The bzread function in ext/bz2/bz2.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 allows remote attackers to cause a denial of service (out-of-bounds write) or execute arbitrary code via a crafted bz2 archive.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade php5Upgrade php | Aug 30, 2017 | Apr 21, 2017 |
| Centos_linux | — | Upgrade php-mbstringUpgrade php-pdoUpgrade php-soapUpgrade php-commonUpgrade php-pgsqlUpgrade php-xmlrpcUpgrade php-pspellUpgrade php-develUpgrade php-mysqlUpgrade php-fpmUpgrade php-processUpgrade php-xmlUpgrade php-snmpUpgrade php-bcmathUpgrade php-intlUpgrade php-odbcUpgrade php-gdUpgrade php-debuginfoUpgrade php-cliUpgrade php-ldapUpgrade php-enchantUpgrade php-embeddedUpgrade php-dbaUpgrade php-mysqlndUpgrade phpUpgrade php-recode | Jun 23, 2020 | Apr 21, 2017 |
| Debian | — | Upgrade php7.0Upgrade php5 | Jul 27, 2016 | Jul 26, 2016 |
| Freebsd | — | Upgrade php70-snmpUpgrade php70-gdUpgrade php70-xmlrpcUpgrade php56-xmlrpcUpgrade php56-exifUpgrade php55-odbcUpgrade php56-snmpUpgrade php70-zipUpgrade php70-curlUpgrade php55-exifUpgrade php55-gdUpgrade php56-zipUpgrade php55-snmpUpgrade php70-bz2Upgrade php70-mcryptUpgrade php70Upgrade php56-odbcUpgrade php56-gdUpgrade php55-xmlrpcUpgrade php55-bz2Upgrade php56Upgrade php55-zipUpgrade php56-bz2Upgrade php55Upgrade php70-odbcUpgrade php70-exif | Dec 10, 2025 | Jul 26, 2016 |
| Huawei Euleros 2_0_sp1 | — | Upgrade php-mysqlUpgrade php-gdUpgrade php-cliUpgrade php-soapUpgrade php-xmlUpgrade php-processUpgrade php-xmlrpcUpgrade phpUpgrade php-pgsqlUpgrade php-commonUpgrade php-odbcUpgrade php-ldapUpgrade php-recodeUpgrade php-pdo | Nov 30, 2017 | Apr 21, 2017 |
| Oracle_linux | — | Upgrade php-mysqlndUpgrade php-odbcUpgrade php-xmlUpgrade php-commonUpgrade php-cliUpgrade php-mysqlUpgrade php-mbstringUpgrade php-snmpUpgrade php-soapUpgrade phpUpgrade php-enchantUpgrade php-fpmUpgrade php-pdoUpgrade php-processUpgrade php-develUpgrade php-pgsqlUpgrade php-embeddedUpgrade php-gdUpgrade php-xmlrpcUpgrade php-bcmathUpgrade php-dbaUpgrade php-pspellUpgrade php-intlUpgrade php-ldapUpgrade php-recode | Nov 9, 2016 | Jul 18, 2016 |
| Php | — | Upgrade to PHP version 5.6.24Upgrade to PHP version 5.5.38Upgrade to PHP version 7.0.9 | May 1, 2017 | Apr 21, 2017 |
| Redhat_linux | — | Upgrade php-pdoUpgrade phpUpgrade php-embeddedNo solution existsUpgrade php-develUpgrade php-odbcUpgrade php-ldapUpgrade php-commonUpgrade php-xmlUpgrade php-enchantUpgrade php-bcmathUpgrade php-fpmUpgrade php-intlUpgrade php-debuginfoUpgrade php-xmlrpcUpgrade php-mysqlUpgrade php-gdUpgrade php-processUpgrade php-recodeUpgrade php-soapUpgrade php-pspellUpgrade php-snmpUpgrade php-dbaUpgrade php-mbstringUpgrade php-cliUpgrade php-mysqlndUpgrade php-pgsql | Nov 4, 2016 | Jul 26, 2016 |
| Suse | — | Upgrade php7-curlUpgrade php7-odbcUpgrade php7-enchantUpgrade php5-dbaUpgrade php53-bz2Upgrade php5-dbaseUpgrade php5-bz2Upgrade php5-gdUpgrade php53-zlibUpgrade php7-dbaUpgrade php7-pearUpgrade php7-mysqlUpgrade php53-xmlrpcUpgrade php7-fileinfoUpgrade php5-sqliteUpgrade php5-opcacheUpgrade php7-bcmathUpgrade php7-xmlwriterUpgrade php53-jsonUpgrade php53-ctypeUpgrade php5-posixUpgrade php5-domUpgrade php53-opensslUpgrade php7-develUpgrade php5-enchantUpgrade php7-zipUpgrade php53-bcmathUpgrade php7-calendarUpgrade php5-pspellUpgrade php53-intlUpgrade php53-pearUpgrade php7-sysvshmUpgrade php53-ldapUpgrade php7-mcryptUpgrade php7-zlibUpgrade php5-sysvshmUpgrade php5-tokenizerUpgrade php53-dbaUpgrade php53-tokenizerUpgrade php7-opcacheUpgrade php53-exifUpgrade php7-fastcgiUpgrade php53-snmpUpgrade apache2-mod_php53Upgrade php5-ctypeUpgrade php5-fileinfoUpgrade php7-pspellUpgrade php7-shmopUpgrade php5-soapUpgrade php5-intlUpgrade php5-fpmUpgrade php5-shmopUpgrade php5-zlibUpgrade php5-pgsqlUpgrade php53-domUpgrade php7-snmpUpgrade php5-curlUpgrade php7-ldapUpgrade php53-pspellUpgrade php5-calendarUpgrade php53-gmpUpgrade php7-ctypeUpgrade php5-mbstringUpgrade php5-exifUpgrade php5-suhosinUpgrade php5-ldapUpgrade php7-sysvsemUpgrade php53-xslUpgrade php5-odbcUpgrade php53-fastcgiUpgrade php53-soapUpgrade php53-calendarUpgrade php5-sysvmsgUpgrade php53-shmopUpgrade php7-intlUpgrade php5-hashUpgrade php5-mysqlUpgrade php7-iconvUpgrade php53-pcntlUpgrade php5-xslUpgrade php53-sysvshmUpgrade php7-exifUpgrade php5-xmlreaderUpgrade php7-xmlreaderUpgrade php53-tidyUpgrade php7-pgsqlUpgrade php53-posixUpgrade php53-wddxUpgrade php5-ftpUpgrade php53-develUpgrade php5-fastcgiUpgrade php53-gdUpgrade php7Upgrade php7-posixUpgrade php7-gettextUpgrade php5-imapUpgrade php7-gmpUpgrade php5-gmpUpgrade php53-sysvmsgUpgrade php7-pharUpgrade php5-mcryptUpgrade php53-sqliteUpgrade php5-jsonUpgrade php5-wddxUpgrade php5-pcntlUpgrade php53-socketsUpgrade php53-readlineUpgrade php5-gettextUpgrade php5-pharUpgrade php53-curlUpgrade php7-bz2Upgrade php7-sysvmsgUpgrade php7-wddxUpgrade php53-gettextUpgrade php7-opensslUpgrade php7-soapUpgrade php5-xmlrpcUpgrade php5-socketsUpgrade apache2-mod_php7Upgrade php7-xmlrpcUpgrade php5-iconvUpgrade php7-imapUpgrade php7-gdUpgrade php5-develUpgrade php7-pear-archive_tarUpgrade php53-zipUpgrade php53-xmlwriterUpgrade php53-xmlreaderUpgrade php53-mysqlUpgrade php5-xmlwriterUpgrade php53-pgsqlUpgrade php5-sysvsemUpgrade php7-fpmUpgrade php7-sqliteUpgrade php5-snmpUpgrade php7-pcntlUpgrade php5-zipUpgrade php7-pdoUpgrade php53-mbstringUpgrade php53-odbcUpgrade php53-sysvsemUpgrade php53-suhosinUpgrade php5-pearUpgrade php53-imapUpgrade php7-domUpgrade php5Upgrade php7-ftpUpgrade php7-mbstringUpgrade php53Upgrade php53-iconvUpgrade php7-xslUpgrade php53-pdoUpgrade php7-jsonUpgrade php5-pdoUpgrade php53-mcryptUpgrade php53-ftpUpgrade php7-socketsUpgrade apache2-mod_php5Upgrade php5-opensslUpgrade php53-fileinfoUpgrade php7-tokenizerUpgrade php5-bcmath | Aug 22, 2016 | Jul 26, 2016 |
| Ubuntu | — | Upgrade libapache2-mod-php5Upgrade php5-cliUpgrade php7.0-cgiUpgrade php5-cgiUpgrade php5-fpmUpgrade php7.0-fpmUpgrade libapache2-mod-php7.0Upgrade php7.0-cli | Aug 2, 2016 | Jul 26, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub