Vulnerability CVE-2016-4473

Vulnerability Name:

CVE-2016-4473 (CCN-127911)

Assigned:

2016-06-17

Published:

2016-06-17

Updated:

2017-06-16

Summary:

/ext/phar/phar_object.c in PHP 7.0.7 and 5.6.x allows remote attackers to execute arbitrary code.
Note: Introduced as part of an incomplete fix to CVE-2015-6833.

CVSS v3 Severity:

9.8 Critical (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
8.5 High (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): High Integrity (I): High Availibility (A): High

9.8 Critical (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
8.5 High (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): High Integrity (I): High Availibility (A): High

CVSS v2 Severity:

7.5 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Authentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): Partial

10.0 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Athentication (Au): None
Impact Metrics:	Confidentiality (C): Complete Integrity (I): Complete Availibility (A): Complete

Vulnerability Type:

CWE-416

Vulnerability Consequences:

Gain Access

References:

Source: MITRE
Type: CNA
CVE-2016-4473

Source: CCN
Type: PHP GIT Repository
Fix bug #72321 - use efree() for emalloc allocation

Source: SUSE
Type: Third Party Advisory
SUSE-SU-2016:2460

Source: REDHAT
Type: Third Party Advisory, VDB Entry
RHSA-2016:2750

Source: BID
Type: Third Party Advisory, VDB Entry
98999

Source: CCN
Type: BID-98999
PHP CVE-2016-4473 Incomplete Fix Remote Code Execution Vulnerability

Source: CCN
Type: Red Hat Bugzilla Bug 1347772
(CVE-2016-4473) CVE-2016-4473 php: Invalid free() instead of efree() in phar_extract_file()

Source: CONFIRM
Type: Exploit, Issue Tracking, Patch, Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1347772

Source: XF
Type: UNKNOWN
php-cve20164473-code-exec(127911)

Vulnerable Configuration:

Configuration 1:

cpe:/a:php:php:5.6.0:alpha1:*:*:*:*:*:*

OR cpe:/a:php:php:5.6.0:alpha2:*:*:*:*:*:*

OR cpe:/a:php:php:5.6.0:alpha3:*:*:*:*:*:*

OR cpe:/a:php:php:5.6.0:alpha4:*:*:*:*:*:*

OR cpe:/a:php:php:5.6.0:alpha5:*:*:*:*:*:*

OR cpe:/a:php:php:5.6.0:beta1:*:*:*:*:*:*

OR cpe:/a:php:php:5.6.0:beta2:*:*:*:*:*:*

OR cpe:/a:php:php:5.6.0:beta3:*:*:*:*:*:*

OR cpe:/a:php:php:5.6.0:beta4:*:*:*:*:*:*

OR cpe:/a:php:php:5.6.1:-:*:*:*:*:*:*

OR cpe:/a:php:php:5.6.2:*:*:*:*:*:*:*

OR cpe:/a:php:php:5.6.3:-:*:*:*:*:*:*

OR cpe:/a:php:php:5.6.4:-:*:*:*:*:*:*

OR cpe:/a:php:php:5.6.5:-:*:*:*:*:*:*

OR cpe:/a:php:php:5.6.6:-:*:*:*:*:*:*

OR cpe:/a:php:php:5.6.7:-:*:*:*:*:*:*

OR cpe:/a:php:php:5.6.8:-:*:*:*:*:*:*

OR cpe:/a:php:php:5.6.9:-:*:*:*:*:*:*

OR cpe:/a:php:php:5.6.10:-:*:*:*:*:*:*

OR cpe:/a:php:php:5.6.11:-:*:*:*:*:*:*

OR cpe:/a:php:php:5.6.12:-:*:*:*:*:*:*

OR cpe:/a:php:php:5.6.13:-:*:*:*:*:*:*

OR cpe:/a:php:php:5.6.14:-:*:*:*:*:*:*

OR cpe:/a:php:php:5.6.15:-:*:*:*:*:*:*

OR cpe:/a:php:php:5.6.16:-:*:*:*:*:*:*

OR cpe:/a:php:php:5.6.17:-:*:*:*:*:*:*

OR cpe:/a:php:php:5.6.18:-:*:*:*:*:*:*

OR cpe:/a:php:php:5.6.19:-:*:*:*:*:*:*

OR cpe:/a:php:php:5.6.20:-:*:*:*:*:*:*

OR cpe:/a:php:php:5.6.21:-:*:*:*:*:*:*

OR cpe:/a:php:php:5.6.22:-:*:*:*:*:*:*

OR cpe:/a:php:php:7.0.7:-:*:*:*:*:*:*

Configuration 2:

cpe:/o:suse:linux_enterprise_module_for_web_scripting:12:*:*:*:*:*:*:*

OR cpe:/o:suse:linux_enterprise_software_development_kit:12:sp1:*:*:*:*:*:*

Configuration CCN 1:

cpe:/a:php:php:7.0.7:-:*:*:*:*:*:*

Denotes that component is vulnerable

Oval Definitions

Definition ID	Class	Title	Last Modified
oval:org.opensuse.security:def:7714	P	log4j12-1.2.17-4.9.1 on GA media (Moderate)	2023-06-12
oval:org.opensuse.security:def:7736	P	perl-5.26.1-150300.17.11.1 on GA media (Moderate)	2023-06-12
oval:org.opensuse.security:def:20164473	V	CVE-2016-4473	2022-09-02
oval:org.opensuse.security:def:10439	P	Security update for SDL2 (Important) (in QA)	2022-01-12
oval:org.opensuse.security:def:9885	P	Security update for SDL2 (Important) (in QA)	2022-01-12
oval:org.opensuse.security:def:10710	P	Security update for the Linux Kernel (Important) (in QA)	2022-01-07
oval:org.opensuse.security:def:9635	P	Security update for xorg-x11-server (Important)	2021-12-20
oval:org.opensuse.security:def:7012	P	Security update for the Linux Kernel (Live Patch 20 for SLE 15 SP1) (Important)	2021-12-14
oval:org.opensuse.security:def:10372	P	Security update for aaa_base (Moderate)	2021-12-03
oval:org.opensuse.security:def:10176	P	Security update for java-1_8_0-openjdk (Important)	2021-11-23
oval:org.opensuse.security:def:6987	P	Security update for the Linux Kernel (Live Patch 21 for SLE 15 SP1) (Important)	2021-11-17
oval:org.opensuse.security:def:9613	P	Security update for tomcat (Important)	2021-11-16
oval:org.opensuse.security:def:10170	P	Security update for qemu (Important)	2021-11-04
oval:org.opensuse.security:def:9605	P	Security update for busybox (Important)	2021-10-27
oval:org.opensuse.security:def:38662	P	Security update for MozillaFirefox (Important)	2021-10-01
oval:org.opensuse.security:def:10154	P	Security update for ghostscript (Critical)	2021-09-15
oval:org.opensuse.security:def:10148	P	Security update for ffmpeg (Important)	2021-09-02
oval:org.opensuse.security:def:10140	P	Security update for java-1_8_0-openjdk (Important)	2021-08-20
oval:org.opensuse.security:def:13912	P	libipa_hbac0-1.13.4-18.10 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:14002	P	perl-32bit-5.18.2-11.1 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:14249	P	libldap-2_4-2-2.4.41-18.29.1 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:14068	P	xorg-x11-server-7.6_1.18.3-57.34 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:14180	P	kernel-default-4.4.73-5.1 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:14911	P	gstreamer-1.8.3-9.5 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:13934	P	libnghttp2-14-1.7.1-1.84 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:9762	P	Security update for cpio (Important)	2021-08-16
oval:org.opensuse.security:def:14050	P	unzip-6.00-32.1 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:14260	P	libmysqlclient18-10.0.30-28.1 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:14087	P	apache2-mod_perl-2.0.8-11.43 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:14205	P	libXvMC1-1.0.8-7.1 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:14273	P	libpng12-0-1.2.50-19.1 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:13904	P	libgraphite2-3-1.3.1-6.1 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:14933	P	java-1_8_0-ibm-1.8.0_sr5.40-30.54.1 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:11099	P	Security update for fossil (Moderate)	2021-07-17
oval:org.opensuse.security:def:10685	P	Security update for the Linux Kernel (Important)	2021-07-15
oval:org.opensuse.security:def:9743	P	Security update for ovmf (Important)	2021-06-25
oval:org.opensuse.security:def:10112	P	Security update for ovmf (Important)	2021-06-25
oval:org.opensuse.security:def:6912	P	Security update for the Linux Kernel (Live Patch 19 for SLE 15 SP1) (Important)	2021-06-18
oval:org.opensuse.security:def:9728	P	Security update for containerd, docker, runc (Important)	2021-06-11
oval:org.opensuse.security:def:10278	P	Security update for ucode-intel (Important)	2021-06-10
oval:org.opensuse.security:def:17064	P	libgadu3-1.11.4-1.12 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:11412	P	libvorbis0-1.3.3-8.23 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:17155	P	bash-lang-4.3-82.1 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:16671	P	xorg-x11-devel-7.6-45.14 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:16099	P	php7-devel-7.0.7-15.1 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:17121	P	libid3tag0-0.15.1b-182.58 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:17032	P	pidgin-otr-4.0.0-6.18 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:36544	P	python-32bit-2.6.9-0.35.1 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:16349	P	php7-devel-7.0.7-49.1 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:11434	P	pcsc-ccid-1.4.14-1.45 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:124641	P	php7-devel-7.0.7-50.52.1 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:17133	P	libsilc-1_1-2-1.1.10-24.128 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:16635	P	php7-devel-7.0.7-50.52.1 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:36502	P	libwebkit-1_0-2-1.2.7-0.17.1 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:10087	P	Security update for polkit (Important)	2021-06-03
oval:org.opensuse.security:def:10263	P	Security update for ceph (Important)	2021-06-02
oval:org.opensuse.security:def:6893	P	Security update for the Linux Kernel (Important)	2021-05-18
oval:org.opensuse.security:def:7076	P	Security update for the Linux Kernel (Live Patch 3 for SLE 15 SP2) (Important)	2021-04-28
oval:org.opensuse.security:def:6878	P	Security update for the Linux Kernel (Live Patch 18 for SLE 15 SP1) (Important)	2021-04-07
oval:org.opensuse.security:def:7063	P	Security update for the Linux Kernel (Live Patch 5 for SLE 15 SP2) (Important)	2021-04-07
oval:org.opensuse.security:def:9681	P	Security update for MozillaFirefox (Important)	2021-04-01
oval:org.opensuse.security:def:9863	P	Security update for git (Important)	2021-03-09
oval:org.opensuse.security:def:9862	P	Security update for openssl-1_1 (Moderate)	2021-03-09
oval:org.opensuse.security:def:10216	P	Security update for wpa_supplicant (Important)	2021-03-08
oval:org.opensuse.security:def:9855	P	Security update for bind (Important)	2021-03-02
oval:org.opensuse.security:def:10397	P	Security update for salt (Critical)	2021-02-26
oval:org.opensuse.security:def:9837	P	Security update for containerd, docker, docker-runc, golang-github-docker-libnetwork (Important)	2021-02-11
oval:org.opensuse.security:def:10163	P	Security update for python-urllib3 (Moderate)	2021-02-08
oval:org.opensuse.security:def:10297	P	Security update for go1.14 (Moderate)	2021-01-26
oval:org.opensuse.security:def:11121	P	Security update for viewvc (Moderate)	2021-01-19
oval:org.opensuse.security:def:35237	P	Security update for gimp (Moderate)	2020-12-29
oval:org.opensuse.security:def:10586	P	Security update for PackageKit (Moderate)	2020-12-16
oval:org.opensuse.security:def:7054	P	Security update for the Linux Kernel (Live Patch 6 for SLE 15 SP2) (Important)	2020-12-07
oval:org.opensuse.security:def:13245	P	apache2-mod_php7-7.0.7-15.1 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:35753	P	libmusicbrainz4-2.1.5-5.18 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:35820	P	ruby-1.8.7.p357-0.7.1 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:16948	P	php7-devel-7.0.7-50.85.1 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:16679	P	LibVNCServer-devel-0.9.9-17.14.1 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:35704	P	g3utils-1.1.36-26.31 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:16798	P	libbz2-devel-1.0.6-30.8.1 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:16886	P	libsilc-1_1-2-1.1.10-24.115 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:35864	P	apache2-mod_jk-1.2.26-1.30.110 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:46365	P	apache2-mod_php7-7.0.7-15.1 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:35792	P	openslp-1.2.0-172.22.1 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:35645	P	unrar-3.80.2-2.8 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:16713	P	dovecot22-devel-2.2.31-19.17.1 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:16855	P	libofx-0.9.9-3.7.1 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:16922	P	libzmq3-4.0.4-15.3.1 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:35006	P	Security update for gnutls (Moderate)	2020-12-01
oval:org.opensuse.security:def:38554	P	bind on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:9926	P	libtcnative-1-0 on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:10448	P	gnome-shell-devel on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:35101	P	Security update for the Linux Kernel (Important)	2020-12-01
oval:org.opensuse.security:def:10836	P	php7-devel on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:6785	P	libyaml-0-2 on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:35338	P	Security update for mozilla-nspr, mozilla-nss (Important)	2020-12-01
oval:org.opensuse.security:def:9931	P	libusbmuxd4 on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:35485	P	Security update for php53 (Moderate)	2020-12-01
oval:org.opensuse.security:def:17819	P	Security update for php7 (Important)	2020-12-01
oval:org.opensuse.security:def:10483	P	libapr1 on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:39411	P	Security update for the Linux Kernel (Important)	2020-12-01
oval:org.opensuse.security:def:9993	P	squidGuard on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:10564	P	libxerces-c-devel on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:37912	P	liblouis-data on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:10576	P	nut-cgi on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:10761	P	libmusicbrainz-devel on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:38007	P	mutt on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:10610	P	xfig on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:38246	P	libSoundTouch0 on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:35005	P	Security update for gnutls	2020-12-01
oval:org.opensuse.security:def:38729	P	libsrtp1 on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:6755	P	libsmi on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:38394	P	libvncclient0 on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:9913	P	libraptor2-0 on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:35017	P	Security update for grub2 (Important)	2020-12-01
oval:org.opensuse.security:def:38613	P	grub2 on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:10814	P	libxslt-devel on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:6763	P	libssh2-1 on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:10774	P	libplist++-devel on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:10453	P	hplip-devel on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:6831	P	rhythmbox on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:35395	P	Security update for openslp (Important)	2020-12-01
oval:org.opensuse.security:def:17793	P	Security update for MozillaFirefox (Important)	2020-12-01
oval:org.opensuse.security:def:10461	P	lib3ds-1-3 on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:38773	P	perl-LWP-Protocol-https on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:37911	P	libldb1 on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:9978	P	python-requests on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:10529	P	libpcscspy0 on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:39453	P	Security update for php7 (Important)	2020-12-01
oval:org.opensuse.security:def:10012	P	w3m on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:10752	P	libjson-c-devel on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:37923	P	libncurses5-32bit on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:10591	P	python3-devel on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:7045	P	libgssglue1 on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:38144	P	bzip2 on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:38701	P	libmusicbrainz4 on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:38304	P	libipa_hbac0 on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:9904	P	libpng16-16 on GA media (Moderate)	2020-12-01
oval:com.ubuntu.xenial:def:201644730000000	V	CVE-2016-4473 on Ubuntu 16.04 LTS (xenial) - medium.	2017-06-08
oval:com.ubuntu.trusty:def:20164473000	V	CVE-2016-4473 on Ubuntu 14.04 LTS (trusty) - medium.	2017-06-08
oval:com.ubuntu.xenial:def:20164473000	V	CVE-2016-4473 on Ubuntu 16.04 LTS (xenial) - medium.	2017-06-08
oval:com.ubuntu.precise:def:20164473000	V	CVE-2016-4473 on Ubuntu 12.04 LTS (precise) - medium.	2016-08-23

BACK