{"id":"CVE-2016-1904","details":"Multiple integer overflows in ext/standard/exec.c in PHP 7.x before 7.0.2 allow remote attackers to cause a denial of service or possibly have unspecified other impact via a long string to the (1) php_escape_shell_cmd or (2) php_escape_shell_arg function, leading to a heap-based buffer overflow.","modified":"2026-08-07T14:48:16.955299Z","published":"2016-01-19T05:59:09.373Z","references":[{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2016/01/14/8"},{"type":"WEB","url":"http://www.securitytracker.com/id/1034608"},{"type":"ADVISORY","url":"http://www.php.net/ChangeLog-7.php"},{"type":"FIX","url":"https://github.com/php/php-src/commit/2871c70efaaaa0f102557a17c727fd4d5204dd4b"},{"type":"EVIDENCE","url":"https://bugs.php.net/bug.php?id=71270"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/php/php-src","events":[{"introduced":"60fffd296abce5fc071f3c173c25a2696cf683c6"},{"last_affected":"4054ec69da7631046f19d54ab06f09728a208b8b"},{"fixed":"2871c70efaaaa0f102557a17c727fd4d5204dd4b"}],"database_specific":{"cpe":["cpe:2.3:a:php:php:7.0.0:*:*:*:*:*:*:*","cpe:2.3:a:php:php:7.0.1:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"7.0.0"},{"last_affected":"7.0.0"},{"introduced":"7.0.1"},{"last_affected":"7.0.1"}],"source":["CPE_STRING","REFERENCES"]}}],"versions":["7.0.0","7.0.1"],"database_specific":{"vanir_signatures":[{"target":{"file":"ext/standard/exec.c","function":"php_escape_shell_cmd"},"deprecated":false,"digest":{"function_hash":"226189531185488838476725418751739334044","length":1400},"id":"CVE-2016-1904-ab212364","signature_type":"Function","signature_version":"v1","source":"https://github.com/php/php-src/commit/2871c70efaaaa0f102557a17c727fd4d5204dd4b"},{"signature_version":"v1","source":"https://github.com/php/php-src/commit/2871c70efaaaa0f102557a17c727fd4d5204dd4b","target":{"file":"ext/standard/exec.c"},"deprecated":false,"digest":{"line_hashes":["117659872304452985398727624562538687260","320556668755691563286244707536482766367","11794313782276392130508157765939661100","228617998571887586856532336695393756614","142460229576488875644992908042681967756","244165684301463545340692676494172903712","32489114690226811644780649320839838199","88025627161522347905451764707748517810"],"threshold":0.9},"id":"CVE-2016-1904-b1127e15","signature_type":"Line"},{"id":"CVE-2016-1904-f650a616","signature_type":"Function","signature_version":"v1","source":"https://github.com/php/php-src/commit/2871c70efaaaa0f102557a17c727fd4d5204dd4b","target":{"file":"ext/standard/exec.c","function":"php_escape_shell_arg"},"deprecated":false,"digest":{"function_hash":"218805386897322723145400729357493747163","length":1318}}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-1904.json","vanir_signatures_modified":"2026-08-07T14:48:16Z"}}],"schema_version":"1.8.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"}]}