past an allocated buffer. This vulnerability lies in the
following functions:

escapeshellarg
escapeshellcmd

On a default php installation, the memory limit is set to 128MB and this
vulnerability is not triggerable. The analysis shows that this is
triggerable when memory limit is roughly > 1024mb.

Upstream bug:

https://bugs.php.net/bug.php?id=71270

Original report with reproducer:

http://seclists.org/oss-sec/2016/q1/98

CVE assignment:

http://seclists.org/oss-sec/2016/q1/100

Patch:

https://github.com/php/php-src/commit/2871c70efaaaa0f102557a17c727fd4d5204dd4b

Comment 1 Andrej Nemec 2016-01-15 04:09:00 EST

Created php tracking bugs for this issue:

Affects: fedora-all [bug 1298843]

Comment 2 Remi Collet 2016-01-15 04:20:10 EST

This patch affects PHP 7, so none of the available PHP version in RHEL or RHSCL is affected.

Comment 3 Tomas Hoger 2016-01-22 15:21:16 EST

Apparently introduced in:

https://github.com/php/php-src/commit/70ddc853fd4757004ac488e6ee892897bb6f395a

As noted in comment 2, this did not affect any PHP version as shipped in Red Hat Enterprise Linux and Red Hat Software Collections.

Note You need to log in before you can comment on or make changes to this bug.