CVE-2016-7414

Critical

Published: 17/09/2016(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

The ZIP signature-verification feature in PHP before 5.6.26 and 7.x before 7.0.11 does not ensure that the uncompressed_filesize field is large enough, allowing remote attackers to cause a denial of service (out-of-bounds memory access) or possibly have unspecified other impact via a crafted PHAR archive.

Risk Assessment

Attackers may exploit this vulnerability to perform denial of service attacks, potentially leading to downtime of applications or systems.

Recommendation

It is recommended to upgrade PHP to version 5.6.26 or 7.0.11 and later to mitigate the risks associated with this vulnerability.

Original NVD description (English source)

The ZIP signature-verification feature in PHP before 5.6.26 and 7.x before 7.0.11 does not ensure that the uncompressed_filesize field is large enough, which allows remote attackers to cause a denial of service (out-of-bounds memory access) or possibly have unspecified other impact via a crafted PHAR archive, related to ext/phar/util.c and ext/phar/zip.c.