CVE-2016-6289

Integer overflow in the virtualfileex function in TSRM/tsrmvirtualcwd.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 allows remote attackers to cause a denial of service (stack-based buffer overflow) or possibly have unspecified other impact via a crafted extract operation on a ZIP archive.

Database specific

{
    "unresolved_ranges": [
        {
            "source": "CPE_FIELD",
            "cpes": [
                "cpe:2.3:a:php:php:5.6.0:alpha4:*:*:*:*:*:*",
                "cpe:2.3:a:php:php:5.6.0:alpha5:*:*:*:*:*:*"
            ],
            "vendor_product": "php:php",
            "extracted_events": [
                {
                    "last_affected": "5.6.0-alpha4"
                },
                {
                    "last_affected": "5.6.0-alpha5"
                }
            ]
        }
    ]
}

References

CVE-2016-6289

Affected packages