Servers and applications
CVE-2016-4071 Format string vulnerability in the php_snmp_error function in ext/snmp/snmp.c in PHP before 5.5.34, 5.6.x before 5.6.20, and 7.x before 7.0.5 allows remote attackers to execute arbitrary code via format string specifiers in an SNMP::get call.
Severity Critical 9.8
Published 20 May 2016
Last changed 17 Jun 2026
Added to UpHeron 14 Oct 2026
Sources NVD Affected software Software Affected versions PHPServers and applications · cpe:a:php:php Version 7.0.4 Version 7.0.3 Version 7.0.2 Version 7.0.1 All 78 release lines Version 5.5.0-alpha1 Version 5.5.0-alpha2 Version 5.5.0-alpha3 Version 5.5.0-alpha4 Version 5.5.0-alpha5 Version 5.5.0-alpha6 Version 5.5.0-beta1 Version 5.5.0-beta2 Version 5.5.0-beta3 Version 5.5.0-beta4 Version 5.5.0-rc1 Version 5.5.0-rc2 Version 5.5.0 Version 5.5.1 Version 5.5.2 Version 5.5.3 Version 5.5.4 Version 5.5.5 Version 5.5.6 Version 5.5.7 Version 5.5.8 Version 5.5.9 Version 5.5.10 Version 5.5.11 Version 5.5.12 Version 5.5.13 Version 5.5.14 Version 5.5.15 Version 5.5.16 Version 5.5.17 Version 5.5.18 Version 5.5.19 Version 5.5.20 Version 5.5.21 Version 5.5.22 Version 5.5.23 Version 5.5.24 Version 5.5.25 Version 5.5.26 Version 5.5.27 Version 5.5.29 Version 5.5.30 Version 5.5.31 Version 5.5.32 Version 5.5.33 Version 5.6.0-alpha1 Version 5.6.0-alpha2 Version 5.6.0-alpha3 Version 5.6.0-alpha4 Version 5.6.0-alpha5 Version 5.6.0-beta1 Version 5.6.0-beta2 Version 5.6.0-beta3 Version 5.6.0-beta4 Version 5.6.1 Version 5.6.2 Version 5.6.3 Version 5.6.4 Version 5.6.5 Version 5.6.6 Version 5.6.7 Version 5.6.8 Version 5.6.9 Version 5.6.10 Version 5.6.11 Version 5.6.12 Version 5.6.13 Version 5.6.14 Version 5.6.15 Version 5.6.16 Version 5.6.17 Version 5.6.18 Version 5.6.19 Version 7.0.0 Version 7.0.1 Version 7.0.2 Version 7.0.3 Version 7.0.4
References NVD https://nvd.nist.gov/vuln/detail/CVE-2016-4071 CVE.org https://www.cve.org/CVERecord?id=CVE-2016-4071