Vulnerability Details : CVE-2016-5773
php_zip.c in the zip extension in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8 improperly interacts with the unserialize implementation and garbage collection, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and application crash) via crafted serialized data containing a ZipArchive object.
Vulnerability category: Memory CorruptionExecute codeDenial of service
Threat overview for CVE-2016-5773
Top countries where our scanners detected CVE-2016-5773
Top open port discovered on systems with this issue
80
IPs affected by CVE-2016-5773 149,261
Threat actors abusing to this issue?
Yes
Find out if you* are
affected by CVE-2016-5773!
*Directly or indirectly through your vendors, service providers and 3rd parties.
Powered by
attack surface intelligence
from SecurityScorecard.
Exploit prediction scoring system (EPSS) score for CVE-2016-5773
Probability of exploitation activity in the next 30 days: 6.33%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 93 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2016-5773
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
---|---|---|---|---|---|
7.5
|
HIGH | AV:N/AC:L/Au:N/C:P/I:P/A:P |
10.0
|
6.4
|
NIST |
9.8
|
CRITICAL | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
3.9
|
5.9
|
NIST |
CWE ids for CVE-2016-5773
-
Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code.Assigned by: nvd@nist.gov (Primary)
References for CVE-2016-5773
-
http://www.securityfocus.com/bid/91397
PHP 'ext/zip/php_zip.c' Use After Free Remote Code Execution Vulnerability
-
http://lists.apple.com/archives/security-announce/2016/Sep/msg00006.html
Apple - Lists.apple.com
-
http://github.com/php/php-src/commit/f6aef68089221c5ea047d4a74224ee3deead99a6?w=1
Fix bug #72434: ZipArchive class Use After Free Vulnerability in PHP'… · php/php-src@f6aef68 · GitHub
-
http://www.debian.org/security/2016/dsa-3618
Debian -- Security Information -- DSA-3618-1 php5
-
http://www.openwall.com/lists/oss-security/2016/06/23/4
oss-security - Re: CVE for PHP 5.5.37 issuesRelease Notes
-
http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00004.html
[security-announce] openSUSE-SU-2016:1761-1: important: Security update
-
https://bugs.php.net/bug.php?id=72434
PHP :: Sec Bug #72434 :: ZipArchive class Use After Free Vulnerability in PHP's GC algorithm and unseriaExploit;Vendor Advisory
-
https://support.apple.com/HT207170
About the security content of macOS Sierra 10.12 - Apple Support
-
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05240731
HPSBNS03635 rev.1 - HPE NonStop Servers OSS Script Languages running Perl and PHP, Multiple Local and Remote Vulnerabilities
-
http://rhn.redhat.com/errata/RHSA-2016-2750.html
RHSA-2016:2750 - Security Advisory - Red Hat Customer Portal
-
http://php.net/ChangeLog-7.php
PHP: PHP 7 ChangeLogPatch;Release Notes
-
http://php.net/ChangeLog-5.php
PHP: PHP 5 ChangeLogPatch;Release Notes
Products affected by CVE-2016-5773
- cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.6.0:alpha4:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.6.0:alpha5:*:*:*:*:*:*
- cpe:2.3:a:php:php:7.0.5:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:7.0.6:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.6.0:beta2:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.6.13:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.6.14:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.6.20:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.6.21:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.6.0:alpha2:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.6.0:alpha3:*:*:*:*:*:*
- cpe:2.3:a:php:php:7.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:7.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.6.11:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.6.12:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.6.19:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.6.2:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.6.7:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.6.8:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.6.9:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.6.0:alpha1:*:*:*:*:*:*
- cpe:2.3:a:php:php:7.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:7.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.6.1:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.6.10:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.6.17:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.6.18:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.6.5:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.6.6:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.6.0:beta1:*:*:*:*:*:*
- cpe:2.3:a:php:php:7.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.6.0:beta3:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.6.0:beta4:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.6.15:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.6.16:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.6.3:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.6.4:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.6.23:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:7.0.7:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.6.22:*:*:*:*:*:*:*