CVE-2016-7414: Buffer Overflow
An out-of-bounds heap read was found in pharparsezipfile due to not checking entry.uncompressedfilesize.
Upstream bug:
https://bugs.php.net/bug.php?id=72928
Upstream patch:
https://github.com/php/php-src/commit/0bfb970f43acd1e81d11be1154805f86655f15d5?w=1
CVE assignment:
http://seclists.org/oss-sec/2016/q3/518
Other sources
Fixed bug (Out of bound when verify signature of zip phar in pharparsezipfile). (CVE-2016-7414)
— PHP
The ZIP signature-verification feature in PHP before 5.6.26 and 7.x before 7.0.11 does not ensure that the uncompressedfilesize field is large enough, which allows remote attackers to cause a denial of service (out-of-bounds memory access) or possibly have unspecified other impact via a crafted PHAR archive, related to ext/phar/util.c and ext/phar/zip.c.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2016-7414?
CVE-2016-7414 is classified as a denial of service vulnerability due to out-of-bounds memory access.
How do I fix CVE-2016-7414?
To fix CVE-2016-7414, upgrade PHP to versions 5.6.26 or 7.0.11 or later.
What versions are affected by CVE-2016-7414?
CVE-2016-7414 affects PHP versions prior to 5.6.26 and versions 7.x before 7.0.11.
Can CVE-2016-7414 lead to data loss?
CVE-2016-7414 is primarily a denial of service issue and does not directly lead to data loss, but it may disrupt service availability.
Is CVE-2016-7414 being actively exploited?
While specific exploitation details for CVE-2016-7414 are not widely reported, it's advisable to patch vulnerable versions as a precaution.