PT-2016-3380 · Php+2 · Php+2
Nguyenvuhoang199321
·
Publicado
2016-09-17
·
Atualizado
2018-05-04
·
CVE-2016-7414
CVSS v2.0
10
Crítica
| Vetor | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
PHP versions prior to 5.6.26
PHP versions 7.x prior to 7.0.11
Description
The issue is related to the ZIP signature-verification feature, which does not ensure that the
uncompressed filesize field is large enough. This allows remote attackers to cause a denial of service (out-of-bounds memory access) or possibly have other unspecified impacts via a crafted PHAR archive. The problem is associated with the files ext/phar/util.c and ext/phar/zip.c.Recommendations
For PHP versions prior to 5.6.26, update to version 5.6.26 or later.
For PHP versions 7.x prior to 7.0.11, update to version 7.0.11 or later.
As a temporary workaround, consider restricting the use of PHAR archives until a patch is applied.
Exploit
Correção
DoS
Buffer Overflow
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Php
Suse
Ubuntu