blogsafe.org My Downloads

BlogSafe.org

PHP CVEs

Vulnerabilities in the PHP language itself, and which PHP versions they affect.

← Back to CVE list

CVE-2016-4473

CRITICAL 9.8 CVSS 3.0
Published
June 8, 2017
Last modified
June 17, 2026
NVD status
Modified
Reported by
secalert@redhat.com
Weakness
CWE-416
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

/ext/phar/phar_object.c in PHP 7.0.7 and 5.6.x allows remote attackers to execute arbitrary code. NOTE: Introduced as part of an incomplete fix to CVE-2015-6833.

Affected products and versions

  • PHP versions 5.6.0alpha1, 5.6.0alpha2, 5.6.0alpha3, 5.6.0alpha4, 5.6.0alpha5, 5.6.0beta1, 5.6.0beta2, 5.6.0beta3, 5.6.0beta4, 5.6.1, 5.6.2, 5.6.3, 5.6.4, 5.6.5, 5.6.6, 5.6.7, 5.6.8, 5.6.9, 5.6.10, 5.6.11, 5.6.12, 5.6.13, 5.6.14, 5.6.15, 5.6.16, 5.6.17, 5.6.18, 5.6.19, 5.6.20, 5.6.21, 5.6.22, 7.0.7

References

  • lists.opensuse.org http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00007.html Third Party Advisory
  • rhn.redhat.com http://rhn.redhat.com/errata/RHSA-2016-2750.html Third Party Advisory, VDB Entry
  • www.securityfocus.com http://www.securityfocus.com/bid/98999 Third Party Advisory, VDB Entry
  • bugzilla.redhat.com https://bugzilla.redhat.com/show_bug.cgi?id=1347772 Exploit, Issue Tracking, Patch, Third Party Advisory, VDB Entry
  • nvd.nist.gov Official NVD record