CVE-2016-3142

The pharparsezipfile function in zip.c in the PHAR extension in PHP before 5.5.33 and 5.6.x before 5.6.19 allows remote attackers to obtain sensitive information from process memory or cause a denial of service (out-of-bounds read and application crash) by placing a PK\x05\x06 signature at an invalid location.

Database specific

{
    "unresolved_ranges": [
        {
            "source": "CPE_FIELD",
            "cpes": [
                "cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*"
            ],
            "vendor_product": "apple:mac_os_x",
            "extracted_events": [
                {
                    "last_affected": "10.11.4"
                }
            ]
        }
    ]
}

References

CVE-2016-3142

Affected packages