The ZIP signature-verification feature in PHP before 5.6.26 and 7.x before 7.0.11 does not ensure that the uncompressed_filesize field is large enough, which allows remote attackers to cause a denial of service (out-of-bounds memory access) or possibly have unspecified other impact via a crafted PHAR archive, related to ext/phar/util.c and ext/phar/zip.c.
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
| Link | Tags |
|---|---|
| http://www.php.net/ChangeLog-7.php | release notes |
| https://security.gentoo.org/glsa/201611-22 | vendor advisory |
| http://www.securitytracker.com/id/1036836 | vdb entry |
| http://www.securityfocus.com/bid/93004 | vdb entry |
| https://github.com/php/php-src/commit/0bfb970f43acd1e81d11be1154805f86655f15d5?w=1 | issue tracking patch |
| https://bugs.php.net/bug.php?id=72928 | issue tracking exploit |
| http://www.openwall.com/lists/oss-security/2016/09/15/10 | mailing list |
| https://access.redhat.com/errata/RHSA-2018:1296 | vendor advisory |
| http://www.php.net/ChangeLog-5.php | release notes |
| https://www.tenable.com/security/tns-2016-19 |