Description

The bzread function in ext/bz2/bz2.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 allows remote attackers to cause a denial of service (out-of-bounds write) or execute arbitrary code via a crafted bz2 archive.

Remediation

References

CVE-2016-5399

Related Vulnerabilities

LimeSurvey Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2022-43279)

WebLogic CVE-2017-10352 Vulnerability (CVE-2017-10352)

WebLogic CVE-2021-1995 Vulnerability (CVE-2021-1995)

MediaWiki Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2017-8808)

WordPress Plugin Compact WP Audio Player Cross-Site Scripting (1.9.7)

Severity

High

Classification

CVE-2016-5399 CWE-787 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities