CVE-2016-10160

Опубликовано: 24 янв. 2017

Источник: nvd

CVSS3: 9.8

CVSS2: 7.5

EPSS Низкий

Описание

Off-by-one error in the phar_parse_pharfile function in ext/phar/phar.c in PHP before 5.6.30 and 7.0.x before 7.0.15 allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a crafted PHAR archive with an alias mismatch.

Ссылки

http://php.net/ChangeLog-5.php
Release Notes
Vendor Advisory
http://php.net/ChangeLog-7.php
Release Notes
Vendor Advisory
http://www.debian.org/security/2017/dsa-3783
Third Party Advisory
http://www.securityfocus.com/bid/95783
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1037659
Broken Link
Third Party Advisory
VDB Entry
https://access.redhat.com/errata/RHSA-2018:1296
Third Party Advisory
https://bugs.php.net/bug.php?id=73768
Issue Tracking
Patch
Vendor Advisory
https://github.com/php/php-src/commit/b28b8b2fee6dfa6fcd13305c581bb835689ac3be
Issue Tracking
Patch
Third Party Advisory
https://security.gentoo.org/glsa/201702-29
Third Party Advisory
https://security.netapp.com/advisory/ntap-20180112-0001/
Third Party Advisory
https://www.tenable.com/security/tns-2017-04
Third Party Advisory
http://php.net/ChangeLog-5.php
Release Notes
Vendor Advisory
http://php.net/ChangeLog-7.php
Release Notes
Vendor Advisory
http://www.debian.org/security/2017/dsa-3783
Third Party Advisory
http://www.securityfocus.com/bid/95783
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1037659
Broken Link
Third Party Advisory
VDB Entry
https://access.redhat.com/errata/RHSA-2018:1296
Third Party Advisory
https://bugs.php.net/bug.php?id=73768
Issue Tracking
Patch
Vendor Advisory
https://github.com/php/php-src/commit/b28b8b2fee6dfa6fcd13305c581bb835689ac3be
Issue Tracking
Patch
Third Party Advisory
https://security.gentoo.org/glsa/201702-29
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:php:php:*:*:*:*:*:*:*:*

Версия от 5.6.0 (включая) до 5.6.30 (исключая)

cpe:2.3:a:php:php:*:*:*:*:*:*:*:*

Версия от 7.0.0 (включая) до 7.0.15 (исключая)

cpe:2.3:a:php:php:*:*:*:*:*:*:*:*

Версия от 7.1.0 (включая) до 7.1.1 (исключая)

Конфигурация 2

cpe:2.3:a:netapp:clustered_data_ontap:-:*:*:*:*:*:*:*

Конфигурация 3

cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

EPSS

Процентиль: 88%

0.03771

Низкий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-193

Связанные уязвимости

CVE-2016-10160

CVSS3: 9.8

ubuntu

больше 8 лет назад

CVE-2016-10160

CVSS3: 5.3

redhat

больше 8 лет назад

CVE-2016-10160

CVSS3: 9.8

debian

больше 8 лет назад

Off-by-one error in the phar_parse_pharfile function in ext/phar/phar. ...

GHSA-4jqc-cj54-frf5

CVSS3: 9.8

github

около 3 лет назад

BDU:2017-01601

fstec

больше 8 лет назад

Уязвимость функции phar_parse_pharfile интерпретатора PHP, позволяющая нарушителю вызвать отказ в обслуживании или выполнить произвольный код

EPSS

Процентиль: 88%

0.03771

Низкий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-193