{"id":"CVE-2016-3078","aliases":["EUVD-2016-4147","GHSA-rj5f-q94x-7mf7","UBUNTU-CVE-2016-3078","USN-2984-1"],"status":"published","title":"Multiple integer overflows in php_zip.c in the zip extension in PHP before 7.0.6 allow remote...","description":"Multiple integer overflows in php_zip.c in the zip extension in PHP before 7.0.6 allow remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted call to (1) getFromIndex or (2) getFromName in the ZipArchive class.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.56132,"percentile":0.99054,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-190"],"published":"2016-04-29T00:00:00Z","modified":"2026-10-20T13:22:24Z","exploits":[{"source":"exploitdb","id":"EDB-39742","title":"PHP 7.0.5 - ZipArchive::getFrom* Integer Overflow","type":"remote","platform":"php","date":"2016-04-28","url":"https://www.exploit-db.com/exploits/39742"}],"fixes":[{"ecosystem":"Ubuntu:16.04:LTS","package":"php7.0","fixed_in":["7.0.4-7ubuntu2.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"php7.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.4-7ubuntu2.1"}]}],"versions":["7.0.1-5","7.0.1-6","7.0.2-1","7.0.2-3","7.0.2-4","7.0.2-5","7.0.3-2","7.0.3-3","7.0.3-9ubuntu1","7.0.4-5ubuntu1","7.0.4-5ubuntu2","7.0.4-7ubuntu1","7.0.4-7ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"php5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.5.9+dfsg-1ubuntu4.17"}]}],"versions":["5.5.3+dfsg-1ubuntu2","5.5.3+dfsg-1ubuntu3","5.5.6+dfsg-1ubuntu1","5.5.6+dfsg-1ubuntu2","5.5.8+dfsg-2ubuntu1","5.5.9+dfsg-1ubuntu1","5.5.9+dfsg-1ubuntu2","5.5.9+dfsg-1ubuntu3","5.5.9+dfsg-1ubuntu4","5.5.9+dfsg-1ubuntu4.1","5.5.9+dfsg-1ubuntu4.2","5.5.9+dfsg-1ubuntu4.3","5.5.9+dfsg-1ubuntu4.4","5.5.9+dfsg-1ubuntu4.5","5.5.9+dfsg-1ubuntu4.6","5.5.9+dfsg-1ubuntu4.7","5.5.9+dfsg-1ubuntu4.9","5.5.9+dfsg-1ubuntu4.11","5.5.9+dfsg-1ubuntu4.12","5.5.9+dfsg-1ubuntu4.13","5.5.9+dfsg-1ubuntu4.14","5.5.9+dfsg-1ubuntu4.16"],"bundled":17},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"php7.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.4-7ubuntu2.1"}]}],"versions":["7.0.1-5","7.0.1-6","7.0.2-1","7.0.2-3","7.0.2-4","7.0.2-5","7.0.3-2","7.0.3-3","7.0.3-9ubuntu1","7.0.4-5ubuntu1","7.0.4-5ubuntu2","7.0.4-7ubuntu1","7.0.4-7ubuntu2"],"bundled":17}],"products":[{"vendor":"php","product":"php"}],"references":[{"url":"https://bugs.php.net/bug.php?id=71923","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Issue Tracking","Vendor Advisory","report"]},{"url":"https://github.com/php/php-src/commit/3b8d4de300854b3517c7acb239b84f7726c1353c?w=1","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"http://www.openwall.com/lists/oss-security/2016/04/28/1","tags":["mailing-list","x_refsource_MLIST","x_transferred","Exploit","Mailing List","Third Party Advisory","evidence","report"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2016-3078","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.exploit-db.com/exploits/39742/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Exploit","Third Party Advisory","VDB Entry","evidence"]},{"url":"https://php.net/ChangeLog-7.php","tags":["x_refsource_CONFIRM","x_transferred","Release Notes","Vendor Advisory","advisory"]},{"url":"http://www.securitytracker.com/id/1035701","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Broken Link","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-3078"},{"url":"https://www.exploit-db.com/exploits/39742"},{"url":"https://github.com/advisories/GHSA-rj5f-q94x-7mf7"},{"url":"https://ubuntu.com/security/CVE-2016-3078","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2984-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-3078","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-8865","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-3132","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-4070","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-4071","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-4072","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-4073","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-4342","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-4343","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-4537","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-4538","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-4539","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-4540","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-4541","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-4542","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-4543","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-4544","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2016-3078","description":"Multiple integer overflows in php_zip.c in the zip extension in PHP before 7.0.6 allow remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted call to (1) getFromIndex or (2) getFromName in the ZipArchive class.","status":"published","published":"2016-08-07T10:00:00Z","modified":"2024-08-05T23:40:15.557Z","updated_at":"2026-11-02T14:33:34.094161Z"}],"euvd":[{"id":"EUVD-2016-4147","description":"Multiple integer overflows in php_zip.c in the zip extension in PHP before 7.0.6 allow remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted call to (1) getFromIndex or (2) getFromName in the ZipArchive class.","status":"published","published":"2016-08-07T10:00:00Z","modified":"2024-08-05T23:40:15Z","updated_at":"2026-11-03T02:22:51.132305Z"}],"ghsa":[{"id":"GHSA-rj5f-q94x-7mf7","title":"Multiple integer overflows in php_zip.c in the zip extension in PHP before 7.0.6 allow remote...","description":"Multiple integer overflows in php_zip.c in the zip extension in PHP before 7.0.6 allow remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted call to (1) getFromIndex or (2) getFromName in the ZipArchive class.","status":"published","published":"2022-05-17T01:16:35Z","modified":"2025-04-12T13:04:21Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T15:01:29.190007Z"}],"nvd":[{"id":"CVE-2016-3078","description":"Multiple integer overflows in php_zip.c in the zip extension in PHP before 7.0.6 allow remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted call to (1) getFromIndex or (2) getFromName in the ZipArchive class.","status":"published","published":"2016-08-07T10:59:02.757Z","modified":"2026-06-17T00:44:55.643Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T14:03:28.854267Z"}],"osv":[{"id":"CVE-2016-3078","description":"Multiple integer overflows in php_zip.c in the zip extension in PHP before 7.0.6 allow remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted call to (1) getFromIndex or (2) getFromName in the ZipArchive class.","status":"published","published":"2016-08-07T10:59:02.757Z","modified":"2026-10-20T13:22:24.238777483Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:02.114472Z"},{"id":"UBUNTU-CVE-2016-3078","description":"Multiple integer overflows in php_zip.c in the zip extension in PHP before 7.0.6 allow remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted call to (1) getFromIndex or (2) getFromName in the ZipArchive class.","status":"published","published":"2016-04-29T00:00:00Z","modified":"2026-04-22T10:39:55.530425Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:11.872222Z"},{"id":"USN-2984-1","title":"php5, php7.0 vulnerabilities","description":"It was discovered that the PHP Fileinfo component incorrectly handled\ncertain magic files. An attacker could use this issue to cause PHP to\ncrash, resulting in a denial of service, or possibly execute arbitrary\ncode. This issue only affected Ubuntu 16.04 LTS. (CVE-2015-8865)\n\nHans Jerry Illikainen discovered that the PHP Zip extension incorrectly\nhandled certain malformed Zip archives. A remote attacker could use this\nissue to cause PHP to crash, resulting in a denial of service, or possibly\nexecute arbitrary code. This issue only affected Ubuntu 16.04 LTS.\n(CVE-2016-3078)\n\nIt was discovered that PHP incorrectly handled invalid indexes in the\nSplDoublyLinkedList class. An attacker could use this issue to cause PHP to\ncrash, resulting in a denial of service, or possibly execute arbitrary\ncode. This issue only affected Ubuntu 16.04 LTS. (CVE-2016-3132)\n\nIt was discovered that the PHP rawurlencode() function incorrectly handled\nlarge strings. A remote attacker could use this issue to cause PHP to\ncrash, resulting in a denial of service. This issue only affected Ubuntu\n16.04 LTS. (CVE-2016-4070)\n\nIt was discovered that the PHP php_snmp_error() function incorrectly\nhandled string formatting. A remote attacker could use this issue to cause\nPHP to crash, resulting in a denial of service, or possibly execute\narbitrary code. This issue only affected Ubuntu 16.04 LTS. (CVE-2016-4071)\n\nIt was discovered that the PHP phar extension incorrectly handled certain\nfilenames in archives. A remote attacker could use this issue to cause PHP\nto crash, resulting in a denial of service, or possibly execute arbitrary\ncode. This issue only affected Ubuntu 16.04 LTS. (CVE-2016-4072)\n\nIt was discovered that the PHP mb_strcut() function incorrectly handled\nstring formatting. A remote attacker could use this issue to cause PHP to\ncrash, resulting in a denial of service, or possibly execute arbitrary\ncode. This issue only affected Ubuntu 16.04 LTS. (CVE-2016-4073)\n\nIt was discovered that the PHP phar extension incorrectly handled certain\narchive files. A remote attacker could use this issue to cause PHP to\ncrash, resulting in a denial of service, or possibly execute arbitrary\ncode. This issue only affected Ubuntu 12.04 LTS, Ubuntu 14.04 LTS and\nUbuntu 15.10. (CVE-2016-4342, CVE-2016-4343)\n\nIt was discovered that the PHP bcpowmod() function incorrectly handled\nmemory. A remote attacker could use this issue to cause PHP to crash,\nresulting in a denial of service, or possibly execute arbitrary code. \n(CVE-2016-4537, CVE-2016-4538)\n\nIt was discovered that the PHP XML parser incorrectly handled certain\nmalformed XML data. A remote attacker could possibly use this issue to\ncause PHP to crash, resulting in a denial of service, or possibly execute\narbitrary code. (CVE-2016-4539)\n\nIt was discovered that certain PHP grapheme functions incorrectly handled\nnegative offsets. A remote attacker could possibly use this issue to cause\nPHP to crash, resulting in a denial of service. (CVE-2016-4540,\nCVE-2016-4541)\n\nIt was discovered that PHP incorrectly handled certain malformed EXIF tags.\nA remote attacker could possibly use this issue to cause PHP to crash,\nresulting in a denial of service. (CVE-2016-4542, CVE-2016-4543,\nCVE-2016-4544)\n","status":"published","published":"2016-05-24T17:31:16Z","modified":"2026-04-22T09:24:48.530084Z","updated_at":"2026-11-02T16:58:10.303275Z"}]}}