CVE-2016-5773 php_zip.c in the zip extension in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8 improperly interacts with the unserialize implementation and garbage collection, which allows remote atta...
CriticalCVSS 9.8
EPSS 9.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
php_zip.c in the zip extension in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8 improperly interacts with the unserialize implementation and garbage collection, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and application crash) via crafted serialized data containing a ZipArchive object.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| PHP | <= 5.5.36 | No fix listed |
| PHP | = 5.6.0-alpha1 | No fix listed |
| PHP | = 5.6.0-alpha2 | No fix listed |
| PHP | = 5.6.0-alpha3 | No fix listed |
| PHP | = 5.6.0-alpha4 | No fix listed |
| PHP | = 5.6.0-alpha5 | No fix listed |
| PHP | = 5.6.0-beta1 | No fix listed |
| PHP | = 5.6.0-beta2 | No fix listed |
| PHP | = 5.6.0-beta3 | No fix listed |
| PHP | = 5.6.0-beta4 | No fix listed |
| PHP | = 5.6.1 | No fix listed |
| PHP | = 5.6.2 | No fix listed |
| PHP | = 5.6.3 | No fix listed |
| PHP | = 5.6.4 | No fix listed |
| PHP | = 5.6.5 | No fix listed |
| PHP | = 5.6.6 | No fix listed |
| PHP | = 5.6.7 | No fix listed |
| PHP | = 5.6.8 | No fix listed |
| PHP | = 5.6.9 | No fix listed |
| PHP | = 5.6.10 | No fix listed |
| PHP | = 5.6.11 | No fix listed |
| PHP | = 5.6.12 | No fix listed |
| PHP | = 5.6.13 | No fix listed |
| PHP | = 5.6.14 | No fix listed |
| PHP | = 5.6.15 | No fix listed |
Show 16 more
| Product | Affected versions | Fixed in |
|---|---|---|
| PHP | = 5.6.16 | No fix listed |
| PHP | = 5.6.17 | No fix listed |
| PHP | = 5.6.18 | No fix listed |
| PHP | = 5.6.19 | No fix listed |
| PHP | = 5.6.20 | No fix listed |
| PHP | = 5.6.21 | No fix listed |
| PHP | = 5.6.22 | No fix listed |
| PHP | = 5.6.23 | No fix listed |
| PHP | = 7.0.0 | No fix listed |
| PHP | = 7.0.1 | No fix listed |
| PHP | = 7.0.2 | No fix listed |
| PHP | = 7.0.3 | No fix listed |
| PHP | = 7.0.4 | No fix listed |
| PHP | = 7.0.5 | No fix listed |
| PHP | = 7.0.6 | No fix listed |
| PHP | = 7.0.7 | No fix listed |
References
- github.com
- APPLE-SA-2016-09-20 vendor-advisory
- openSUSE-SU-2016:1761 vendor-advisory
- php.net patch release-notes
- php.net patch release-notes
- RHSA-2016:2750 vendor-advisory
- DSA-3618 vendor-advisory
- [oss-security] 20160623 Re: CVE for PHP 5.5.37 issues mailing-list release-notes
- 91397 vdb-entry
- bugs.php.net exploit vendor-advisory
- h20566.www2.hpe.com
- support.apple.com