CVE-2016-6297: Buffer Overflow

Q: What is the severity of CVE-2016-6297?

CVE-2016-6297 is rated as a high severity vulnerability, allowing for denial of service and potential exploitation through crafted zip URLs.

Q: How do I fix CVE-2016-6297?

To fix CVE-2016-6297, upgrade PHP to at least version 5.5.38, 5.6.24, or 7.0.9.

Q: What causes the CVE-2016-6297 vulnerability?

The CVE-2016-6297 vulnerability is caused by an integer overflow in the php_stream_zip_opener function within the zip extension of PHP.

Q: Which versions of PHP are affected by CVE-2016-6297?

CVE-2016-6297 affects PHP versions before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9.

Q: What are the potential impacts of CVE-2016-6297?

The potential impacts of CVE-2016-6297 include stack-based buffer overflow leading to denial of service or other unspecified impacts.

Published Jul 25, 2016

Updated

Integer overflow in the phpstreamzipopener function in ext/zip/zipstream.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 allows remote attackers to cause a denial of service (stack-based buffer overflow) or possibly have unspecified other impact via a crafted zip:// URL.

Other sources

Fixed bug (Stack-based buffer overflow vulnerability in phpstreamzipopener). (CVE-2016-6297)

— PHP

Affected Software

43 affected componentsFixes available

PHP PHP<=5.5.37

PHP PHP=5.6.0-alpha1

PHP PHP=5.6.0-alpha2

PHP PHP=5.6.0-alpha3

PHP PHP=5.6.0-alpha4

PHP PHP=5.6.0-alpha5

PHP PHP=5.6.0-beta1

PHP PHP=5.6.0-beta2

PHP PHP=5.6.0-beta3

PHP PHP=5.6.0-beta4

PHP PHP=5.6.1

PHP PHP=5.6.2

PHP PHP=5.6.3

PHP PHP=5.6.4

PHP PHP=5.6.5

PHP PHP=5.6.6

PHP PHP=5.6.7

PHP PHP=5.6.8

PHP PHP=5.6.9

PHP PHP=5.6.10

PHP PHP=5.6.11

PHP PHP=5.6.12

PHP PHP=5.6.13

PHP PHP=5.6.14

PHP PHP=5.6.15

PHP PHP=5.6.16

PHP PHP=5.6.17

PHP PHP=5.6.18

PHP PHP=5.6.19

PHP PHP=5.6.20

PHP PHP=5.6.21

PHP PHP=5.6.22

PHP PHP=5.6.23

PHP PHP=7.0.0

PHP PHP=7.0.1

PHP PHP=7.0.2

PHP PHP=7.0.3

PHP PHP=7.0.4

PHP PHP=7.0.5

PHP PHP=7.0.6

PHP PHP=7.0.7

PHP PHP=7.0.8

PHP PHP<7.0.9

7.0.9

Event History

Jul 25, 2016

CVE Published

via MITRE·02:00 PM

Data Sourced

via MITRE·02:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2016-6297?

CVE-2016-6297 is rated as a high severity vulnerability, allowing for denial of service and potential exploitation through crafted zip URLs.

How do I fix CVE-2016-6297?