CVE-2016-2554

Critical

Published: 16/05/2016(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

A stack-based buffer overflow in ext/phar/tar.c in PHP before 5.5.32, 5.6.x before 5.6.18, and 7.x before 7.0.3 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted TAR archive.

Risk Assessment

This vulnerability can lead to application crashes, affecting service availability within the organization. There is also a risk of unspecified impacts that may threaten system security.

Recommendation

It is recommended to upgrade PHP to version 5.5.32, 5.6.18, or 7.0.3 or later to mitigate this vulnerability.

Original NVD description (English source)

Stack-based buffer overflow in ext/phar/tar.c in PHP before 5.5.32, 5.6.x before 5.6.18, and 7.x before 7.0.3 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted TAR archive.