CVE-2016-2554
CRITICAL
9.8
CVSS 3.0
Description
Stack-based buffer overflow in ext/phar/tar.c in PHP before 5.5.32, 5.6.x before 5.6.18, and 7.x before 7.0.3 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted TAR archive.
Affected products and versions
- PHP — Up to and including 5.5.31
- PHP versions 5.6.0alpha1, 5.6.0alpha2, 5.6.0alpha3, 5.6.0alpha4, 5.6.0alpha5, 5.6.0beta1, 5.6.0beta2, 5.6.0beta3, 5.6.0beta4, 5.6.1, 5.6.2, 5.6.3, 5.6.4, 5.6.5, 5.6.6, 5.6.7, 5.6.8, 5.6.9, 5.6.10, 5.6.11, 5.6.12, 5.6.13, 5.6.14, 5.6.15, 5.6.16, 5.6.17, 7.0.0, 7.0.1, 7.0.2
References
- lists.opensuse.org http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00052.html
- lists.opensuse.org http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00056.html
- lists.opensuse.org http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00058.html
- php.net http://php.net/ChangeLog-5.php
- php.net http://php.net/ChangeLog-7.php
- rhn.redhat.com http://rhn.redhat.com/errata/RHSA-2016-2750.html
- www.ubuntu.com http://www.ubuntu.com/usn/USN-2952-1
- www.ubuntu.com http://www.ubuntu.com/usn/USN-2952-2
- bugs.php.net https://bugs.php.net/bug.php?id=71488 Exploit
- h20566.www2.hpe.com https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05240731
- nvd.nist.gov Official NVD record