# CVEs published 2016-07-25 10 CVEs were published on July 25, 2016: 0 critical, 0 high. Days are UTC. - [CVE-2016-6288](https://cve.now/CVE-2016-6288.md): The php\_url\_parse\_ex function in ext/standard/url.c in PHP before 5.5.38 allows remote attackers to cause a denial of service (buffer over-r (no CVSS) - [CVE-2016-6289](https://cve.now/CVE-2016-6289.md): Integer overflow in the virtual\_file\_ex function in TSRM/tsrm\_virtual\_cwd.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 (no CVSS) - [CVE-2016-6290](https://cve.now/CVE-2016-6290.md): ext/session/session.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 does not properly maintain a certain hash data structu (no CVSS) - [CVE-2016-6291](https://cve.now/CVE-2016-6291.md): The exif\_process\_IFD\_in\_MAKERNOTE function in ext/exif/exif.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 allows remote (no CVSS) - [CVE-2016-6292](https://cve.now/CVE-2016-6292.md): The exif\_process\_user\_comment function in ext/exif/exif.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 allows remote atta (no CVSS) - [CVE-2016-6293](https://cve.now/CVE-2016-6293.md): The uloc\_acceptLanguageFromHTTP function in common/uloc.cpp in International Components for Unicode (ICU) through 57.1 for C/C++ does not en (no CVSS) - [CVE-2016-6294](https://cve.now/CVE-2016-6294.md): The locale\_accept\_from\_http function in ext/intl/locale/locale\_methods.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 doe (no CVSS) - [CVE-2016-6295](https://cve.now/CVE-2016-6295.md): ext/snmp/snmp.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 improperly interacts with the unserialize implementation and (no CVSS) - [CVE-2016-6296](https://cve.now/CVE-2016-6296.md): Integer signedness error in the simplestring\_addn function in simplestring.c in xmlrpc-epi through 0.54.2, as used in PHP before 5.5.38, 5.6 (no CVSS) - [CVE-2016-6297](https://cve.now/CVE-2016-6297.md): Integer overflow in the php\_stream\_zip\_opener function in ext/zip/zip\_stream.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0 (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2016-07-25 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.