CVE-2016-10160 in macOS

Summary

Off-by-one error in the phar_parse_pharfile function in ext/phar/phar.c in PHP before 5.6.30 and 7.0.x before 7.0.15 allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a crafted PHAR archive with an alias mismatch.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Reservation

01/24/2017

Disclosure

01/24/2017

Status

Confirmed

Entries

VulDB provides additional information and datapoints for this CVE:

ID	Vulnerability	CWE	Exp	Cou	CVE
98608	Apple macOS apache_mod_php memory corruption	119	Not defined	Official fix	CVE-2016-10160
95877	PHP phar.c phar_parse_pharfile memory corruption	119	Not defined	Official fix	CVE-2016-10160

Sources

• MITRE
• NVD
• CVE Details