blogsafe.org My Downloads

BlogSafe.org

PHP CVEs

Vulnerabilities in the PHP language itself, and which PHP versions they affect.

← Back to CVE list

CVE-2016-6297

HIGH 8.8 CVSS 3.0
Published
July 25, 2016
Last modified
June 17, 2026
NVD status
Modified
Reported by
cve@mitre.org
Weakness
CWE-119
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Description

Integer overflow in the php_stream_zip_opener function in ext/zip/zip_stream.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 allows remote attackers to cause a denial of service (stack-based buffer overflow) or possibly have unspecified other impact via a crafted zip:// URL.

Affected products and versions

  • PHP — Up to and including 5.5.37
  • PHP versions 5.6.0alpha1, 5.6.0alpha2, 5.6.0alpha3, 5.6.0alpha4, 5.6.0alpha5, 5.6.0beta1, 5.6.0beta2, 5.6.0beta3, 5.6.0beta4, 5.6.1, 5.6.2, 5.6.3, 5.6.4, 5.6.5, 5.6.6, 5.6.7, 5.6.8, 5.6.9, 5.6.10, 5.6.11, 5.6.12, 5.6.13, 5.6.14, 5.6.15, 5.6.16, 5.6.17, 5.6.18, 5.6.19, 5.6.20, 5.6.21, 5.6.22, 5.6.23, 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8

References

  • fortiguard.com http://fortiguard.com/advisory/fortinet-discovers-php-stack-based-buffer-overflow-vulnerabilities Third Party Advisory
  • git.php.net http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=81406c0c1d45f75fcc7972ed974d2597abb0b9e9
  • lists.apple.com http://lists.apple.com/archives/security-announce/2016/Sep/msg00006.html
  • openwall.com http://openwall.com/lists/oss-security/2016/07/24/2 Mailing List
  • php.net http://php.net/ChangeLog-5.php Release Notes
  • php.net http://php.net/ChangeLog-7.php Release Notes
  • rhn.redhat.com http://rhn.redhat.com/errata/RHSA-2016-2750.html
  • www.debian.org http://www.debian.org/security/2016/dsa-3631
  • www.securityfocus.com http://www.securityfocus.com/bid/92099 Third Party Advisory, VDB Entry
  • www.securitytracker.com http://www.securitytracker.com/id/1036430
  • bugs.php.net https://bugs.php.net/72520 Exploit, Issue Tracking
  • security.gentoo.org https://security.gentoo.org/glsa/201611-22
  • support.apple.com https://support.apple.com/HT207170
  • nvd.nist.gov Official NVD record