CVE-2016-5399
PHP 5.5.37/5.6.23/7.0.8 - 'bzread()' Out-of-Bounds Write
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
5Exploited in Wild
-Decision
Descriptions
The bzread function in ext/bz2/bz2.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 allows remote attackers to cause a denial of service (out-of-bounds write) or execute arbitrary code via a crafted bz2 archive.
La función bzread en ext/bz2/bz2.c en PHP en versiones anteriores a 5.5.38, 5.6.x en versiones anteriores a 5.6.24, y 7.x en versiones anteriores a 7.0.9 permite a atacantes remotos provocar una denegación de servicio (escritura fuera de limites) o ejecutar código arbitrario a través de un archivo bz2 manipulado.
A flaw was found in the way certain error conditions were handled by bzread() function in PHP. An attacker could use this flaw to upload a specially crafted bz2 archive which, when parsed via the vulnerable function, could cause the application to crash or execute arbitrary code with the permissions of the user running the PHP application.
PHP versions 7.0.8, 5.6.23, and 5.5.37 suffers from an out-of-bounds write vulnerability in bzread().
CVSS Scores
SSVC
- Decision:-
Timeline
- 2016-06-10 CVE Reserved
- 2016-07-21 CVE Published
- 2023-09-06 EPSS Updated
- 2024-08-06 CVE Updated
- 2024-08-06 First Exploit
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-390: Detection of Error Condition Without Action
- CWE-787: Out-of-bounds Write
CAPEC
References (16)
| URL | Tag | Source |
|---|---|---|
| http://www.securityfocus.com/archive/1/538966/100/0/threaded | Mailing List | |
| http://www.securityfocus.com/bid/92051 | Third Party Advisory | |
| http://www.securitytracker.com/id/1036430 | Third Party Advisory | |
| https://security.netapp.com/advisory/ntap-20180112-0001 | Third Party Advisory |
|
| URL | Date | SRC |
|---|---|---|
| https://www.exploit-db.com/exploits/40155 | 2024-08-06 | |
| http://packetstormsecurity.com/files/137998/PHP-7.0.8-5.6.23-5.5.37-bzread-OOB-Write.html | 2024-08-06 | |
| http://seclists.org/fulldisclosure/2016/Jul/72 | 2024-08-06 | |
| http://www.openwall.com/lists/oss-security/2016/07/21/1 | 2024-08-06 | |
| https://bugs.php.net/bug.php?id=72613 | 2024-08-06 |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| http://php.net/ChangeLog-5.php | 2023-02-12 | |
| http://php.net/ChangeLog-7.php | 2023-02-12 | |
| http://rhn.redhat.com/errata/RHSA-2016-2598.html | 2023-02-12 | |
| http://rhn.redhat.com/errata/RHSA-2016-2750.html | 2023-02-12 | |
| http://www.debian.org/security/2016/dsa-3631 | 2023-02-12 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1358395 | 2016-11-15 | |
| https://access.redhat.com/security/cve/CVE-2016-5399 | 2016-11-15 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Php Search vendor "Php" | Php Search vendor "Php" for product "Php" | <= 5.5.37 Search vendor "Php" for product "Php" and version " <= 5.5.37" | - |
Affected
| ||||||
| Php Search vendor "Php" | Php Search vendor "Php" for product "Php" | >= 5.6.0 < 5.6.24 Search vendor "Php" for product "Php" and version " >= 5.6.0 < 5.6.24" | - |
Affected
| ||||||
| Php Search vendor "Php" | Php Search vendor "Php" for product "Php" | >= 7.0.0 < 7.0.9 Search vendor "Php" for product "Php" and version " >= 7.0.0 < 7.0.9" | - |
Affected
| ||||||