CVE-2016-3078
Quick assessment
Affected
n/a n/a
Exploitation
High exploitation probability; assess promptly
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
PHP（PHP：Hypertext Preprocessor，PHP：超文本预处理器）是PHP Group和开放源代码社区共同维护的一种开源的通用计算机脚本语言。该语言主要用于Web开发，支持多种数据库及操作系统。 PHP 7.0.6之前版本中的zip扩展中的php_zip.c文件存在整数溢出漏洞。远程攻击者通过调用ZipArchive类中的‘getFromIndex’或‘getFromName’参数利用该漏洞造成拒绝服务（基于堆的缓冲区溢出和应用程序崩溃）。
Public Exploits 1
ExploitDB · 1
EDB-39742 [remote]
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2016-3078
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
Multiple integer overflows in php_zip.c in the zip extension in PHP before 7.0.6 allow remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted call to (1) getFromIndex or (2) getFromName in the ZipArchive class.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
PHP 整数溢出漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
PHP（PHP：Hypertext Preprocessor，PHP：超文本预处理器）是PHP Group和开放源代码社区共同维护的一种开源的通用计算机脚本语言。该语言主要用于Web开发，支持多种数据库及操作系统。 PHP 7.0.6之前版本中的zip扩展中的php_zip.c文件存在整数溢出漏洞。远程攻击者通过调用ZipArchive类中的‘getFromIndex’或‘getFromName’参数利用该漏洞造成拒绝服务（基于堆的缓冲区溢出和应用程序崩溃）。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| - | n/a | n/a | - |
|
II. Public POCs for CVE-2016-3078
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2016-3078
请登录查看更多情报信息。
Patches & Fixes for CVE-2016-3078 (1)
Vendor Advisories for CVE-2016-3078 (2)
-
🔗 https://security-tracker.debian.org/tracker/CVE-2016-3078 x_refsource_CONFIRM
-
Exploits & Public PoCs for CVE-2016-3078 (1)
Mailing List Discussions for CVE-2016-3078 (1)
Other References for CVE-2016-3078 (2)
-
🔗 https://php.net/ChangeLog-7.php x_refsource_CONFIRM
-
https://bugs.php.net/bug.php?id=71923 x_refsource_CONFIRM
Same Patch Batch · n/a · 2016-08-07 · 50 CVEs total
| CVE-2016-5094 | PHP 整数溢出漏洞 | |
| CVE-2016-5767 | PHP GD Graphics Library 整数溢出漏洞 | |
| CVE-2016-5771 | PHP SPL扩展释放后重用漏洞 | |
| CVE-2016-5772 | PHP WDDX扩展双重释放漏洞 | |
| CVE-2016-5773 | PHP zip扩展释放后重用漏洞 | |
| CVE-2016-6128 | PHP 输入验证错误漏洞 | |
| CVE-2016-6515 | OpenSSH输入验证错误漏洞 | |
| CVE-2016-5770 | PHP SPL扩展整数溢出漏洞 | |
| CVE-2016-5096 | PHP 整数溢出漏洞 | |
| CVE-2016-5095 | PHP 整数溢出漏洞 | |
| CVE-2016-5114 | PHP 缓冲区溢出漏洞 | |
| CVE-2016-5093 | PHP 安全漏洞 | |
| CVE-2016-3132 | PHP 双重释放漏洞 | |
| CVE-2015-8935 | PHP 安全漏洞 | |
| CVE-2013-7456 | PHP 拒绝服务漏洞 | |
| CVE-2016-6635 | WordPress 跨站请求伪造漏洞 | |
| CVE-2016-6634 | WordPress 跨站脚本漏洞 | |
| CVE-2016-5359 | Wireshark WBXML解析器整数溢出漏洞 | |
| CVE-2016-5358 | Wireshark Ethernet解析器拒绝服务漏洞 | |
| CVE-2016-5357 | Wireshark NetScreen文件解析器基于堆的缓冲区溢出漏洞 |
Showing top 20 of 50 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
V. Comments for CVE-2016-3078
No comments yet