Every CVESearch/Get API key

CVE-2016-3132

Double free vulnerability in the SplDoublyLinkedList::offsetSet function in ext/spl/spl_dllist.c...

9.8 CriticalFix available

CVE-2016-3132 is a critical vulnerability (CVSS 9.8) in Php, published May 6, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 11.7%, the 96th percentile. Fixed in php7.0 7.0.4-7ubuntu2.1.

What does this mean?
Severity
9.8 CriticalCVSS 3.0, NVD
Exploit chance
11.7%EPSS, 96th percentile
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
7.0.4-7ubuntu2.1php7.0 +2 more

Description

Double free vulnerability in the SplDoublyLinkedList::offsetSet function in ext/spl/spl_dllist.c in PHP 7.x before 7.0.6 allows remote attackers to execute arbitrary code via a crafted index.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

11.7%Up 5.9 points since Feb 4, 2022
90%50%10%1%

Affected products

Affected packages

Affected packages
PackageAffectedFixed
php7.0
Ubuntu:16.04:LTS
before 7.0.4-7ubuntu2.1, plus listed versions
7.0.1-57.0.1-67.0.2-17.0.2-37.0.2-4
Show 8 moreShow less
7.0.2-57.0.3-27.0.3-37.0.3-9ubuntu17.0.4-5ubuntu17.0.4-5ubuntu27.0.4-7ubuntu17.0.4-7ubuntu2
7.0.4-7ubuntu2.1
php5
Ubuntu:14.04:LTS
From an advisory covering 17 CVEs
before 5.5.9+dfsg-1ubuntu4.17, plus listed versions
5.5.3+dfsg-1ubuntu25.5.3+dfsg-1ubuntu35.5.6+dfsg-1ubuntu15.5.6+dfsg-1ubuntu25.5.8+dfsg-2ubuntu1
Show 17 moreShow less
5.5.9+dfsg-1ubuntu15.5.9+dfsg-1ubuntu25.5.9+dfsg-1ubuntu35.5.9+dfsg-1ubuntu45.5.9+dfsg-1ubuntu4.15.5.9+dfsg-1ubuntu4.25.5.9+dfsg-1ubuntu4.35.5.9+dfsg-1ubuntu4.45.5.9+dfsg-1ubuntu4.55.5.9+dfsg-1ubuntu4.65.5.9+dfsg-1ubuntu4.75.5.9+dfsg-1ubuntu4.95.5.9+dfsg-1ubuntu4.115.5.9+dfsg-1ubuntu4.125.5.9+dfsg-1ubuntu4.135.5.9+dfsg-1ubuntu4.145.5.9+dfsg-1ubuntu4.16
5.5.9+dfsg-1ubuntu4.17
php7.0
Ubuntu:16.04:LTS
From an advisory covering 17 CVEs
before 7.0.4-7ubuntu2.1, plus listed versions
7.0.1-57.0.1-67.0.2-17.0.2-37.0.2-4
Show 8 moreShow less
7.0.2-57.0.3-27.0.3-37.0.3-9ubuntu17.0.4-5ubuntu17.0.4-5ubuntu27.0.4-7ubuntu17.0.4-7ubuntu2
7.0.4-7ubuntu2.1

What each source reports

NVD Score used9.8

Double free vulnerability in the SplDoublyLinkedList::offsetSet function in ext/spl/spl_dllist.c in PHP 7.x before 7.0.6 allows remote attackers to execute arbitrary code via a crafted index.

Record
CVE-2016-3132
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-415
Updated
2026-11-02
CVE ListNo score

Double free vulnerability in the SplDoublyLinkedList::offsetSet function in ext/spl/spl_dllist.c in PHP 7.x before 7.0.6 allows remote attackers to execute arbitrary code via a crafted index.

Record
CVE-2016-3132
Updated
2026-11-02
EUVDEUVD-2016-4184No score

Double free vulnerability in the SplDoublyLinkedList::offsetSet function in ext/spl/spl_dllist.c in PHP 7.x before 7.0.6 allows remote attackers to execute arbitrary code via a crafted index.

Record
EUVD-2016-4184
Updated
2026-11-03
GitHub AdvisoriesGHSA-rpq8-3f5m-jp4r9.8

Double free vulnerability in the SplDoublyLinkedList::offsetSet function in ext/spl/spl_dllist.c...

Double free vulnerability in the SplDoublyLinkedList::offsetSet function in ext/spl/spl_dllist.c in PHP 7.x before 7.0.6 allows remote attackers to execute arbitrary code via a crafted index.

Record
GHSA-rpq8-3f5m-jp4r
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-415
Updated
2026-11-02
OSV9.8

Double free vulnerability in the SplDoublyLinkedList::offsetSet function in ext/spl/spl_dllist.c in PHP 7.x before 7.0.6 allows remote attackers to execute arbitrary code via a crafted index.

Record
CVE-2016-3132
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2016-31329.8

Double free vulnerability in the SplDoublyLinkedList::offsetSet function in ext/spl/spl_dllist.c in PHP 7.x before 7.0.6 allows remote attackers to execute arbitrary code via a crafted index.

Record
UBUNTU-CVE-2016-3132
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUSN-2984-1No score

php5, php7.0 vulnerabilities

It was discovered that the PHP Fileinfo component incorrectly handled certain magic files. An attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 16.04 LTS. (CVE-2015-8865)

Hans Jerry Illikainen discovered that the PHP Zip extension incorrectly handled certain malformed Zip archives. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 16.04 LTS. (CVE-2016-3078)

It was discovered that PHP incorrectly handled invalid indexes in the SplDoublyLinkedList class. An attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 16.04 LTS. (CVE-2016-3132)

It was discovered that the PHP rawurlencode() function incorrectly handled large strings. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service. This issue only affected Ubuntu 16.04 LTS. (CVE-2016-4070)

It was discovered that the PHP php_snmp_error() function incorrectly handled string formatting. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 16.04 LTS. (CVE-2016-4071)

It was discovered that the PHP phar extension incorrectly handled certain filenames in archives. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 16.04 LTS. (CVE-2016-4072)

It was discovered that the PHP mb_strcut() function incorrectly handled string formatting. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 16.04 LTS. (CVE-2016-4073)

It was discovered that the PHP phar extension incorrectly handled certain archive files. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 12.04 LTS, Ubuntu 14.04 LTS and Ubuntu 15.10. (CVE-2016-4342, CVE-2016-4343)

It was discovered that the PHP bcpowmod() function incorrectly handled memory. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2016-4537, CVE-2016-4538)

It was discovered that the PHP XML parser incorrectly handled certain malformed XML data. A remote attacker could possibly use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2016-4539)

It was discovered that certain PHP grapheme functions incorrectly handled negative offsets. A remote attacker could possibly use this issue to cause PHP to crash, resulting in a denial of service. (CVE-2016-4540, CVE-2016-4541)

It was discovered that PHP incorrectly handled certain malformed EXIF tags. A remote attacker could possibly use this issue to cause PHP to crash, resulting in a denial of service. (CVE-2016-4542, CVE-2016-4543, CVE-2016-4544)

Record
USN-2984-1
Updated
2026-11-02

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 20 moreShow less
PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open