{"id":"CVE-2016-10158","aliases":["DLA-818-1","DSA-3783-1","EUVD-2016-1346","GHSA-3jf4-pmg8-mhm6","MGASA-2017-0040","RHSA-2018:1296","SUSE-SU-2017:0534-1","SUSE-SU-2017:0556-1","SUSE-SU-2017:0568-1","UBUNTU-CVE-2016-10158","USN-3196-1","USN-3211-1"],"status":"published","title":"The exif_convert_any_to_int function in ext/exif/exif.c in PHP before 5.6.30, 7.0.x before 7.0.15...","description":"The exif_convert_any_to_int function in ext/exif/exif.c in PHP before 5.6.30, 7.0.x before 7.0.15, and 7.1.x before 7.1.1 allows remote attackers to cause a denial of service (application crash) via crafted EXIF data that triggers an attempt to divide the minimum representable negative integer by -1.","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.07763,"percentile":0.94678,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-189"],"published":"2017-01-24T00:00:00Z","modified":"2026-10-20T13:14:35Z","fixes":[{"ecosystem":"Ubuntu:14.04:LTS","package":"php5","fixed_in":["5.5.9+dfsg-1ubuntu4.21"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"php7.0","fixed_in":["7.0.15-0ubuntu0.16.04.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:7","package":"php5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.45-0+deb7u7"}]}],"versions":["5.4.11-1","5.4.15-1","5.4.34-0+deb7u1","5.4.35-0+deb7u1","5.4.35-0+deb7u2","5.4.36-0+deb7u1","5.4.36-0+deb7u3","5.4.38-0+deb7u1","5.4.39-0+deb7u1","5.4.39-0+deb7u2","5.4.4-14","5.4.4-14+deb7u1","5.4.4-14+deb7u10","5.4.4-14+deb7u11","5.4.4-14+deb7u12","5.4.4-14+deb7u13","5.4.4-14+deb7u14","5.4.4-14+deb7u2","5.4.4-14+deb7u3","5.4.4-14+deb7u4","5.4.4-14+deb7u5","5.4.4-14+deb7u7","5.4.4-14+deb7u8","5.4.4-14+deb7u9","5.4.4-15","5.4.4-15.1","5.4.41-0+deb7u1","5.4.44-0+deb7u1","5.4.45-0+deb7u1","5.4.45-0+deb7u2","5.4.45-0+deb7u3","5.4.45-0+deb7u4","5.4.45-0+deb7u5","5.4.45-0+deb7u6","5.4.6-1","5.4.6-2","5.4.8-1","5.4.9-1","5.4.9-2","5.4.9-3","5.4.9-4"],"bundled":11},{"source":"osv","ecosystem":"Debian:8","package":"php5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.6.30+dfsg-0+deb8u1"}]}],"versions":["5.6.11+dfsg-1","5.6.12+dfsg-0+deb8u1","5.6.12+dfsg-1","5.6.13+dfsg-0+deb8u1","5.6.13+dfsg-1","5.6.13+dfsg-2","5.6.14+dfsg-0+deb8u1","5.6.14+dfsg-1","5.6.15+dfsg-1","5.6.16+dfsg-1","5.6.16+dfsg-2","5.6.16+dfsg-3","5.6.16+dfsg-4","5.6.17+dfsg-0+deb8u1","5.6.17+dfsg-1","5.6.17+dfsg-3","5.6.18+dfsg-1","5.6.19+dfsg-0+deb8u1","5.6.19+dfsg-1","5.6.19+dfsg-2","5.6.20+dfsg-0+deb8u1","5.6.20+dfsg-1","5.6.21+dfsg-1","5.6.21+dfsg-2","5.6.22+dfsg-0+deb8u1","5.6.22+dfsg-1","5.6.22+dfsg-2","5.6.23+dfsg-0+deb8u1","5.6.23+dfsg-1","5.6.24+dfsg-0+deb8u1","5.6.24+dfsg-1","5.6.26+dfsg-0+deb8u1","5.6.26+dfsg-1","5.6.27+dfsg-0+deb8u1","5.6.28+dfsg-0+deb8u1","5.6.29+dfsg-0+deb8u1","5.6.7+dfsg-1","5.6.9+dfsg-0+deb8u1","5.6.9+dfsg-1"],"bundled":5},{"source":"osv","ecosystem":"Mageia:5","package":"php","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.6.30-1.mga5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-php70-php","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el6"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-php70-php-bcmath","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el6"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-php70-php-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el6"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-php70-php-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el6"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-php70-php-dba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el6"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-php70-php-dbg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el6"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-php70-php-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el6"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-php70-php-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el6"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-php70-php-embedded","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el6"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-php70-php-enchant","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el6"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-php70-php-fpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el6"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-php70-php-gd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el6"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-php70-php-gmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el6"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-php70-php-imap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el6"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-php70-php-intl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el6"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-php70-php-json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el6"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-php70-php-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el6"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-php70-php-mbstring","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el6"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-php70-php-mysqlnd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el6"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-php70-php-odbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el6"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-php70-php-opcache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el6"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-php70-php-pdo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el6"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-php70-php-pgsql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el6"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-php70-php-process","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el6"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-php70-php-pspell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el6"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-php70-php-recode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el6"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-php70-php-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el6"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-php70-php-soap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el6"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-php70-php-tidy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el6"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-php70-php-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el6"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-php70-php-xmlrpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el6"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-php70-php-zip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el6"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-php70-php","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el7"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-php70-php-bcmath","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el7"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-php70-php-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el7"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-php70-php-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el7"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-php70-php-dba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el7"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-php70-php-dbg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el7"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-php70-php-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el7"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-php70-php-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el7"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-php70-php-embedded","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el7"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-php70-php-enchant","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el7"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-php70-php-fpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el7"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-php70-php-gd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el7"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-php70-php-gmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el7"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-php70-php-intl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el7"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-php70-php-json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el7"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-php70-php-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el7"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-php70-php-mbstring","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el7"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-php70-php-mysqlnd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el7"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-php70-php-odbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el7"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-php70-php-opcache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el7"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-php70-php-pdo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el7"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-php70-php-pgsql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el7"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-php70-php-process","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el7"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-php70-php-pspell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el7"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-php70-php-recode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el7"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-php70-php-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el7"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-php70-php-soap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el7"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-php70-php-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el7"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-php70-php-xmlrpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el7"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-php70-php-zip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el7"}]}],"bundled":37},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.7-35.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP1","package":"php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.7-35.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP2","package":"php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.7-35.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"php5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.5.14-96.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP1","package":"php5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.5.14-96.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP2","package":"php5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.5.14-96.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"php53","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.17-101.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 5","package":"php53","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.17-101.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Manager 2.1","package":"php53","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.17-101.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Manager Proxy 2.1","package":"php53","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.17-101.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"php53","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.17-101.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-LTSS","package":"php53","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.17-101.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-TERADATA","package":"php53","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.17-101.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"php53","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.17-101.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"php53","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.17-101.1"}]}],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"php5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.5.9+dfsg-1ubuntu4.21"}]}],"versions":["5.5.3+dfsg-1ubuntu2","5.5.3+dfsg-1ubuntu3","5.5.6+dfsg-1ubuntu1","5.5.6+dfsg-1ubuntu2","5.5.8+dfsg-2ubuntu1","5.5.9+dfsg-1ubuntu1","5.5.9+dfsg-1ubuntu2","5.5.9+dfsg-1ubuntu3","5.5.9+dfsg-1ubuntu4","5.5.9+dfsg-1ubuntu4.1","5.5.9+dfsg-1ubuntu4.2","5.5.9+dfsg-1ubuntu4.3","5.5.9+dfsg-1ubuntu4.4","5.5.9+dfsg-1ubuntu4.5","5.5.9+dfsg-1ubuntu4.6","5.5.9+dfsg-1ubuntu4.7","5.5.9+dfsg-1ubuntu4.9","5.5.9+dfsg-1ubuntu4.11","5.5.9+dfsg-1ubuntu4.12","5.5.9+dfsg-1ubuntu4.13","5.5.9+dfsg-1ubuntu4.14","5.5.9+dfsg-1ubuntu4.16","5.5.9+dfsg-1ubuntu4.17","5.5.9+dfsg-1ubuntu4.19","5.5.9+dfsg-1ubuntu4.20"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"php7.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.15-0ubuntu0.16.04.2"}]}],"versions":["7.0.1-5","7.0.1-6","7.0.2-1","7.0.2-3","7.0.2-4","7.0.2-5","7.0.3-2","7.0.3-3","7.0.3-9ubuntu1","7.0.4-5ubuntu1","7.0.4-5ubuntu2","7.0.4-7ubuntu1","7.0.4-7ubuntu2","7.0.4-7ubuntu2.1","7.0.8-0ubuntu0.16.04.1","7.0.8-0ubuntu0.16.04.2","7.0.8-0ubuntu0.16.04.3","7.0.13-0ubuntu0.16.04.1","7.0.15-0ubuntu0.16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"php5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.5.9+dfsg-1ubuntu4.21"}]}],"versions":["5.5.3+dfsg-1ubuntu2","5.5.3+dfsg-1ubuntu3","5.5.6+dfsg-1ubuntu1","5.5.6+dfsg-1ubuntu2","5.5.8+dfsg-2ubuntu1","5.5.9+dfsg-1ubuntu1","5.5.9+dfsg-1ubuntu2","5.5.9+dfsg-1ubuntu3","5.5.9+dfsg-1ubuntu4","5.5.9+dfsg-1ubuntu4.1","5.5.9+dfsg-1ubuntu4.2","5.5.9+dfsg-1ubuntu4.3","5.5.9+dfsg-1ubuntu4.4","5.5.9+dfsg-1ubuntu4.5","5.5.9+dfsg-1ubuntu4.6","5.5.9+dfsg-1ubuntu4.7","5.5.9+dfsg-1ubuntu4.9","5.5.9+dfsg-1ubuntu4.11","5.5.9+dfsg-1ubuntu4.12","5.5.9+dfsg-1ubuntu4.13","5.5.9+dfsg-1ubuntu4.14","5.5.9+dfsg-1ubuntu4.16","5.5.9+dfsg-1ubuntu4.17","5.5.9+dfsg-1ubuntu4.19","5.5.9+dfsg-1ubuntu4.20"],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"php7.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.15-0ubuntu0.16.04.2"}]}],"versions":["7.0.1-5","7.0.1-6","7.0.2-1","7.0.2-3","7.0.2-4","7.0.2-5","7.0.3-2","7.0.3-3","7.0.3-9ubuntu1","7.0.4-5ubuntu1","7.0.4-5ubuntu2","7.0.4-7ubuntu1","7.0.4-7ubuntu2","7.0.4-7ubuntu2.1","7.0.8-0ubuntu0.16.04.1","7.0.8-0ubuntu0.16.04.2","7.0.8-0ubuntu0.16.04.3","7.0.13-0ubuntu0.16.04.1","7.0.15-0ubuntu0.16.04.1"],"bundled":10}],"products":[{"vendor":"php","product":"php"}],"references":[{"url":"http://www.securityfocus.com/bid/95764","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://github.com/php/php-src/commit/1cda0d7c2ffb62d8331c64e703131d9cabdc03ea","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix"]},{"url":"https://bugs.php.net/bug.php?id=73737","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","report"]},{"url":"https://access.redhat.com/errata/RHSA-2018:1296","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"http://php.net/ChangeLog-5.php","tags":["x_refsource_CONFIRM","x_transferred","Release Notes","Vendor Advisory","advisory","report"]},{"url":"https://security.netapp.com/advisory/ntap-20180112-0001/","tags":["x_refsource_CONFIRM","x_transferred","advisory"]},{"url":"https://www.tenable.com/security/tns-2017-04","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.debian.org/security/2017/dsa-3783","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"https://security.gentoo.org/glsa/201702-29","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","advisory"]},{"url":"http://php.net/ChangeLog-7.php","tags":["x_refsource_CONFIRM","x_transferred","Release Notes","Vendor Advisory","advisory","report"]},{"url":"http://www.securitytracker.com/id/1037659","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-10158","tags":["advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20180112-0001"},{"url":"https://github.com/advisories/GHSA-3jf4-pmg8-mhm6"},{"url":"https://advisories.mageia.org/MGASA-2017-0040.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=20185","tags":["report"]},{"url":"http://php.net/ChangeLog-5.php#5.6.30","tags":["web"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_software_collections/3/html/3.1_release_notes/chap-rhscl#sect-RHSCL-Changes-php","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1377311","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1377314","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1377336","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1377340","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1377344","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1377352","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1404723","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1404726","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1404731","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1404735","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1412631","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1412686","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1418984","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1418986","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1419010","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1419012","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1419015","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1419018","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1419020","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1466730","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1466736","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1466739","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1466740","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1466746","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1471824","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1471827","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1471834","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1471842","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1473822","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1475373","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1475522","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1484837","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1484838","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1484839","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1512057","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1535246","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1535251","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_1296.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-7412","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-7412","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-7412","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-7413","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-7413","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-7413","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-7414","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-7414","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-7414","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-7416","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-7416","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-7416","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-7417","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-7417","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-7417","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-7418","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-7418","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-7418","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-7479","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-7479","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-7479","tags":["advisory"]},{"url":"https://blog.checkpoint.com/wp-content/uploads/2016/12/PHP_Technical_Report.pdf","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-9933","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-9933","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-9933","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-9934","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-9934","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-9934","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-9935","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-9935","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-9935","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-9936","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-9936","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-9936","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-10158","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-10158","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-10159","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-10159","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-10159","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-10160","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-10160","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-10160","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-10161","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-10161","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-10161","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-10162","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-10162","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-10162","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-10167","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-10167","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-10167","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-10168","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-10168","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-10168","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-5340","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-5340","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-5340","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-7890","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-7890","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-7890","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-9224","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-9224","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-9224","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-9226","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-9226","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-9226","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-9227","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-9227","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-9227","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-9228","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-9228","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-9228","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-9229","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-9229","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-9229","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-11143","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-11143","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-11143","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-11144","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-11144","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-11144","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-11145","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-11145","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-11145","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-11147","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-11147","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-11147","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-11362","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-11362","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-11362","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-11628","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-11628","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-11628","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-12932","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-12932","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-12932","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-12933","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-12933","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-12933","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-12934","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-12934","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-12934","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-16642","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-16642","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-16642","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-5711","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-5711","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-5711","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-5712","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-5712","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-5712","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20170534-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1008026","tags":["report"]},{"url":"https://bugzilla.suse.com/1019547","tags":["report"]},{"url":"https://bugzilla.suse.com/1019550","tags":["report"]},{"url":"https://bugzilla.suse.com/1019568","tags":["report"]},{"url":"https://bugzilla.suse.com/1019570","tags":["report"]},{"url":"https://bugzilla.suse.com/1022219","tags":["report"]},{"url":"https://bugzilla.suse.com/1022255","tags":["report"]},{"url":"https://bugzilla.suse.com/1022257","tags":["report"]},{"url":"https://bugzilla.suse.com/1022260","tags":["report"]},{"url":"https://bugzilla.suse.com/1022262","tags":["report"]},{"url":"https://bugzilla.suse.com/1022263","tags":["report"]},{"url":"https://bugzilla.suse.com/1022264","tags":["report"]},{"url":"https://bugzilla.suse.com/1022265","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10158","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10159","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10160","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10161","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10162","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10166","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10167","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10168","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7478","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7479","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7480","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9138","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5340","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20170556-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20170568-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2016-10158","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3196-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-3211-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2014-9912","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-7478","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-7479","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-9137","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-9934","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-9935","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-10159","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-10160","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-10161","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-9936","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-10162","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-5340","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2016-10158","description":"The exif_convert_any_to_int function in ext/exif/exif.c in PHP before 5.6.30, 7.0.x before 7.0.15, and 7.1.x before 7.1.1 allows remote attackers to cause a denial of service (application crash) via crafted EXIF data that triggers an attempt to divide the minimum representable negative integer by -1.","status":"published","published":"2017-01-24T21:00:00Z","modified":"2024-08-06T03:14:42.374Z","updated_at":"2026-11-02T14:33:31.450804Z"}],"euvd":[{"id":"EUVD-2016-1346","description":"The exif_convert_any_to_int function in ext/exif/exif.c in PHP before 5.6.30, 7.0.x before 7.0.15, and 7.1.x before 7.1.1 allows remote attackers to cause a denial of service (application crash) via crafted EXIF data that triggers an attempt to divide the minimum representable negative integer by -1.","status":"published","published":"2017-01-24T21:00:00Z","modified":"2024-08-06T03:14:42Z","updated_at":"2026-11-03T02:22:24.738409Z"}],"ghsa":[{"id":"GHSA-3jf4-pmg8-mhm6","title":"The exif_convert_any_to_int function in ext/exif/exif.c in PHP before 5.6.30, 7.0.x before 7.0.15...","description":"The exif_convert_any_to_int function in ext/exif/exif.c in PHP before 5.6.30, 7.0.x before 7.0.15, and 7.1.x before 7.1.1 allows remote attackers to cause a denial of service (application crash) via crafted EXIF data that triggers an attempt to divide the minimum representable negative integer by -1.","status":"published","published":"2022-05-14T03:27:48Z","modified":"2025-04-20T03:31:32Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:01:38.976438Z"}],"nvd":[{"id":"CVE-2016-10158","description":"The exif_convert_any_to_int function in ext/exif/exif.c in PHP before 5.6.30, 7.0.x before 7.0.15, and 7.1.x before 7.1.1 allows remote attackers to cause a denial of service (application crash) via crafted EXIF data that triggers an attempt to divide the minimum representable negative integer by -1.","status":"published","published":"2017-01-24T21:59:00.133Z","modified":"2026-06-17T00:39:10.5Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-189"],"updated_at":"2026-11-02T14:03:35.029632Z"}],"osv":[{"id":"CVE-2016-10158","description":"The exif_convert_any_to_int function in ext/exif/exif.c in PHP before 5.6.30, 7.0.x before 7.0.15, and 7.1.x before 7.1.1 allows remote attackers to cause a denial of service (application crash) via crafted EXIF data that triggers an attempt to divide the minimum representable negative integer by -1.","status":"published","published":"2017-01-24T21:59:00.133Z","modified":"2026-10-20T13:14:35.513275041Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:01.531338Z"},{"id":"RHSA-2018:1296","title":"Red Hat Security Advisory: rh-php70-php security, bug fix, and enhancement update","status":"published","published":"2024-09-13T16:50:16Z","modified":"2026-06-29T10:20:06Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:04.822845Z"},{"id":"UBUNTU-CVE-2016-10158","description":"The exif_convert_any_to_int function in ext/exif/exif.c in PHP before 5.6.30, 7.0.x before 7.0.15, and 7.1.x before 7.1.1 allows remote attackers to cause a denial of service (application crash) via crafted EXIF data that triggers an attempt to divide the minimum representable negative integer by -1.","status":"published","published":"2017-01-24T00:00:00Z","modified":"2026-04-22T10:28:38.723324Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:11.492576Z"},{"id":"DLA-818-1","title":"php5 - security update","status":"published","published":"2017-02-07T00:00:00Z","modified":"2026-03-09T02:11:16.079306Z","updated_at":"2026-11-02T15:46:13.207219Z"},{"id":"DSA-3783-1","title":"php5 - security update","status":"published","published":"2017-02-08T00:00:00Z","modified":"2026-03-09T01:19:13.825727Z","updated_at":"2026-11-02T15:46:16.523846Z"},{"id":"MGASA-2017-0040","title":"Updated php packages fix security vulnerabilities","description":"Floating-point exception in php-exif when parsing a tag format\n(CVE-2016-10158).\n\nCrash in php-phar while loading hostile phar archive (CVE-2016-10159).\n\nMemory corruption in php-phar when loading hostile phar (CVE-2016-10160).\n\nHeap out of bounds read on unserialize in finish_nested_data()\n(CVE-2016-10161).\n","status":"published","published":"2017-02-04T18:41:12Z","modified":"2026-04-16T06:24:33.847658171Z","updated_at":"2026-11-02T15:49:40.103088Z"},{"id":"SUSE-SU-2017:0534-1","title":"Security update for php7","description":"\nThis update for php7 fixes the following security issues:\n\n- CVE-2016-7480: The SplObjectStorage unserialize implementation in\n  ext/spl/spl_observer.c in PHP did not verify that a key is an object,\n  which allowed remote attackers to execute arbitrary code or cause a denial\n  of service (uninitialized memory access) via crafted serialized data.\n  (bsc#1019568)\n- CVE-2017-5340: Zend/zend_hash.c in PHP mishandled certain cases that\n  require large array allocations, which allowed remote attackers to\n  execute arbitrary code or cause a denial of service (integer overflow,\n  uninitialized memory access, and use of arbitrary destructor function\n  pointers) via crafted serialized data. (bsc#1019570)\n- CVE-2016-7479: In all versions of PHP 7, during the unserialization\n  process, resizing the 'properties' hash table of a serialized object may\n  have lead to use-after-free. A remote attacker may exploit this bug to\n  gain arbitrary code execution. (bsc#1019547)\n- CVE-2016-7478: Zend/zend_exceptions.c in PHP allowed remote attackers to\n  cause a denial of service (infinite loop) via a crafted Exception object\n  in serialized data, a related issue to CVE-2015-8876.  (bsc#1019550)\n- CVE-2016-10159: Integer overflow in the phar_parse_pharfile function\n  in ext/phar/phar.c in PHP allowed remote attackers to cause a denial\n  of service (memory consumption or application crash) via a truncated\n  manifest entry in a PHAR archive. (bsc#1022255)\n- CVE-2016-10160: Off-by-one error in the phar_parse_pharfile function\n  in ext/phar/phar.c in PHP allowed remote attackers to cause a denial\n  of service (memory corruption) or possibly execute arbitrary code via\n  a crafted PHAR archive with an alias mismatch. (bsc#1022257)\n- CVE-2016-10161: The object_common1 function in\n  ext/standard/var_unserializer.c in PHP allowed remote attackers to\n  cause a denial of service (buffer over-read and application crash) via\n  crafted serialized data that is mishandled in a finish_nested_data call.\n  (bsc#1022260)\n- CVE-2016-10162: The php_wddx_pop_element function in ext/wddx/wddx.c in\n  PHP 7 allowed remote attackers to cause a denial of service (NULL pointer\n  dereference and application crash) via an inapplicable class name in a\n  wddxPacket XML document, leading to mishandling in a wddx_deserialize\n  call. (bsc#1022262)\n- CVE-2016-10166: A potential unsigned underflow in gd interpolation\n  functions could lead to memory corruption in the PHP gd module\n  (bsc#1022263)\n- CVE-2016-10167: A denial of service problem in gdImageCreateFromGd2Ctx()\n  could lead to php out of memory even on small files. (bsc#1022264)\n- CVE-2016-10168: A signed integer overflow in the gd module could lead\n  to memory corruption (bsc#1022265)\n- CVE-2016-9138: PHP mishandled property modification during __wakeup\n  processing, which allows remote attackers to cause a denial of\n  service or possibly have unspecified other impact via crafted\n  serialized data, as demonstrated by Exception::__toString with\n  DateInterval::__wakeup. (bsc#1008026)\n","status":"published","published":"2017-02-22T09:00:09Z","modified":"2026-02-04T04:33:21.241721Z","updated_at":"2026-11-02T15:53:43.83457Z"},{"id":"SUSE-SU-2017:0556-1","title":"Security update for php5","description":"\nThis update for php5 fixes the following issues:\n\n- CVE-2016-7478: When unserializing untrusted input data, PHP could end up in an infinite\n  loop, causing denial of service (bsc#1019550)\n- CVE-2016-10158: The exif_convert_any_to_int function in ext/exif/exif.c\n  in PHP allowed remote attackers to cause a denial of service (application\n  crash) via crafted EXIF data that triggers an attempt to divide the\n  minimum representable negative integer by -1.  (bsc#1022219)\n- CVE-2016-10159: Integer overflow in the phar_parse_pharfile function\n  in ext/phar/phar.c in PHP allowed remote attackers to cause a denial\n  of service (memory consumption or application crash) via a truncated\n  manifest entry in a PHAR archive. (bsc#1022255)\n- CVE-2016-10160: Off-by-one error in the phar_parse_pharfile function\n  in ext/phar/phar.c in PHP allowed remote attackers to cause a denial\n  of service (memory corruption) or possibly execute arbitrary code via\n  a crafted PHAR archive with an alias mismatch. (bsc#1022257)\n- CVE-2016-10161: The object_common1 function in\n  ext/standard/var_unserializer.c in PHP allowed remote attackers to\n  cause a denial of service (buffer over-read and application crash) via\n  crafted serialized data that is mishandled in a finish_nested_data call.\n  (bsc#1022260)\n- CVE-2016-10166: A potential unsigned underflow in gd interpolation\n  functions could lead to memory corruption in the PHP gd module\n  (bsc#1022263)\n- CVE-2016-10167: A denial of service problem in gdImageCreateFromGd2Ctx()\n  could lead to php out of memory even on small files. (bsc#1022264)\n- CVE-2016-10168: A signed integer overflow in the gd module could lead\n  to memory corruption (bsc#1022265)\n","status":"published","published":"2017-02-23T09:00:51Z","modified":"2026-02-04T03:09:28.014645Z","updated_at":"2026-11-02T15:53:43.83457Z"},{"id":"SUSE-SU-2017:0568-1","title":"Security update for php53","description":"\nThis update for php53 fixes the following security issues:\n\n- CVE-2016-7478: When unserializing untrusted input data, PHP could end up in an infinite\n  loop, causing denial of service (bsc#1019550)\n- CVE-2016-10158: The exif_convert_any_to_int function in ext/exif/exif.c\n  in PHP allowed remote attackers to cause a denial of service (application\n  crash) via crafted EXIF data that triggers an attempt to divide the\n  minimum representable negative integer by -1.  (bsc#1022219)\n- CVE-2016-10159: Integer overflow in the phar_parse_pharfile function\n  in ext/phar/phar.c in PHP allowed remote attackers to cause a denial\n  of service (memory consumption or application crash) via a truncated\n  manifest entry in a PHAR archive. (bsc#1022255)\n- CVE-2016-10160: Off-by-one error in the phar_parse_pharfile function\n  in ext/phar/phar.c in PHP allowed remote attackers to cause a denial\n  of service (memory corruption) or possibly execute arbitrary code via\n  a crafted PHAR archive with an alias mismatch. (bsc#1022257)\n- CVE-2016-10161: The object_common1 function in\n  ext/standard/var_unserializer.c in PHP allowed remote attackers to\n  cause a denial of service (buffer over-read and application crash) via\n  crafted serialized data that is mishandled in a finish_nested_data call.\n  (bsc#1022260)\n- CVE-2016-10166: A potential unsigned underflow in gd interpolation\n  functions could lead to memory corruption in the PHP gd module\n  (bsc#1022263)\n- CVE-2016-10167: A denial of service problem in gdImageCreateFromGd2Ctx()\n  could lead to php out of memory even on small files. (bsc#1022264)\n- CVE-2016-10168: A signed integer overflow in the gd module could lead\n  to memory corruption (bsc#1022265)\n\n","status":"published","published":"2017-02-27T12:57:02Z","modified":"2026-02-04T03:29:21.181644Z","updated_at":"2026-11-02T15:53:43.83457Z"},{"id":"USN-3196-1","title":"php5 vulnerabilities","description":"It was discovered that PHP incorrectly handled certain arguments to the\nlocale_get_display_name function. A remote attacker could use this issue to\ncause PHP to crash, resulting in a denial of service, or possibly execute\narbitrary code. (CVE-2014-9912)\n\nIt was discovered that PHP incorrectly handled certain invalid objects when\nunserializing data. A remote attacker could use this issue to cause PHP to\nhang, resulting in a denial of service. (CVE-2016-7478)\n\nIt was discovered that PHP incorrectly handled certain invalid objects when\nunserializing data. A remote attacker could use this issue to cause PHP to\ncrash, resulting in a denial of service, or possibly execute arbitrary\ncode. (CVE-2016-7479)\n\nIt was discovered that PHP incorrectly handled certain invalid objects when\nunserializing data. A remote attacker could use this issue to cause PHP to\ncrash, resulting in a denial of service, or possibly execute arbitrary\ncode. This issue only applied to Ubuntu 14.04 LTS. (CVE-2016-9137)\n\nIt was discovered that PHP incorrectly handled unserializing certain\nwddxPacket XML documents. A remote attacker could use this issue to cause\nPHP to crash, resulting in a denial of service. (CVE-2016-9934)\n\nIt was discovered that PHP incorrectly handled unserializing certain\nwddxPacket XML documents. A remote attacker could use this issue to cause\nPHP to crash, resulting in a denial of service, or possibly execute\narbitrary code. (CVE-2016-9935)\n\nIt was discovered that PHP incorrectly handled certain EXIF data. A remote\nattacker could use this issue to cause PHP to crash, resulting in a denial\nof service. (CVE-2016-10158)\n\nIt was discovered that PHP incorrectly handled certain PHAR archives. A\nremote attacker could use this issue to cause PHP to crash or consume\nresources, resulting in a denial of service. (CVE-2016-10159)\n\nIt was discovered that PHP incorrectly handled certain PHAR archives. A\nremote attacker could use this issue to cause PHP to crash, resulting in a\ndenial of service, or possibly execute arbitrary code. (CVE-2016-10160)\n\nIt was discovered that PHP incorrectly handled certain invalid objects when\nunserializing data. A remote attacker could use this issue to cause PHP to\ncrash, resulting in a denial of service. (CVE-2016-10161)\n","status":"published","published":"2017-02-14T18:44:56Z","modified":"2026-04-22T09:31:26.707533Z","updated_at":"2026-11-02T16:58:10.303275Z"},{"id":"USN-3211-1","title":"php7.0 vulnerabilities","description":"It was discovered that PHP incorrectly handled certain invalid objects when\nunserializing data. A remote attacker could use this issue to cause PHP to\ncrash, resulting in a denial of service, or possibly execute arbitrary\ncode. (CVE-2016-7479)\n\nIt was discovered that PHP incorrectly handled certain invalid objects when\nunserializing data. A remote attacker could use this issue to cause PHP to\ncrash, resulting in a denial of service, or possibly execute arbitrary\ncode. (CVE-2016-9137)\n\nIt was discovered that PHP incorrectly handled unserializing certain\nwddxPacket XML documents. A remote attacker could use this issue to cause\nPHP to crash, resulting in a denial of service, or possibly execute\narbitrary code. (CVE-2016-9935)\n\nIt was discovered that PHP incorrectly handled certain invalid objects when\nunserializing data. A remote attacker could use this issue to cause PHP to\ncrash, resulting in a denial of service, or possibly execute arbitrary\ncode. (CVE-2016-9936)\n\nIt was discovered that PHP incorrectly handled certain EXIF data. A remote\nattacker could use this issue to cause PHP to crash, resulting in a denial\nof service. (CVE-2016-10158)\n\nIt was discovered that PHP incorrectly handled certain PHAR archives. A\nremote attacker could use this issue to cause PHP to crash or consume\nresources, resulting in a denial of service. (CVE-2016-10159)\n\nIt was discovered that PHP incorrectly handled certain PHAR archives. A\nremote attacker could use this issue to cause PHP to crash, resulting in a\ndenial of service, or possibly execute arbitrary code. (CVE-2016-10160)\n\nIt was discovered that PHP incorrectly handled certain invalid objects when\nunserializing data. A remote attacker could use this issue to cause PHP to\ncrash, resulting in a denial of service. (CVE-2016-10161)\n\nIt was discovered that PHP incorrectly handled unserializing certain\nwddxPacket XML documents. A remote attacker could use this issue to cause\nPHP to crash, resulting in a denial of service. (CVE-2016-10162)\n\nIt was discovered that PHP incorrectly handled certain invalid objects when\nunserializing data. A remote attacker could use this issue to cause PHP to\ncrash, resulting in a denial of service, or possibly execute arbitrary\ncode. (CVE-2017-5340)\n","status":"published","published":"2017-02-23T16:28:50Z","modified":"2026-04-22T09:31:56.613928Z","updated_at":"2026-11-02T16:58:10.303275Z"}]}}