CVE-2016-4342: Buffer Overflow
A heap corruption vulnerability when parsing tar/zip/phar file with empty content.
Upstream bug:
https://bugs.php.net/bug.php?id=71354
Upstream patch:
https://git.php.net/?p=php-src.git;a=commitdiff;h=13ad4d3e971807f9a58ab5933182907dc2958539
Other sources
ext/phar/pharobject.c in PHP before 5.5.32, 5.6.x before 5.6.18, and 7.x before 7.0.3 mishandles zero-length uncompressed data, which allows remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact via a crafted (1) TAR, (2) ZIP, or (3) PHAR archive.
— Launchpad
Fixed bug (Heap corruption in tar/zip/phar parser). (CVE-2016-4342)
— PHP
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2016-4342?
CVE-2016-4342 is a vulnerability in PHP that allows remote attackers to cause a denial of service or possibly have other unspecified impact via a crafted TAR, ZIP, or PHAR file.
How does CVE-2016-4342 affect PHP?
CVE-2016-4342 affects PHP versions before 5.5.32, 5.6.x before 5.6.18, and 7.x before 7.0.3.
What is the severity of CVE-2016-4342?
CVE-2016-4342 has a severity score of 8.8 (high).
How do I fix CVE-2016-4342 in PHP?
To fix CVE-2016-4342 in PHP, make sure you are using PHP version 5.5.32, 5.6.18, or 7.0.3 or later.
Where can I find more information about CVE-2016-4342?
You can find more information about CVE-2016-4342 at the PHP website (https://www.php.net/ChangeLog-7.php#7.0.3) and through the Openwall mailing list (http://www.openwall.com/lists/oss-security/2016/04/28/2).