CVE-2016-5773
CriticalSummary
The zip extension in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8 improperly interacts with the unserialize implementation and garbage collection, allowing remote attackers to execute arbitrary code or cause a denial of service via crafted serialized data containing a ZipArchive object.
Risk Assessment
This vulnerability can lead to remote code execution, posing a serious threat to the security of the application and the organization's data. Additionally, it may cause application crashes, affecting service availability.
Recommendation
It is recommended to update PHP to the latest version that includes fixes for this vulnerability. A code audit of the application should also be conducted to identify potential areas of exploitation.
Original NVD description (English source)
php_zip.c in the zip extension in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8 improperly interacts with the unserialize implementation and garbage collection, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and application crash) via crafted serialized data containing a ZipArchive object.