CVE-2016-10160: Critical severity PHP PHP vulnerability
Fixed bug (Memory corruption when loading hostile phar). (CVE-2016-10160)
Other sources
Off-by-one error in the pharparsepharfile function in ext/phar/phar.c in PHP before 5.6.30 and 7.0.x before 7.0.15 allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a crafted PHAR archive with an alias mismatch.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2016-10160?
CVE-2016-10160 is classified as a high severity vulnerability that can lead to denial of service or potentially arbitrary code execution.
How do I fix CVE-2016-10160?
To fix CVE-2016-10160, upgrade your PHP version to 5.6.30, 7.0.15, or 7.1.1 as recommended.
Which PHP versions are affected by CVE-2016-10160?
CVE-2016-10160 affects PHP versions before 5.6.30 and 7.0.x before 7.0.15.
Can CVE-2016-10160 be exploited remotely?
Yes, CVE-2016-10160 can be exploited remotely using a crafted PHAR archive.
What types of systems are impacted by CVE-2016-10160?
Systems running vulnerable versions of PHP, such as Debian and Red Hat distributions, are impacted by CVE-2016-10160.