CVE-2016-5770

Vulnerability

Integer overflow vulnerability in the SplFileObject::fread function in spl_directory.c of the SPL extension in PHP. Affects PHP versions before 5.5.37 and 5.6.x before 5.6.23 [2]. The issue occurs when a large integer argument is passed to fread, leading to an integer overflow. This is related to CVE-2016-5096.

Exploitation

An attacker can exploit this remotely by providing a crafted large integer value to the fread method of a SplFileObject instance. No authentication is required; the attacker only needs to trigger the vulnerable code path, for example through a web application that accepts user input for file reading operations.

Impact

Successful exploitation can cause a denial of service (crash) or potentially lead to other unspecified impacts, such as memory corruption or arbitrary code execution, depending on the environment. The exact impact is not fully detailed in available references.

Mitigation

Upgrade to PHP 5.5.37, 5.6.23, or later. Red Hat Software Collections provided an update to rh-php56 5.6.25 in RHSA-2016:2750 [1]. No workaround is documented; applying the patch is recommended.