The phar_parse_zipfile function in zip.c in the PHAR extension in PHP before 5.5.33 and 5.6.x before 5.6.19 allows remote attackers to obtain sensitive information from process memory or cause a denial of service (out-of-bounds read and application crash) by placing a PK\x05\x06 signature at an invalid location.
CVSS Details
- CVSS 3.1 Base Score: 8.2
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Apple Osx Apachemodphp | — | Upgrade macOS to the latest version | Jun 2, 2016 | Mar 31, 2016 |
| Debian | — | Upgrade php5 | Mar 31, 2017 | Mar 31, 2016 |
| Huawei Euleros 2_0_sp2 | — | Upgrade php-cliUpgrade phpUpgrade php-xmlUpgrade php-recodeUpgrade php-ldapUpgrade php-processUpgrade php-mysqlUpgrade php-pdoUpgrade php-xmlrpcUpgrade php-pgsqlUpgrade php-gdUpgrade php-commonUpgrade php-odbcUpgrade php-soap | Dec 4, 2019 | Mar 31, 2016 |
| Huawei Euleros 2_0_sp3 | — | Upgrade php-ldapUpgrade php-soapUpgrade php-gdUpgrade phpUpgrade php-pdoUpgrade php-recodeUpgrade php-xmlUpgrade php-odbcUpgrade php-commonUpgrade php-processUpgrade php-mysqlUpgrade php-cliUpgrade php-pgsqlUpgrade php-xmlrpc | Dec 18, 2019 | Mar 31, 2016 |
| Huawei Euleros 2_0_sp5 | — | Upgrade php-recodeUpgrade php-xmlrpcUpgrade php-gdUpgrade php-pdoUpgrade php-mysqlUpgrade php-xmlUpgrade php-processUpgrade php-cliUpgrade phpUpgrade php-ldapUpgrade php-pgsqlUpgrade php-commonUpgrade php-soapUpgrade php-odbc | Nov 19, 2019 | Mar 31, 2016 |
| Php | — | Upgrade to PHP version 5.5.33Upgrade to PHP version 5.6.19 | May 5, 2016 | Mar 31, 2016 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Feb 2, 2016 |
| Suse | — | Upgrade php5-pcntlUpgrade php5-pgsqlUpgrade php53-develUpgrade php5-dbaUpgrade php53-bcmathUpgrade php5-zlibUpgrade php53-wddxUpgrade php5-fileinfoUpgrade php53-mcryptUpgrade php53-intlUpgrade php5-curlUpgrade php5-domUpgrade php5-zipUpgrade php53-mysqlUpgrade php5-ftpUpgrade php5-bz2Upgrade php5-exifUpgrade php53-pcntlUpgrade php53-readlineUpgrade php5-gmpUpgrade php53-gdUpgrade php5-calendarUpgrade php53-iconvUpgrade php53-calendarUpgrade php53-socketsUpgrade php53-shmopUpgrade php53-posixUpgrade php5-sysvsemUpgrade php5-snmpUpgrade php53Upgrade php5-sysvmsgUpgrade php5-soapUpgrade php53-fileinfoUpgrade php53-sysvshmUpgrade php53-suhosinUpgrade php53-imapUpgrade php53-xmlreaderUpgrade php53-zlibUpgrade php53-gettextUpgrade php53-odbcUpgrade php5-mysqlUpgrade php5-mcryptUpgrade php5Upgrade php53-mbstringUpgrade php5-xmlreaderUpgrade php53-dbaUpgrade php5-gettextUpgrade php5-odbcUpgrade php5-xmlwriterUpgrade php53-curlUpgrade php5-fastcgiUpgrade php5-intlUpgrade php53-jsonUpgrade php5-gdUpgrade php5-opcacheUpgrade php53-pgsqlUpgrade php53-exifUpgrade php5-socketsUpgrade php53-sysvmsgUpgrade php53-xslUpgrade php53-bz2Upgrade php5-posixUpgrade php53-sysvsemUpgrade php53-opensslUpgrade php5-suhosinUpgrade php53-gmpUpgrade php5-ldapUpgrade php5-develUpgrade php5-iconvUpgrade php5-xslUpgrade php5-fpmUpgrade php5-sqliteUpgrade php53-sqliteUpgrade php53-tokenizerUpgrade php53-soapUpgrade php5-wddxUpgrade php5-enchantUpgrade php53-domUpgrade php53-ldapUpgrade php5-xmlrpcUpgrade php5-sysvshmUpgrade php5-pspellUpgrade php5-tokenizerUpgrade php5-ctypeUpgrade php53-xmlrpcUpgrade php53-fastcgiUpgrade php53-pspellUpgrade php53-ftpUpgrade apache2-mod_php53Upgrade apache2-mod_php5 | Apr 26, 2016 | Mar 31, 2016 |
| Ubuntu | — | Upgrade php5-gdUpgrade libapache2-mod-php5Upgrade php5-fpmUpgrade php5-cgiUpgrade php5-snmpUpgrade php5-cliUpgrade php5-mysqlnd | Apr 21, 2016 | Mar 31, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub