Description
Integer overflow in the virtual_file_ex function in TSRM/tsrm_virtual_cwd.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 allows remote attackers to cause a denial of service (stack-based buffer overflow) or possibly have unspecified other impact via a crafted extract operation on a ZIP archive.
Remediation
References
Related Vulnerabilities
WordPress Plugin bib2html Cross-Site Scripting (0.9.3)
Serendipity Remote Code Execution (CVE-2020-10964)
WordPress Plugin FireStats 'firestats-wordpress.php' Remote File Include (1.6.1)
WordPress Plugin Download Monitor Information Disclosure (1.6.3)
WordPress Plugin Media Library Assistant SQL Injection (3.05)