Off-by-one error in PHP - CVE-2016-10160

Vulnerability identifier: #VU12907

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2016-10160

CWE-ID: CWE-193

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause DoS condition or execute arbitrary code on the target system.

The weakness exists in the phar_parse_pharfile function in ext/phar/phar.c due to off-by-one error. A remote attacker can submit a specially crafted PHAR archive with an alias mismatch and cause the service to crash or execute arbitrary code.

Successful exploitation of the vulnerability may result in system compromise.

PHP
Amazon Linux AMI
Gentoo Linux
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for Power
SUSE Linux
Slackware Linux
php5 (Ubuntu package)
php (Debian package)

Update to version 5.6.30 or 7.0.15.

php5 (Ubuntu package) - addressed in versions 5.3.10-1ubuntu3.26, 5.5.9+dfsg-1ubuntu4.21
php (Debian package) - update to 5.6.30+dfsg-0+deb8u1

• http://www.php.net/ChangeLog-5.php
• http://www.php.net/ChangeLog-7.php

• Red Hat update for php
• Debian update for php5
• Gentoo update for PHP
• Slackware Linux update for php
• Amazon Linux AMI update for php56
• Amazon Linux AMI update for php70
• Ubuntu update for PHP
• SUSE Linux update for php53