CVE-2016-3078: Integer Overflow
Published Aug 7, 2016
·Updated
Fixed bug (integer overflow in ZipArchive::getFrom). (CVE-2016-3078)
Other sources
Multiple integer overflows in phpzip.c in the zip extension in PHP before 7.0.6 allow remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted call to (1) getFromIndex or (2) getFromName in the ZipArchive class.
Affected Software
3 affected componentsFixes available
debian/php7.0
PHP PHP>=7.0.0<7.0.6
PHP PHP<7.0.6
7.0.6
Remediation
Event History
Aug 7, 2016
CVE Published
via MITRE·10:00 AM
Data Sourced
via MITRE·10:00 AM
Description
Jan 11, 2024
Data Sourced
via Launchpad·10:17 PM
Description
Sep 20, 2024
Data Sourced
via Ubuntu·01:14 AM
RemedyDescriptionSeverityAffected Software
Frequently Asked Questions
1
What is the vulnerability ID for this bug?
The vulnerability ID for this bug is CVE-2016-3078.
2
What is the severity of CVE-2016-3078?
CVE-2016-3078 has a severity rating of 9.8 (critical).
3
Which software versions are affected by CVE-2016-3078?
The PHP versions before 7.0.6 are affected by CVE-2016-3078.
4
How can CVE-2016-3078 be exploited?
CVE-2016-3078 can be exploited by a crafted call to the getFromIndex or getFromName functions in the ZipArchive class.
5
How can I fix CVE-2016-3078?
To fix CVE-2016-3078, update your PHP installation to version 7.0.6 or later.