CVE-2016-5773
Last modified
CVE-2016-5773 is a vulnerability of currently unknown severity. php_zip.c in the zip extension in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8 improperly interacts with the unserialize implementation and garbage collection, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and application crash) via crafted serialized data containing a ZipArchive object.. EPSS estimates a 9.09% chance of exploitation in the next 30 days.
Description
php_zip.c in the zip extension in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8 improperly interacts with the unserialize implementation and garbage collection, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and application crash) via crafted serialized data containing a ZipArchive object.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions | Update |
|---|---|---|---|
| Php | Php | <= 5.5.36 | — |
| Php | Php | 5.6.0 | Alpha1 |
| Php | Php | 5.6.1 | — |
| Php | Php | 5.6.2 | — |
| Php | Php | 5.6.3 | — |
| Php | Php | 5.6.4 | — |
| Php | Php | 5.6.5 | — |
| Php | Php | 5.6.6 | — |
| Php | Php | 5.6.7 | — |
| Php | Php | 5.6.8 | — |
| Php | Php | 5.6.9 | — |
| Php | Php | 5.6.10 | — |
| Php | Php | 5.6.11 | — |
| Php | Php | 5.6.12 | — |
| Php | Php | 5.6.13 | — |
| Php | Php | 5.6.14 | — |
| Php | Php | 5.6.15 | — |
| Php | Php | 5.6.16 | — |
| Php | Php | 5.6.17 | — |
| Php | Php | 5.6.18 | — |
| Php | Php | 5.6.19 | — |
| Php | Php | 5.6.20 | — |
| Php | Php | 5.6.21 | — |
| Php | Php | 5.6.22 | — |
| Php | Php | 5.6.23 | — |
| Php | Php | 7.0.0 | — |
| Php | Php | 7.0.1 | — |
| Php | Php | 7.0.2 | — |
| Php | Php | 7.0.3 | — |
| Php | Php | 7.0.4 | — |
| Php | Php | 7.0.5 | — |
| Php | Php | 7.0.6 | — |
| Php | Php | 7.0.7 | — |
References
- http://php.net/ChangeLog-5.phpPatch, Release Notes
- http://php.net/ChangeLog-7.phpPatch, Release Notes
- https://bugs.php.net/bug.php?id=72434Exploit, Vendor Advisory
- http://php.net/ChangeLog-5.phpPatch, Release Notes
- http://php.net/ChangeLog-7.phpPatch, Release Notes
- https://bugs.php.net/bug.php?id=72434Exploit, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2016-5773?
How severe is CVE-2016-5773?
How do I fix CVE-2016-5773?
Are you affected by CVE-2016-5773?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST