Description

Off-by-one error in the phar_parse_pharfile function in ext/phar/phar.c in PHP before 5.6.30 and 7.0.x before 7.0.15 allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a crafted PHAR archive with an alias mismatch.

Remediation

References

CVE-2016-10160

Related Vulnerabilities

MediaWiki Allocation of Resources Without Limits or Throttling Vulnerability (CVE-2021-41799)

SharePoint CVE-2020-17115 Vulnerability (CVE-2020-17115)

WordPress Plugin Disclosure Policy 'abspath' Parameter Remote File Include (1.0)

Dolibarr Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2017-9435)

WordPress Plugin Joy Of Text Lite-SMS messaging for WordPress SQL Injection (2.3.0)

Severity

Critical

Classification

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities CWE-119 CVE-2016-10160