CVE-2016-3078
CriticalSummary
Multiple integer overflows in php_zip.c in the zip extension in PHP before 7.0.6 allow remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted call to (1) getFromIndex or (2) getFromName in the ZipArchive class.
Risk Assessment
An attacker could exploit this vulnerability to remotely trigger application crashes, leading to service availability interruptions. It may also result in unspecified other impacts that could affect system integrity.
Recommendation
It is recommended to upgrade PHP to version 7.0.6 or later to mitigate this vulnerability. Additionally, monitoring application logs for potential exploitation attempts is advisable.
Original NVD description (English source)
Multiple integer overflows in php_zip.c in the zip extension in PHP before 7.0.6 allow remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted call to (1) getFromIndex or (2) getFromName in the ZipArchive class.