{"id":"CVE-2016-3132","aliases":["EUVD-2016-4184","GHSA-rpq8-3f5m-jp4r","UBUNTU-CVE-2016-3132","USN-2984-1"],"status":"published","title":"Double free vulnerability in the SplDoublyLinkedList::offsetSet function in ext/spl/spl_dllist.c...","description":"Double free vulnerability in the SplDoublyLinkedList::offsetSet function in ext/spl/spl_dllist.c in PHP 7.x before 7.0.6 allows remote attackers to execute arbitrary code via a crafted index.","severity":{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.11674,"percentile":0.96084,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-415"],"published":"2016-05-06T00:00:00Z","modified":"2026-10-20T13:22:24Z","fixes":[{"ecosystem":"Ubuntu:16.04:LTS","package":"php7.0","fixed_in":["7.0.4-7ubuntu2.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"php7.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.4-7ubuntu2.1"}]}],"versions":["7.0.1-5","7.0.1-6","7.0.2-1","7.0.2-3","7.0.2-4","7.0.2-5","7.0.3-2","7.0.3-3","7.0.3-9ubuntu1","7.0.4-5ubuntu1","7.0.4-5ubuntu2","7.0.4-7ubuntu1","7.0.4-7ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"php5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.5.9+dfsg-1ubuntu4.17"}]}],"versions":["5.5.3+dfsg-1ubuntu2","5.5.3+dfsg-1ubuntu3","5.5.6+dfsg-1ubuntu1","5.5.6+dfsg-1ubuntu2","5.5.8+dfsg-2ubuntu1","5.5.9+dfsg-1ubuntu1","5.5.9+dfsg-1ubuntu2","5.5.9+dfsg-1ubuntu3","5.5.9+dfsg-1ubuntu4","5.5.9+dfsg-1ubuntu4.1","5.5.9+dfsg-1ubuntu4.2","5.5.9+dfsg-1ubuntu4.3","5.5.9+dfsg-1ubuntu4.4","5.5.9+dfsg-1ubuntu4.5","5.5.9+dfsg-1ubuntu4.6","5.5.9+dfsg-1ubuntu4.7","5.5.9+dfsg-1ubuntu4.9","5.5.9+dfsg-1ubuntu4.11","5.5.9+dfsg-1ubuntu4.12","5.5.9+dfsg-1ubuntu4.13","5.5.9+dfsg-1ubuntu4.14","5.5.9+dfsg-1ubuntu4.16"],"bundled":17},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"php7.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.4-7ubuntu2.1"}]}],"versions":["7.0.1-5","7.0.1-6","7.0.2-1","7.0.2-3","7.0.2-4","7.0.2-5","7.0.3-2","7.0.3-3","7.0.3-9ubuntu1","7.0.4-5ubuntu1","7.0.4-5ubuntu2","7.0.4-7ubuntu1","7.0.4-7ubuntu2"],"bundled":17}],"products":[{"vendor":"php","product":"php"}],"references":[{"url":"https://security-tracker.debian.org/tracker/CVE-2016-3132","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://bugs.php.net/bug.php?id=71735","tags":["x_refsource_CONFIRM","x_transferred","Exploit","evidence"]},{"url":"http://www.securityfocus.com/bid/92356","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"http://github.com/php/php-src/commit/28a6ed9f9a36b9c517e4a8a429baf4dd382fc5d5?w=1","tags":["x_refsource_CONFIRM","x_transferred","Patch","fix"]},{"url":"https://php.net/ChangeLog-7.php","tags":["x_refsource_CONFIRM","x_transferred","Patch","Release Notes","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-3132"},{"url":"https://github.com/advisories/GHSA-rpq8-3f5m-jp4r"},{"url":"https://ubuntu.com/security/CVE-2016-3132","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2984-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-3132","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-8865","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-3078","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-4070","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-4071","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-4072","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-4073","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-4342","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-4343","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-4537","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-4538","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-4539","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-4540","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-4541","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-4542","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-4543","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-4544","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2016-3132","description":"Double free vulnerability in the SplDoublyLinkedList::offsetSet function in ext/spl/spl_dllist.c in PHP 7.x before 7.0.6 allows remote attackers to execute arbitrary code via a crafted index.","status":"published","published":"2016-08-07T10:00:00Z","modified":"2024-08-05T23:47:57.389Z","updated_at":"2026-11-02T14:33:34.094161Z"}],"euvd":[{"id":"EUVD-2016-4184","description":"Double free vulnerability in the SplDoublyLinkedList::offsetSet function in ext/spl/spl_dllist.c in PHP 7.x before 7.0.6 allows remote attackers to execute arbitrary code via a crafted index.","status":"published","published":"2016-08-07T10:00:00Z","modified":"2024-08-05T23:47:57Z","updated_at":"2026-11-03T02:22:51.132305Z"}],"ghsa":[{"id":"GHSA-rpq8-3f5m-jp4r","title":"Double free vulnerability in the SplDoublyLinkedList::offsetSet function in ext/spl/spl_dllist.c...","description":"Double free vulnerability in the SplDoublyLinkedList::offsetSet function in ext/spl/spl_dllist.c in PHP 7.x before 7.0.6 allows remote attackers to execute arbitrary code via a crafted index.","status":"published","published":"2022-05-17T03:42:18Z","modified":"2023-01-27T05:08:27Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-415"],"updated_at":"2026-11-02T14:43:18.355701Z"}],"nvd":[{"id":"CVE-2016-3132","description":"Double free vulnerability in the SplDoublyLinkedList::offsetSet function in ext/spl/spl_dllist.c in PHP 7.x before 7.0.6 allows remote attackers to execute arbitrary code via a crafted index.","status":"published","published":"2016-08-07T10:59:04.663Z","modified":"2026-06-17T00:45:08.873Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-415"],"updated_at":"2026-11-02T14:03:28.854267Z"}],"osv":[{"id":"CVE-2016-3132","description":"Double free vulnerability in the SplDoublyLinkedList::offsetSet function in ext/spl/spl_dllist.c in PHP 7.x before 7.0.6 allows remote attackers to execute arbitrary code via a crafted index.","status":"published","published":"2016-08-07T10:59:04.663Z","modified":"2026-10-20T13:22:24.633258693Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:02.114472Z"},{"id":"UBUNTU-CVE-2016-3132","description":"Double free vulnerability in the SplDoublyLinkedList::offsetSet function in ext/spl/spl_dllist.c in PHP 7.x before 7.0.6 allows remote attackers to execute arbitrary code via a crafted index.","status":"published","published":"2016-05-06T00:00:00Z","modified":"2026-04-22T10:39:51.95791Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:11.872222Z"},{"id":"USN-2984-1","title":"php5, php7.0 vulnerabilities","description":"It was discovered that the PHP Fileinfo component incorrectly handled\ncertain magic files. An attacker could use this issue to cause PHP to\ncrash, resulting in a denial of service, or possibly execute arbitrary\ncode. This issue only affected Ubuntu 16.04 LTS. (CVE-2015-8865)\n\nHans Jerry Illikainen discovered that the PHP Zip extension incorrectly\nhandled certain malformed Zip archives. A remote attacker could use this\nissue to cause PHP to crash, resulting in a denial of service, or possibly\nexecute arbitrary code. This issue only affected Ubuntu 16.04 LTS.\n(CVE-2016-3078)\n\nIt was discovered that PHP incorrectly handled invalid indexes in the\nSplDoublyLinkedList class. An attacker could use this issue to cause PHP to\ncrash, resulting in a denial of service, or possibly execute arbitrary\ncode. This issue only affected Ubuntu 16.04 LTS. (CVE-2016-3132)\n\nIt was discovered that the PHP rawurlencode() function incorrectly handled\nlarge strings. A remote attacker could use this issue to cause PHP to\ncrash, resulting in a denial of service. This issue only affected Ubuntu\n16.04 LTS. (CVE-2016-4070)\n\nIt was discovered that the PHP php_snmp_error() function incorrectly\nhandled string formatting. A remote attacker could use this issue to cause\nPHP to crash, resulting in a denial of service, or possibly execute\narbitrary code. This issue only affected Ubuntu 16.04 LTS. (CVE-2016-4071)\n\nIt was discovered that the PHP phar extension incorrectly handled certain\nfilenames in archives. A remote attacker could use this issue to cause PHP\nto crash, resulting in a denial of service, or possibly execute arbitrary\ncode. This issue only affected Ubuntu 16.04 LTS. (CVE-2016-4072)\n\nIt was discovered that the PHP mb_strcut() function incorrectly handled\nstring formatting. A remote attacker could use this issue to cause PHP to\ncrash, resulting in a denial of service, or possibly execute arbitrary\ncode. This issue only affected Ubuntu 16.04 LTS. (CVE-2016-4073)\n\nIt was discovered that the PHP phar extension incorrectly handled certain\narchive files. A remote attacker could use this issue to cause PHP to\ncrash, resulting in a denial of service, or possibly execute arbitrary\ncode. This issue only affected Ubuntu 12.04 LTS, Ubuntu 14.04 LTS and\nUbuntu 15.10. (CVE-2016-4342, CVE-2016-4343)\n\nIt was discovered that the PHP bcpowmod() function incorrectly handled\nmemory. A remote attacker could use this issue to cause PHP to crash,\nresulting in a denial of service, or possibly execute arbitrary code. \n(CVE-2016-4537, CVE-2016-4538)\n\nIt was discovered that the PHP XML parser incorrectly handled certain\nmalformed XML data. A remote attacker could possibly use this issue to\ncause PHP to crash, resulting in a denial of service, or possibly execute\narbitrary code. (CVE-2016-4539)\n\nIt was discovered that certain PHP grapheme functions incorrectly handled\nnegative offsets. A remote attacker could possibly use this issue to cause\nPHP to crash, resulting in a denial of service. (CVE-2016-4540,\nCVE-2016-4541)\n\nIt was discovered that PHP incorrectly handled certain malformed EXIF tags.\nA remote attacker could possibly use this issue to cause PHP to crash,\nresulting in a denial of service. (CVE-2016-4542, CVE-2016-4543,\nCVE-2016-4544)\n","status":"published","published":"2016-05-24T17:31:16Z","modified":"2026-04-22T09:24:48.530084Z","updated_at":"2026-11-02T16:58:10.303275Z"}]}}