CVE-2016-10160

Critical

Published: 24/01/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

Off-by-one error in the phar_parse_pharfile function in PHP before 5.6.30 and 7.0.x before 7.0.15 allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a crafted PHAR archive with an alias mismatch.

Risk Assessment

Organizations may be exposed to attacks that lead to memory corruption or unauthorized code execution, potentially resulting in data loss or system compromise.

Recommendation

It is recommended to upgrade PHP to version 5.6.30 or 7.0.15 and later to mitigate this vulnerability.

Original NVD description (English source)

Off-by-one error in the phar_parse_pharfile function in ext/phar/phar.c in PHP before 5.6.30 and 7.0.x before 7.0.15 allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a crafted PHAR archive with an alias mismatch.