CVE-2016-3142
php: Out-of-bounds read in phar_parse_zipfile()
Severity
LowRed Hat Product Security
CVSS 2.0
Review impact separately from score.
Published · February 2, 2016
Updated · June 28, 2026
Description
The phar_parse_zipfile function in zip.c in the PHAR extension in PHP before 5.5.33 and 5.6.x before 5.6.19 allows remote attackers to obtain sensitive information from process memory or cause a denial of service (out-of-bounds read and application crash) by placing a PK\x05\x06 signature at an invalid location.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 2.0 · 2.6AV:N/AC:H/Au:N/C:N/I:N/A:P
CWE-125 · Out-of-bounds Read