CVE-2016-5773

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2016-5773
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2016-5773.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2016-5773
Downstream
Related
Published
2016-08-07T10:59:21.650Z
Modified
2026-05-17T11:55:18.418770428Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

php_zip.c in the zip extension in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8 improperly interacts with the unserialize implementation and garbage collection, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and application crash) via crafted serialized data containing a ZipArchive object.

Database specific 
{
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "last_affected": "5.6.0-alpha4"
                },
                {
                    "last_affected": "5.6.0-alpha5"
                }
            ],
            "cpes": [
                "cpe:2.3:a:php:php:5.6.0:alpha4:*:*:*:*:*:*",
                "cpe:2.3:a:php:php:5.6.0:alpha5:*:*:*:*:*:*"
            ],
            "vendor_product": "php:php",
            "source": "CPE_FIELD"
        }
    ]
}
References

Affected packages