The _php_mb_regex_ereg_replace_exec when called by mb_ereg_replace_callback frees the description twice in case when callback execution failed (i.e. threw an exception). Upstream bug: https://bugs.php.net/bug.php?id=72402 Upstream patch: http://git.php.net/?p=php-src.git;a=commitdiff;h=5b597a2e5b28e2d5a52fc1be13f425f08f47cb62 CVE assignment: http://seclists.org/oss-sec/2016/q2/589
Created php tracking bugs for this issue: Affects: fedora-all [bug 1351180]
php-5.6.23-1.fc24 has been pushed to the Fedora 24 stable repository. If problems still persist, please make note of it in this bug report.
php-5.6.23-1.fc22 has been pushed to the Fedora 22 stable repository. If problems still persist, please make note of it in this bug report.
php-5.6.23-1.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report.
Analysis: mb_ereg_replace_callback() is used to perform a regex search, the matched text is them replaced by output of the callback function. Script authors need to provide the callback function as the input to the function. In case the callback execution fails, (Most likely when the script author did not provide a proper callback), then a double-free takes places, causing php application crash.
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2016:2598 https://rhn.redhat.com/errata/RHSA-2016-2598.html
This issue has been addressed in the following products: Red Hat Software Collections for Red Hat Enterprise Linux 6 Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7 Red Hat Software Collections for Red Hat Enterprise Linux 7.2 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.3 EUS Via RHSA-2016:2750 https://rhn.redhat.com/errata/RHSA-2016-2750.html