Every CVESearch/Get API key

CVE-2016-4343

The phar_make_dirstream function in ext/phar/dirstream.c in PHP before 5.6.18 and 7.x before 7.0...

8.8 HighFix available

CVE-2016-4343 is a high vulnerability (CVSS 8.8) in Php, published April 29, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.19%, the 91st percentile. Fixed in php5 5.5.9+dfsg-1ubuntu4.17.

What does this mean?
Severity
8.8 HighCVSS 3.1, NVD
Exploit chance
4.19%EPSS, 91st percentile
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
5.5.9+dfsg-1ubuntu4.17php5 +96 more

Description

The phar_make_dirstream function in ext/phar/dirstream.c in PHP before 5.6.18 and 7.x before 7.0.3 mishandles zero-size ././@LongLink files, which allows remote attackers to cause a denial of service (uninitialized pointer dereference) or possibly have unspecified other impact via a crafted TAR archive.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

4.19%Up 2.2 points since Feb 4, 2022
90%50%10%1%

Affected products

Affected packages

Affected packages
PackageAffectedFixed
php
TuxCare:CentOS:6
From an advisory covering 70 CVEs
before 5.3.3-51.el6.cloudlinux
5.3.3-51.el6.cloudlinux
php-bcmath
TuxCare:CentOS:6
From an advisory covering 70 CVEs
before 5.3.3-51.el6.cloudlinux
5.3.3-51.el6.cloudlinux
php-cli
TuxCare:CentOS:6
From an advisory covering 70 CVEs
before 5.3.3-51.el6.cloudlinux
5.3.3-51.el6.cloudlinux
php-common
TuxCare:CentOS:6
From an advisory covering 70 CVEs
before 5.3.3-51.el6.cloudlinux
5.3.3-51.el6.cloudlinux
php-dba
TuxCare:CentOS:6
From an advisory covering 70 CVEs
before 5.3.3-51.el6.cloudlinux
5.3.3-51.el6.cloudlinux
php-devel
TuxCare:CentOS:6
From an advisory covering 70 CVEs
before 5.3.3-51.el6.cloudlinux
5.3.3-51.el6.cloudlinux
php-embedded
TuxCare:CentOS:6
From an advisory covering 70 CVEs
before 5.3.3-51.el6.cloudlinux
5.3.3-51.el6.cloudlinux
php-enchant
TuxCare:CentOS:6
From an advisory covering 70 CVEs
before 5.3.3-51.el6.cloudlinux
5.3.3-51.el6.cloudlinux
php-fpm
TuxCare:CentOS:6
From an advisory covering 70 CVEs
before 5.3.3-51.el6.cloudlinux
5.3.3-51.el6.cloudlinux
php-gd
TuxCare:CentOS:6
From an advisory covering 70 CVEs
before 5.3.3-51.el6.cloudlinux
5.3.3-51.el6.cloudlinux
Show 87 moreShow less
Affected packages
PackageAffectedFixed
php-imap
TuxCare:CentOS:6
From an advisory covering 70 CVEs
before 5.3.3-51.el6.cloudlinux
5.3.3-51.el6.cloudlinux
php-intl
TuxCare:CentOS:6
From an advisory covering 70 CVEs
before 5.3.3-51.el6.cloudlinux
5.3.3-51.el6.cloudlinux
php-ldap
TuxCare:CentOS:6
From an advisory covering 70 CVEs
before 5.3.3-51.el6.cloudlinux
5.3.3-51.el6.cloudlinux
php-mbstring
TuxCare:CentOS:6
From an advisory covering 70 CVEs
before 5.3.3-51.el6.cloudlinux
5.3.3-51.el6.cloudlinux
php-mysql
TuxCare:CentOS:6
From an advisory covering 70 CVEs
before 5.3.3-51.el6.cloudlinux
5.3.3-51.el6.cloudlinux
php-odbc
TuxCare:CentOS:6
From an advisory covering 70 CVEs
before 5.3.3-51.el6.cloudlinux
5.3.3-51.el6.cloudlinux
php-pdo
TuxCare:CentOS:6
From an advisory covering 70 CVEs
before 5.3.3-51.el6.cloudlinux
5.3.3-51.el6.cloudlinux
php-pgsql
TuxCare:CentOS:6
From an advisory covering 70 CVEs
before 5.3.3-51.el6.cloudlinux
5.3.3-51.el6.cloudlinux
php-process
TuxCare:CentOS:6
From an advisory covering 70 CVEs
before 5.3.3-51.el6.cloudlinux
5.3.3-51.el6.cloudlinux
php-pspell
TuxCare:CentOS:6
From an advisory covering 70 CVEs
before 5.3.3-51.el6.cloudlinux
5.3.3-51.el6.cloudlinux
php-recode
TuxCare:CentOS:6
From an advisory covering 70 CVEs
before 5.3.3-51.el6.cloudlinux
5.3.3-51.el6.cloudlinux
php-snmp
TuxCare:CentOS:6
From an advisory covering 70 CVEs
before 5.3.3-51.el6.cloudlinux
5.3.3-51.el6.cloudlinux
php-soap
TuxCare:CentOS:6
From an advisory covering 70 CVEs
before 5.3.3-51.el6.cloudlinux
5.3.3-51.el6.cloudlinux
php-tidy
TuxCare:CentOS:6
From an advisory covering 70 CVEs
before 5.3.3-51.el6.cloudlinux
5.3.3-51.el6.cloudlinux
php-xml
TuxCare:CentOS:6
From an advisory covering 70 CVEs
before 5.3.3-51.el6.cloudlinux
5.3.3-51.el6.cloudlinux
php-xmlrpc
TuxCare:CentOS:6
From an advisory covering 70 CVEs
before 5.3.3-51.el6.cloudlinux
5.3.3-51.el6.cloudlinux
php-zts
TuxCare:CentOS:6
From an advisory covering 70 CVEs
before 5.3.3-51.el6.cloudlinux
5.3.3-51.el6.cloudlinux
php5
Debian:7
From an advisory covering 16 CVEs
before 5.4.45-0+deb7u3, plus listed versions
5.4.11-15.4.15-15.4.34-0+deb7u15.4.35-0+deb7u15.4.35-0+deb7u2
Show 32 moreShow less
5.4.36-0+deb7u15.4.36-0+deb7u35.4.38-0+deb7u15.4.39-0+deb7u15.4.39-0+deb7u25.4.4-145.4.4-14+deb7u15.4.4-14+deb7u105.4.4-14+deb7u115.4.4-14+deb7u125.4.4-14+deb7u135.4.4-14+deb7u145.4.4-14+deb7u25.4.4-14+deb7u35.4.4-14+deb7u45.4.4-14+deb7u55.4.4-14+deb7u75.4.4-14+deb7u85.4.4-14+deb7u95.4.4-155.4.4-15.15.4.41-0+deb7u15.4.44-0+deb7u15.4.45-0+deb7u15.4.45-0+deb7u25.4.6-15.4.6-25.4.8-15.4.9-15.4.9-25.4.9-35.4.9-4
5.4.45-0+deb7u3
rh-php56
Red Hat:rhel_software_collections:2::el6
From an advisory covering 80 CVEs
before 0:2.3-1.el6
0:2.3-1.el6
rh-php56-php
Red Hat:rhel_software_collections:2::el6
From an advisory covering 80 CVEs
before 0:5.6.25-1.el6
0:5.6.25-1.el6
rh-php56-php-bcmath
Red Hat:rhel_software_collections:2::el6
From an advisory covering 80 CVEs
before 0:5.6.25-1.el6
0:5.6.25-1.el6
rh-php56-php-cli
Red Hat:rhel_software_collections:2::el6
From an advisory covering 80 CVEs
before 0:5.6.25-1.el6
0:5.6.25-1.el6
rh-php56-php-common
Red Hat:rhel_software_collections:2::el6
From an advisory covering 80 CVEs
before 0:5.6.25-1.el6
0:5.6.25-1.el6
rh-php56-php-dba
Red Hat:rhel_software_collections:2::el6
From an advisory covering 80 CVEs
before 0:5.6.25-1.el6
0:5.6.25-1.el6
rh-php56-php-dbg
Red Hat:rhel_software_collections:2::el6
From an advisory covering 80 CVEs
before 0:5.6.25-1.el6
0:5.6.25-1.el6
rh-php56-php-debuginfo
Red Hat:rhel_software_collections:2::el6
From an advisory covering 80 CVEs
before 0:5.6.25-1.el6
0:5.6.25-1.el6
rh-php56-php-devel
Red Hat:rhel_software_collections:2::el6
From an advisory covering 80 CVEs
before 0:5.6.25-1.el6
0:5.6.25-1.el6
rh-php56-php-embedded
Red Hat:rhel_software_collections:2::el6
From an advisory covering 80 CVEs
before 0:5.6.25-1.el6
0:5.6.25-1.el6
rh-php56-php-enchant
Red Hat:rhel_software_collections:2::el6
From an advisory covering 80 CVEs
before 0:5.6.25-1.el6
0:5.6.25-1.el6
rh-php56-php-fpm
Red Hat:rhel_software_collections:2::el6
From an advisory covering 80 CVEs
before 0:5.6.25-1.el6
0:5.6.25-1.el6
rh-php56-php-gd
Red Hat:rhel_software_collections:2::el6
From an advisory covering 80 CVEs
before 0:5.6.25-1.el6
0:5.6.25-1.el6
rh-php56-php-gmp
Red Hat:rhel_software_collections:2::el6
From an advisory covering 80 CVEs
before 0:5.6.25-1.el6
0:5.6.25-1.el6
rh-php56-php-imap
Red Hat:rhel_software_collections:2::el6
From an advisory covering 80 CVEs
before 0:5.6.25-1.el6
0:5.6.25-1.el6
rh-php56-php-intl
Red Hat:rhel_software_collections:2::el6
From an advisory covering 80 CVEs
before 0:5.6.25-1.el6
0:5.6.25-1.el6
rh-php56-php-ldap
Red Hat:rhel_software_collections:2::el6
From an advisory covering 80 CVEs
before 0:5.6.25-1.el6
0:5.6.25-1.el6
rh-php56-php-mbstring
Red Hat:rhel_software_collections:2::el6
From an advisory covering 80 CVEs
before 0:5.6.25-1.el6
0:5.6.25-1.el6
rh-php56-php-mysqlnd
Red Hat:rhel_software_collections:2::el6
From an advisory covering 80 CVEs
before 0:5.6.25-1.el6
0:5.6.25-1.el6
rh-php56-php-odbc
Red Hat:rhel_software_collections:2::el6
From an advisory covering 80 CVEs
before 0:5.6.25-1.el6
0:5.6.25-1.el6
rh-php56-php-opcache
Red Hat:rhel_software_collections:2::el6
From an advisory covering 80 CVEs
before 0:5.6.25-1.el6
0:5.6.25-1.el6
rh-php56-php-pdo
Red Hat:rhel_software_collections:2::el6
From an advisory covering 80 CVEs
before 0:5.6.25-1.el6
0:5.6.25-1.el6
rh-php56-php-pear
Red Hat:rhel_software_collections:2::el6
From an advisory covering 80 CVEs
before 1:1.9.5-4.el6
1:1.9.5-4.el6
rh-php56-php-pgsql
Red Hat:rhel_software_collections:2::el6
From an advisory covering 80 CVEs
before 0:5.6.25-1.el6
0:5.6.25-1.el6
rh-php56-php-process
Red Hat:rhel_software_collections:2::el6
From an advisory covering 80 CVEs
before 0:5.6.25-1.el6
0:5.6.25-1.el6
rh-php56-php-pspell
Red Hat:rhel_software_collections:2::el6
From an advisory covering 80 CVEs
before 0:5.6.25-1.el6
0:5.6.25-1.el6
rh-php56-php-recode
Red Hat:rhel_software_collections:2::el6
From an advisory covering 80 CVEs
before 0:5.6.25-1.el6
0:5.6.25-1.el6
rh-php56-php-snmp
Red Hat:rhel_software_collections:2::el6
From an advisory covering 80 CVEs
before 0:5.6.25-1.el6
0:5.6.25-1.el6
rh-php56-php-soap
Red Hat:rhel_software_collections:2::el6
From an advisory covering 80 CVEs
before 0:5.6.25-1.el6
0:5.6.25-1.el6
rh-php56-php-tidy
Red Hat:rhel_software_collections:2::el6
From an advisory covering 80 CVEs
before 0:5.6.25-1.el6
0:5.6.25-1.el6
rh-php56-php-xml
Red Hat:rhel_software_collections:2::el6
From an advisory covering 80 CVEs
before 0:5.6.25-1.el6
0:5.6.25-1.el6
rh-php56-php-xmlrpc
Red Hat:rhel_software_collections:2::el6
From an advisory covering 80 CVEs
before 0:5.6.25-1.el6
0:5.6.25-1.el6
rh-php56-runtime
Red Hat:rhel_software_collections:2::el6
From an advisory covering 80 CVEs
before 0:2.3-1.el6
0:2.3-1.el6
rh-php56-scldevel
Red Hat:rhel_software_collections:2::el6
From an advisory covering 80 CVEs
before 0:2.3-1.el6
0:2.3-1.el6
rh-php56
Red Hat:rhel_software_collections:2::el7
From an advisory covering 80 CVEs
before 0:2.3-1.el7
0:2.3-1.el7
rh-php56-php
Red Hat:rhel_software_collections:2::el7
From an advisory covering 80 CVEs
before 0:5.6.25-1.el7
0:5.6.25-1.el7
rh-php56-php-bcmath
Red Hat:rhel_software_collections:2::el7
From an advisory covering 80 CVEs
before 0:5.6.25-1.el7
0:5.6.25-1.el7
rh-php56-php-cli
Red Hat:rhel_software_collections:2::el7
From an advisory covering 80 CVEs
before 0:5.6.25-1.el7
0:5.6.25-1.el7
rh-php56-php-common
Red Hat:rhel_software_collections:2::el7
From an advisory covering 80 CVEs
before 0:5.6.25-1.el7
0:5.6.25-1.el7
rh-php56-php-dba
Red Hat:rhel_software_collections:2::el7
From an advisory covering 80 CVEs
before 0:5.6.25-1.el7
0:5.6.25-1.el7
rh-php56-php-dbg
Red Hat:rhel_software_collections:2::el7
From an advisory covering 80 CVEs
before 0:5.6.25-1.el7
0:5.6.25-1.el7
rh-php56-php-debuginfo
Red Hat:rhel_software_collections:2::el7
From an advisory covering 80 CVEs
before 0:5.6.25-1.el7
0:5.6.25-1.el7
rh-php56-php-devel
Red Hat:rhel_software_collections:2::el7
From an advisory covering 80 CVEs
before 0:5.6.25-1.el7
0:5.6.25-1.el7
rh-php56-php-embedded
Red Hat:rhel_software_collections:2::el7
From an advisory covering 80 CVEs
before 0:5.6.25-1.el7
0:5.6.25-1.el7
rh-php56-php-enchant
Red Hat:rhel_software_collections:2::el7
From an advisory covering 80 CVEs
before 0:5.6.25-1.el7
0:5.6.25-1.el7
rh-php56-php-fpm
Red Hat:rhel_software_collections:2::el7
From an advisory covering 80 CVEs
before 0:5.6.25-1.el7
0:5.6.25-1.el7
rh-php56-php-gd
Red Hat:rhel_software_collections:2::el7
From an advisory covering 80 CVEs
before 0:5.6.25-1.el7
0:5.6.25-1.el7
rh-php56-php-gmp
Red Hat:rhel_software_collections:2::el7
From an advisory covering 80 CVEs
before 0:5.6.25-1.el7
0:5.6.25-1.el7
rh-php56-php-intl
Red Hat:rhel_software_collections:2::el7
From an advisory covering 80 CVEs
before 0:5.6.25-1.el7
0:5.6.25-1.el7
rh-php56-php-ldap
Red Hat:rhel_software_collections:2::el7
From an advisory covering 80 CVEs
before 0:5.6.25-1.el7
0:5.6.25-1.el7
rh-php56-php-mbstring
Red Hat:rhel_software_collections:2::el7
From an advisory covering 80 CVEs
before 0:5.6.25-1.el7
0:5.6.25-1.el7
rh-php56-php-mysqlnd
Red Hat:rhel_software_collections:2::el7
From an advisory covering 80 CVEs
before 0:5.6.25-1.el7
0:5.6.25-1.el7
rh-php56-php-odbc
Red Hat:rhel_software_collections:2::el7
From an advisory covering 80 CVEs
before 0:5.6.25-1.el7
0:5.6.25-1.el7
rh-php56-php-opcache
Red Hat:rhel_software_collections:2::el7
From an advisory covering 80 CVEs
before 0:5.6.25-1.el7
0:5.6.25-1.el7
rh-php56-php-pdo
Red Hat:rhel_software_collections:2::el7
From an advisory covering 80 CVEs
before 0:5.6.25-1.el7
0:5.6.25-1.el7
rh-php56-php-pear
Red Hat:rhel_software_collections:2::el7
From an advisory covering 80 CVEs
before 1:1.9.5-4.el7
1:1.9.5-4.el7
rh-php56-php-pgsql
Red Hat:rhel_software_collections:2::el7
From an advisory covering 80 CVEs
before 0:5.6.25-1.el7
0:5.6.25-1.el7
rh-php56-php-process
Red Hat:rhel_software_collections:2::el7
From an advisory covering 80 CVEs
before 0:5.6.25-1.el7
0:5.6.25-1.el7
rh-php56-php-pspell
Red Hat:rhel_software_collections:2::el7
From an advisory covering 80 CVEs
before 0:5.6.25-1.el7
0:5.6.25-1.el7
rh-php56-php-recode
Red Hat:rhel_software_collections:2::el7
From an advisory covering 80 CVEs
before 0:5.6.25-1.el7
0:5.6.25-1.el7
rh-php56-php-snmp
Red Hat:rhel_software_collections:2::el7
From an advisory covering 80 CVEs
before 0:5.6.25-1.el7
0:5.6.25-1.el7
rh-php56-php-soap
Red Hat:rhel_software_collections:2::el7
From an advisory covering 80 CVEs
before 0:5.6.25-1.el7
0:5.6.25-1.el7
rh-php56-php-xml
Red Hat:rhel_software_collections:2::el7
From an advisory covering 80 CVEs
before 0:5.6.25-1.el7
0:5.6.25-1.el7
rh-php56-php-xmlrpc
Red Hat:rhel_software_collections:2::el7
From an advisory covering 80 CVEs
before 0:5.6.25-1.el7
0:5.6.25-1.el7
rh-php56-runtime
Red Hat:rhel_software_collections:2::el7
From an advisory covering 80 CVEs
before 0:2.3-1.el7
0:2.3-1.el7
rh-php56-scldevel
Red Hat:rhel_software_collections:2::el7
From an advisory covering 80 CVEs
before 0:2.3-1.el7
0:2.3-1.el7
php5
Ubuntu:14.04:LTS
before 5.5.9+dfsg-1ubuntu4.17, plus listed versions
5.5.3+dfsg-1ubuntu25.5.3+dfsg-1ubuntu35.5.6+dfsg-1ubuntu15.5.6+dfsg-1ubuntu25.5.8+dfsg-2ubuntu1
Show 17 moreShow less
5.5.9+dfsg-1ubuntu15.5.9+dfsg-1ubuntu25.5.9+dfsg-1ubuntu35.5.9+dfsg-1ubuntu45.5.9+dfsg-1ubuntu4.15.5.9+dfsg-1ubuntu4.25.5.9+dfsg-1ubuntu4.35.5.9+dfsg-1ubuntu4.45.5.9+dfsg-1ubuntu4.55.5.9+dfsg-1ubuntu4.65.5.9+dfsg-1ubuntu4.75.5.9+dfsg-1ubuntu4.95.5.9+dfsg-1ubuntu4.115.5.9+dfsg-1ubuntu4.125.5.9+dfsg-1ubuntu4.135.5.9+dfsg-1ubuntu4.145.5.9+dfsg-1ubuntu4.16
5.5.9+dfsg-1ubuntu4.17
php5
Ubuntu:14.04:LTS
From an advisory covering 17 CVEs
before 5.5.9+dfsg-1ubuntu4.17, plus listed versions
5.5.3+dfsg-1ubuntu25.5.3+dfsg-1ubuntu35.5.6+dfsg-1ubuntu15.5.6+dfsg-1ubuntu25.5.8+dfsg-2ubuntu1
Show 17 moreShow less
5.5.9+dfsg-1ubuntu15.5.9+dfsg-1ubuntu25.5.9+dfsg-1ubuntu35.5.9+dfsg-1ubuntu45.5.9+dfsg-1ubuntu4.15.5.9+dfsg-1ubuntu4.25.5.9+dfsg-1ubuntu4.35.5.9+dfsg-1ubuntu4.45.5.9+dfsg-1ubuntu4.55.5.9+dfsg-1ubuntu4.65.5.9+dfsg-1ubuntu4.75.5.9+dfsg-1ubuntu4.95.5.9+dfsg-1ubuntu4.115.5.9+dfsg-1ubuntu4.125.5.9+dfsg-1ubuntu4.135.5.9+dfsg-1ubuntu4.145.5.9+dfsg-1ubuntu4.16
5.5.9+dfsg-1ubuntu4.17
php7.0
Ubuntu:16.04:LTS
From an advisory covering 17 CVEs
before 7.0.4-7ubuntu2.1, plus listed versions
7.0.1-57.0.1-67.0.2-17.0.2-37.0.2-4
Show 8 moreShow less
7.0.2-57.0.3-27.0.3-37.0.3-9ubuntu17.0.4-5ubuntu17.0.4-5ubuntu27.0.4-7ubuntu17.0.4-7ubuntu2
7.0.4-7ubuntu2.1

What each source reports

NVD Score used8.8

The phar_make_dirstream function in ext/phar/dirstream.c in PHP before 5.6.18 and 7.x before 7.0.3 mishandles zero-size ././@LongLink files, which allows remote attackers to cause a denial of service (uninitialized pointer dereference) or possibly have unspecified other impact via a crafted TAR archive.

Record
CVE-2016-4343
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0
6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness
CWE-824
Updated
2026-11-02
CVE ListNo score

The phar_make_dirstream function in ext/phar/dirstream.c in PHP before 5.6.18 and 7.x before 7.0.3 mishandles zero-size ././@LongLink files, which allows remote attackers to cause a denial of service (uninitialized pointer dereference) or possibly have unspecified other impact via a crafted TAR archive.

Record
CVE-2016-4343
Updated
2026-11-02
EUVDEUVD-2016-5343No score

The phar_make_dirstream function in ext/phar/dirstream.c in PHP before 5.6.18 and 7.x before 7.0.3 mishandles zero-size ././@LongLink files, which allows remote attackers to cause a denial of service (uninitialized pointer dereference) or possibly have unspecified other impact via a crafted TAR archive.

Record
EUVD-2016-5343
Updated
2026-11-03
GitHub AdvisoriesGHSA-957h-v895-rv7p8.8

The phar_make_dirstream function in ext/phar/dirstream.c in PHP before 5.6.18 and 7.x before 7.0...

The phar_make_dirstream function in ext/phar/dirstream.c in PHP before 5.6.18 and 7.x before 7.0.3 mishandles zero-size ././@LongLink files, which allows remote attackers to cause a denial of service (uninitialized pointer dereference) or possibly have unspecified other impact via a crafted TAR archive.

Record
GHSA-957h-v895-rv7p
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-824
Updated
2026-11-02
OSV8.8

The phar_make_dirstream function in ext/phar/dirstream.c in PHP before 5.6.18 and 7.x before 7.0.3 mishandles zero-size ././@LongLink files, which allows remote attackers to cause a denial of service (uninitialized pointer dereference) or possibly have unspecified other impact via a crafted TAR archive.

Record
CVE-2016-4343
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2016:27508.1

Red Hat Security Advisory: rh-php56 security, bug fix, and enhancement update

Record
RHSA-2016:2750
CVSS 3.0
8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-13
OSVUBUNTU-CVE-2016-43438.8

The phar_make_dirstream function in ext/phar/dirstream.c in PHP before 5.6.18 and 7.x before 7.0.3 mishandles zero-size ././@LongLink files, which allows remote attackers to cause a denial of service (uninitialized pointer dereference) or possibly have unspecified other impact via a crafted TAR archive.

Record
UBUNTU-CVE-2016-4343
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVCLSA-2020-1605798462No score

Fix of 227 CVE

  • Fix bug #69720: Null pointer dereference in phar_get_fp_offset()
  • Fix bug #70728: Type Confusion Vulnerability in PHP_to_XMLRPC_worker()
  • Fix bug #70661: Use After Free Vulnerability in WDDX Packet Deserialization
  • Fix bug #70741: Session WDDX Packet Deserialization Type Confusion Vulnerability
  • Fix bug #71459: Integer overflow in iptcembed()
  • Fix bug #71039: exec functions ignore length but look for NULL termination
  • Fix bug #71354: Heap corruption in tar/zip/phar parser.
  • Fix bug #71391: NULL Pointer Dereference in phar_tar_setupmetadata()
  • Fix bug #71323: Output of stream_get_meta_data can be falsified by its input
  • Fix bug #71498: Out-of-Bound Read in phar_parse_zipfile()
  • Fix bug #71587: Use-After-Free / Double-Free in WDDX Deserialize
  • Fix bug #71860: Invalid memory write in phar on filename with \0 in name
  • Fix bug #71798: Integer Overflow in php_raw_url_encode
  • Fix bug #72837: integer overflow in bzdecompress caused heap corruption
  • Fix bug #72681: PHP Session Data Injection Vulnerability
  • Fix bug #72807: integer overflow in curl_escape caused heap corruption
  • Fix bug #72838: Integer overflow lead to heap corruption in sql_regcase
  • Fix bug #72697: select_colors write out-of-bounds
  • Fix bug #72730: imagegammacorrect allows arbitrary write access
  • Fix bug #72836: integer overflow in base64_decode caused heap corruption
  • Fix bug #72848: integer overflow in quoted_printable_encode caused heap corruption
  • Fix bug #72849: integer overflow in urlencode caused heap corruption
  • Fix bug #72850: integer overflow in php_uuencode caused heap corruption
  • Fix bug #72771: ftps:// wrapper is vulnerable to protocol downgrade attack
  • Fix bug #72749: wddx_deserialize allows illegal memory access
  • Fix bug #72750: wddx_deserialize null dereference
  • Fix bug #72790: wddx_deserialize null dereference with invalid xml
  • Fix bug #72799: wddx_deserialize null dereference in php_wddx_pop_element
  • Fix bug #73189: Memcpy negative size parameter php_resolve_path
  • Fix bug #73150: missing NULL check in dom_document_save_html
  • Fix bug #73284: heap overflow in php_ereg_replace function
  • Fix bug #73218: stack-buffer-overflow through "ResourceBundle" methods
  • Fix bug #73208: integer overflow in imap_8bit caused heap corruption
  • Fix bug #73082: string length overflow in mb_encode_* function
  • Fix bug #73174: heap overflow in php_pcre_replace_impl
  • Fix bug #73276: crash in openssl_random_pseudo_bytes function
  • Fix bug #73275: crash in openssl_encrypt function
  • Fix bug #73017: memory corruption in wordwrap function
  • Fix bug #73240: Write out of bounds at number_format
  • Fix bug #73073: CachingIterator null dereference when convert to string
  • Fix bug #73293: NULL pointer dereference in SimpleXMLElement::asXML()
  • Fix bug #73356: crash in bzcompress function
  • Fix bug #72696: imagefilltoborder stackoverflow on truecolor images
  • Fix bug #73418: Integer Overflow in "_php_imap_mail" leads Heap Overflow
  • Fix bug #73144: Use-after-free in ArrayObject Deserialization
  • Fix bug #73192: parse_url return wrong hostname
  • Fix bug #73331: NULL Pointer Dereference in WDDX Packet Deserialization with PDORow
  • Fix bug #73452: Segfault (Regression for #69152)
  • Fix bug #73631: Invalid read when wddx decodes empty boolean element
  • Fix bug #67587: Redirection loop on nginx with FPM
  • Fix bug #71465: PHAR doesn't know about litespeed
  • Fix bug #73737: FPE when parsing a tag format
  • Fix bug #73868: Fix DOS vulnerability in gdImageCreateFromGd2Ctx()
  • Fix bug #73869: Signed Integer Overflow gd_io.c
  • Fix bug #73773: Seg fault when loading hostile phar
  • Fix bug #70436: Use After Free Vulnerability in unserialize()
  • Fix bug #74603: PHP INI Parsing Stack Buffer Overflow Vulnerability
  • Fix bug #72535: arcfour encryption stream filter crashes php
  • Fix bug #72434: ZipArchive class Use After Free Vulnerability in PHP's GC algorithm and unseria
  • Fix bug #72455: Heap Overflow due to integer overflows
  • Fix bug #74782:…
Record
CLSA-2020-1605798462
Updated
2026-11-02
OSVUSN-2984-1No score

php5, php7.0 vulnerabilities

It was discovered that the PHP Fileinfo component incorrectly handled certain magic files. An attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 16.04 LTS. (CVE-2015-8865)

Hans Jerry Illikainen discovered that the PHP Zip extension incorrectly handled certain malformed Zip archives. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 16.04 LTS. (CVE-2016-3078)

It was discovered that PHP incorrectly handled invalid indexes in the SplDoublyLinkedList class. An attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 16.04 LTS. (CVE-2016-3132)

It was discovered that the PHP rawurlencode() function incorrectly handled large strings. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service. This issue only affected Ubuntu 16.04 LTS. (CVE-2016-4070)

It was discovered that the PHP php_snmp_error() function incorrectly handled string formatting. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 16.04 LTS. (CVE-2016-4071)

It was discovered that the PHP phar extension incorrectly handled certain filenames in archives. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 16.04 LTS. (CVE-2016-4072)

It was discovered that the PHP mb_strcut() function incorrectly handled string formatting. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 16.04 LTS. (CVE-2016-4073)

It was discovered that the PHP phar extension incorrectly handled certain archive files. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 12.04 LTS, Ubuntu 14.04 LTS and Ubuntu 15.10. (CVE-2016-4342, CVE-2016-4343)

It was discovered that the PHP bcpowmod() function incorrectly handled memory. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2016-4537, CVE-2016-4538)

It was discovered that the PHP XML parser incorrectly handled certain malformed XML data. A remote attacker could possibly use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2016-4539)

It was discovered that certain PHP grapheme functions incorrectly handled negative offsets. A remote attacker could possibly use this issue to cause PHP to crash, resulting in a denial of service. (CVE-2016-4540, CVE-2016-4541)

It was discovered that PHP incorrectly handled certain malformed EXIF tags. A remote attacker could possibly use this issue to cause PHP to crash, resulting in a denial of service. (CVE-2016-4542, CVE-2016-4543, CVE-2016-4544)

Record
USN-2984-1
Updated
2026-11-02

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 146 references and the rest of 1 source description. The JSON record has them.

PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open