Arbitrary code execution in PHP - CVE-2016-7416

Vulnerability identifier: #VU523

CSH Severity: High

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2016-7416

CWE-ID: CWE-284

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a remote or local user to cause arbitrary code execution on the target system.
The weakness is caused by memory corruption in local data handling that allows a malicious user to get access to the system and cause arbitrary code execution.
Successful explotation of the vulnerability may result in arbitrary code execution on the vulnerable system.

PHP
Arch Linux
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for Power
SUSE Linux
Slackware Linux
Fedora
php (Alpine package)
php

Update to 5.6.26.
http://php.net/ChangeLog-5.php#5.6.26
Update to 7.0.11.
http://php.net/ChangeLog-7.php#7.0.11

php (Alpine package) - update to 5.6.27-r0
php - addressed in versions 5.6.26-1.fc23, 5.6.26-1.fc24

• Arch Linux update for php
• Slackware Linux update for php
• OpenSUSE Linux update for php5
• SUSE Linux update for php5
• SUSE Linux update for php53
• OpenSUSE Linux update for php5
• SUSE Linux update for php5
• Red Hat update for php
• Arbitrary code execution in php (Alpine package)
• SUSE Linux update for php53
• Fedora 24 update for php
• Fedora 23 update for php