CVE-2016-7414: Buffer Overflow

Published Sep 17, 2016
·
Updated

An out-of-bounds heap read was found in pharparsezipfile due to not checking entry.uncompressedfilesize.

Upstream bug:

https://bugs.php.net/bug.php?id=72928

Upstream patch:

https://github.com/php/php-src/commit/0bfb970f43acd1e81d11be1154805f86655f15d5?w=1

CVE assignment:

http://seclists.org/oss-sec/2016/q3/518

Other sources

Fixed bug (Out of bound when verify signature of zip phar in pharparsezipfile). (CVE-2016-7414)

PHP

The ZIP signature-verification feature in PHP before 5.6.26 and 7.x before 7.0.11 does not ensure that the uncompressedfilesize field is large enough, which allows remote attackers to cause a denial of service (out-of-bounds memory access) or possibly have unspecified other impact via a crafted PHAR archive, related to ext/phar/util.c and ext/phar/zip.c.

MITRE

Affected Software

15 affected componentsFixes available
redhat/php<5.6.26
5.6.26
redhat/php<7.0.11
7.0.11
PHP PHP<=5.6.25
PHP PHP=7.0.0
PHP PHP=7.0.1
PHP PHP=7.0.2
PHP PHP=7.0.3
PHP PHP=7.0.4
PHP PHP=7.0.5
PHP PHP=7.0.6
PHP PHP=7.0.7
PHP PHP=7.0.8
PHP PHP=7.0.9
PHP PHP=7.0.10
PHP PHP<7.0.11
7.0.11

Event History

Sep 17, 2016
CVE Published
via MITRE·09:00 PM
Data Sourced
via MITRE·09:00 PM
Description

Frequently Asked Questions

1

What is the severity of CVE-2016-7414?

CVE-2016-7414 is classified as a denial of service vulnerability due to out-of-bounds memory access.

2

How do I fix CVE-2016-7414?

To fix CVE-2016-7414, upgrade PHP to versions 5.6.26 or 7.0.11 or later.

3

What versions are affected by CVE-2016-7414?

CVE-2016-7414 affects PHP versions prior to 5.6.26 and versions 7.x before 7.0.11.

4

Can CVE-2016-7414 lead to data loss?

CVE-2016-7414 is primarily a denial of service issue and does not directly lead to data loss, but it may disrupt service availability.

5

Is CVE-2016-7414 being actively exploited?

While specific exploitation details for CVE-2016-7414 are not widely reported, it's advisable to patch vulnerable versions as a precaution.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203