Bugzilla – Bug 1022257
VUL-0: CVE-2016-10160: php: ext/phar/phar.c :: phar_parse_pharfile off-by-one error via crafted PHAR archives with an alias mismatch
Last modified: 2017-07-11 14:47:47 UTC
Off-by-one error in the phar_parse_pharfile function in ext/phar/phar.c in PHP before 5.6.30 and 7.0.x before 7.0.15 allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a crafted PHAR archive with an alias mismatch. QA reproducer submitted as test in https://github.com/php/php-src/commit/b28b8b2fee6dfa6fcd13305c581bb835689ac3be References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-10160 http://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-10160.html http://www.cvedetails.com/cve/CVE-2016-10160/ http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10160 https://github.com/php/php-src/commit/b28b8b2fee6dfa6fcd13305c581bb835689ac3be https://bugs.php.net/bug.php?id=73768 http://www.securityfocus.com/bid/95783
From 5.3
bugbot adjusting priority
BEFORE 12/php7, 12/php5 $ USE_ZEND_ALLOC=0 php test.php [...] Aborted (core dumped) $ 11sp3/php53 $ php test.php zend_mm_heap corrupted $ AFTER all php $ USE_ZEND_ALLOC=0 php test.php cannot load phar "/022257/bug73768.phar" with implicit alias "" under different alias "alias.phar" $
I believe all fixed.
SUSE-SU-2017:0534-1: An update that fixes 13 vulnerabilities is now available. Category: security (important) Bug References: 1008026,1019547,1019550,1019568,1019570,1022219,1022255,1022257,1022260,1022262,1022263,1022264,1022265 CVE References: CVE-2016-10158,CVE-2016-10159,CVE-2016-10160,CVE-2016-10161,CVE-2016-10162,CVE-2016-10166,CVE-2016-10167,CVE-2016-10168,CVE-2016-7478,CVE-2016-7479,CVE-2016-7480,CVE-2016-9138,CVE-2017-5340 Sources used: SUSE Linux Enterprise Software Development Kit 12-SP2 (src): php7-7.0.7-35.1 SUSE Linux Enterprise Software Development Kit 12-SP1 (src): php7-7.0.7-35.1 SUSE Linux Enterprise Module for Web Scripting 12 (src): php7-7.0.7-35.1
SUSE-SU-2017:0556-1: An update that fixes 8 vulnerabilities is now available. Category: security (important) Bug References: 1019550,1022219,1022255,1022257,1022260,1022263,1022264,1022265 CVE References: CVE-2016-10158,CVE-2016-10159,CVE-2016-10160,CVE-2016-10161,CVE-2016-10166,CVE-2016-10167,CVE-2016-10168,CVE-2016-7478 Sources used: SUSE Linux Enterprise Software Development Kit 12-SP2 (src): php5-5.5.14-96.1 SUSE Linux Enterprise Software Development Kit 12-SP1 (src): php5-5.5.14-96.1 SUSE Linux Enterprise Module for Web Scripting 12 (src): php5-5.5.14-96.1
SUSE-SU-2017:0568-1: An update that fixes 8 vulnerabilities is now available. Category: security (important) Bug References: 1019550,1022219,1022255,1022257,1022260,1022263,1022264,1022265 CVE References: CVE-2016-10158,CVE-2016-10159,CVE-2016-10160,CVE-2016-10161,CVE-2016-10166,CVE-2016-10167,CVE-2016-10168,CVE-2016-7478 Sources used: SUSE OpenStack Cloud 5 (src): php53-5.3.17-101.1 SUSE Manager Proxy 2.1 (src): php53-5.3.17-101.1 SUSE Manager 2.1 (src): php53-5.3.17-101.1 SUSE Linux Enterprise Software Development Kit 11-SP4 (src): php53-5.3.17-101.1 SUSE Linux Enterprise Server 11-SP4 (src): php53-5.3.17-101.1 SUSE Linux Enterprise Server 11-SP3-LTSS (src): php53-5.3.17-101.1 SUSE Linux Enterprise Point of Sale 11-SP3 (src): php53-5.3.17-101.1 SUSE Linux Enterprise Debuginfo 11-SP4 (src): php53-5.3.17-101.1 SUSE Linux Enterprise Debuginfo 11-SP3 (src): php53-5.3.17-101.1
openSUSE-SU-2017:0588-1: An update that fixes 13 vulnerabilities is now available. Category: security (important) Bug References: 1008026,1019547,1019550,1019568,1019570,1022219,1022255,1022257,1022260,1022262,1022263,1022264,1022265 CVE References: CVE-2016-10158,CVE-2016-10159,CVE-2016-10160,CVE-2016-10161,CVE-2016-10162,CVE-2016-10166,CVE-2016-10167,CVE-2016-10168,CVE-2016-7478,CVE-2016-7479,CVE-2016-7480,CVE-2016-9138,CVE-2017-5340 Sources used: openSUSE Leap 42.2 (src): php7-7.0.7-12.1
All affected codestreams released. openSUSE comes from SLE. Closing.