CVE-2016-4473

Опубликовано: 08 июн. 2017

Источник: nvd

CVSS3: 9.8

CVSS2: 7.5

EPSS Средний

Описание

/ext/phar/phar_object.c in PHP 7.0.7 and 5.6.x allows remote attackers to execute arbitrary code. NOTE: Introduced as part of an incomplete fix to CVE-2015-6833.

Ссылки

http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00007.html
Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2016-2750.html
Third Party Advisory
VDB Entry
http://www.securityfocus.com/bid/98999
Third Party Advisory
VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1347772
Exploit
Issue Tracking
Patch
Third Party Advisory
VDB Entry
http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00007.html
Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2016-2750.html
Third Party Advisory
VDB Entry
http://www.securityfocus.com/bid/98999
Third Party Advisory
VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1347772
Exploit
Issue Tracking
Patch
Third Party Advisory
VDB Entry

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:php:php:5.6.0:alpha1:*:*:*:*:*:*

cpe:2.3:a:php:php:5.6.0:alpha2:*:*:*:*:*:*

cpe:2.3:a:php:php:5.6.0:alpha3:*:*:*:*:*:*

cpe:2.3:a:php:php:5.6.0:alpha4:*:*:*:*:*:*

cpe:2.3:a:php:php:5.6.0:alpha5:*:*:*:*:*:*

cpe:2.3:a:php:php:5.6.0:beta1:*:*:*:*:*:*

cpe:2.3:a:php:php:5.6.0:beta2:*:*:*:*:*:*

cpe:2.3:a:php:php:5.6.0:beta3:*:*:*:*:*:*

cpe:2.3:a:php:php:5.6.0:beta4:*:*:*:*:*:*

cpe:2.3:a:php:php:5.6.1:*:*:*:*:*:*:*

cpe:2.3:a:php:php:5.6.2:*:*:*:*:*:*:*

cpe:2.3:a:php:php:5.6.3:*:*:*:*:*:*:*

cpe:2.3:a:php:php:5.6.4:*:*:*:*:*:*:*

cpe:2.3:a:php:php:5.6.5:*:*:*:*:*:*:*

cpe:2.3:a:php:php:5.6.6:*:*:*:*:*:*:*

cpe:2.3:a:php:php:5.6.7:*:*:*:*:*:*:*

cpe:2.3:a:php:php:5.6.8:*:*:*:*:*:*:*

cpe:2.3:a:php:php:5.6.9:*:*:*:*:*:*:*

cpe:2.3:a:php:php:5.6.10:*:*:*:*:*:*:*

cpe:2.3:a:php:php:5.6.11:*:*:*:*:*:*:*

cpe:2.3:a:php:php:5.6.12:*:*:*:*:*:*:*

cpe:2.3:a:php:php:5.6.13:*:*:*:*:*:*:*

cpe:2.3:a:php:php:5.6.14:*:*:*:*:*:*:*

cpe:2.3:a:php:php:5.6.15:*:*:*:*:*:*:*

cpe:2.3:a:php:php:5.6.16:*:*:*:*:*:*:*

cpe:2.3:a:php:php:5.6.17:*:*:*:*:*:*:*

cpe:2.3:a:php:php:5.6.18:*:*:*:*:*:*:*

cpe:2.3:a:php:php:5.6.19:*:*:*:*:*:*:*

cpe:2.3:a:php:php:5.6.20:*:*:*:*:*:*:*

cpe:2.3:a:php:php:5.6.21:*:*:*:*:*:*:*

cpe:2.3:a:php:php:5.6.22:*:*:*:*:*:*:*

cpe:2.3:a:php:php:7.0.7:*:*:*:*:*:*:*

Конфигурация 2

Одно из

cpe:2.3:o:suse:linux_enterprise_module_for_web_scripting:12:*:*:*:*:*:*:*

cpe:2.3:o:suse:linux_enterprise_software_development_kit:12:sp1:*:*:*:*:*:*

EPSS

Процентиль: 95%

0.20365

Средний

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-416

Связанные уязвимости

CVE-2016-4473

CVSS3: 9.8

ubuntu

около 8 лет назад

/ext/phar/phar_object.c in PHP 7.0.7 and 5.6.x allows remote attackers to execute arbitrary code. NOTE: Introduced as part of an incomplete fix to CVE-2015-6833.

CVE-2016-4473

redhat

около 9 лет назад

/ext/phar/phar_object.c in PHP 7.0.7 and 5.6.x allows remote attackers to execute arbitrary code. NOTE: Introduced as part of an incomplete fix to CVE-2015-6833.

CVE-2016-4473

CVSS3: 9.8

debian

около 8 лет назад

/ext/phar/phar_object.c in PHP 7.0.7 and 5.6.x allows remote attackers ...

GHSA-jvpg-hmq4-6326

CVSS3: 9.8

github

около 3 лет назад

/ext/phar/phar_object.c in PHP 7.0.7 and 5.6.x allows remote attackers to execute arbitrary code. NOTE: Introduced as part of an incomplete fix to CVE-2015-6833.

BDU:2017-01772

fstec

около 8 лет назад

Уязвимость компонента /ext/phar/phar_object.c интерпретатора PHP, позволяющая нарушителю выполнить произвольный код

EPSS

Процентиль: 95%

0.20365

Средний

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-416