CVE-2016-4343: High severity php vulnerability
Fixed bug (Uninitialized pointer in pharmakedirstream()). (CVE-2016-4343)
Other sources
The pharmakedirstream function in ext/phar/dirstream.c in PHP before 5.6.18 and 7.x before 7.0.3 mishandles zero-size ././@LongLink files, which allows remote attackers to cause a denial of service (uninitialized pointer dereference) or possibly have unspecified other impact via a crafted TAR archive.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the vulnerability ID for this bug?
The vulnerability ID for this bug is CVE-2016-4343.
What is the severity of CVE-2016-4343?
The severity of CVE-2016-4343 is high with a severity value of 8.8.
What software versions are affected by CVE-2016-4343?
Versions of PHP before 5.6.18 and 7.x before 7.0.3 are affected by CVE-2016-4343.
How can remote attackers exploit CVE-2016-4343?
Remote attackers can exploit CVE-2016-4343 by crafting a TAR archive file with zero-size ././@LongLink files.
Where can I find more information about CVE-2016-4343?
You can find more information about CVE-2016-4343 in the PHP.net ChangeLog-7.php and the Openwall OSS Security mailing list.