CVE-2016-5773

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2016-5773
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-5773.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2016-5773
Downstream
Related
Published
2016-08-07T10:59:21.650Z
Modified
2026-07-08T12:27:26.072601Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

php_zip.c in the zip extension in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8 improperly interacts with the unserialize implementation and garbage collection, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and application crash) via crafted serialized data containing a ZipArchive object.

Database specific 
{
    "unresolved_ranges": [
        {
            "cpes": [
                "cpe:2.3:a:php:php:5.6.0:alpha4:*:*:*:*:*:*",
                "cpe:2.3:a:php:php:5.6.0:alpha5:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "introduced": "5.6.0-alpha4"
                },
                {
                    "last_affected": "5.6.0-alpha4"
                },
                {
                    "introduced": "5.6.0-alpha5"
                },
                {
                    "last_affected": "5.6.0-alpha5"
                }
            ],
            "vendor_product": "php:php",
            "source": "CPE_STRING"
        }
    ]
}
References

Affected packages

Git / github.com/php/php-src

Affected ranges

Type
GIT
Repo
https://github.com/php/php-src
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
527e8e73c97e282b1efde24cfb95dc0942e0ad59
Introduced
8648f76bac2f78391a1539253f21d62f53d83022
Last affected
fb59213fc461f079bc218abf44cb5e2b4db2182c
Fixed
f6aef68089221c5ea047d4a74224ee3deead99a6
Database specific 
{
    "cpe": [
        "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:php:php:5.6.0:alpha1:*:*:*:*:*:*",
        "cpe:2.3:a:php:php:5.6.0:alpha2:*:*:*:*:*:*",
        "cpe:2.3:a:php:php:5.6.0:alpha3:*:*:*:*:*:*",
        "cpe:2.3:a:php:php:5.6.0:beta1:*:*:*:*:*:*",
        "cpe:2.3:a:php:php:5.6.0:beta2:*:*:*:*:*:*",
        "cpe:2.3:a:php:php:5.6.0:beta3:*:*:*:*:*:*",
        "cpe:2.3:a:php:php:5.6.0:beta4:*:*:*:*:*:*",
        "cpe:2.3:a:php:php:5.6.1:*:*:*:*:*:*:*",
        "cpe:2.3:a:php:php:5.6.2:*:*:*:*:*:*:*",
        "cpe:2.3:a:php:php:5.6.3:*:*:*:*:*:*:*",
        "cpe:2.3:a:php:php:5.6.4:*:*:*:*:*:*:*",
        "cpe:2.3:a:php:php:5.6.5:*:*:*:*:*:*:*",
        "cpe:2.3:a:php:php:5.6.6:*:*:*:*:*:*:*",
        "cpe:2.3:a:php:php:5.6.7:*:*:*:*:*:*:*",
        "cpe:2.3:a:php:php:5.6.8:*:*:*:*:*:*:*",
        "cpe:2.3:a:php:php:5.6.9:*:*:*:*:*:*:*",
        "cpe:2.3:a:php:php:5.6.10:*:*:*:*:*:*:*",
        "cpe:2.3:a:php:php:5.6.11:*:*:*:*:*:*:*",
        "cpe:2.3:a:php:php:5.6.12:*:*:*:*:*:*:*",
        "cpe:2.3:a:php:php:5.6.13:*:*:*:*:*:*:*",
        "cpe:2.3:a:php:php:5.6.14:*:*:*:*:*:*:*",
        "cpe:2.3:a:php:php:5.6.15:*:*:*:*:*:*:*",
        "cpe:2.3:a:php:php:5.6.16:*:*:*:*:*:*:*",
        "cpe:2.3:a:php:php:5.6.17:*:*:*:*:*:*:*",
        "cpe:2.3:a:php:php:5.6.18:*:*:*:*:*:*:*",
        "cpe:2.3:a:php:php:5.6.19:*:*:*:*:*:*:*",
        "cpe:2.3:a:php:php:5.6.20:*:*:*:*:*:*:*",
        "cpe:2.3:a:php:php:5.6.21:*:*:*:*:*:*:*",
        "cpe:2.3:a:php:php:5.6.22:*:*:*:*:*:*:*",
        "cpe:2.3:a:php:php:5.6.23:*:*:*:*:*:*:*",
        "cpe:2.3:a:php:php:7.0.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:php:php:7.0.1:*:*:*:*:*:*:*",
        "cpe:2.3:a:php:php:7.0.2:*:*:*:*:*:*:*",
        "cpe:2.3:a:php:php:7.0.3:*:*:*:*:*:*:*",
        "cpe:2.3:a:php:php:7.0.4:*:*:*:*:*:*:*",
        "cpe:2.3:a:php:php:7.0.5:*:*:*:*:*:*:*",
        "cpe:2.3:a:php:php:7.0.6:*:*:*:*:*:*:*",
        "cpe:2.3:a:php:php:7.0.7:*:*:*:*:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "5.5.36"
        },
        {
            "introduced": "5.6.0-alpha1"
        },
        {
            "last_affected": "5.6.0-alpha1"
        },
        {
            "introduced": "5.6.0-alpha2"
        },
        {
            "last_affected": "5.6.0-alpha2"
        },
        {
            "introduced": "5.6.0-alpha3"
        },
        {
            "last_affected": "5.6.0-alpha3"
        },
        {
            "introduced": "5.6.0-beta1"
        },
        {
            "last_affected": "5.6.0-beta1"
        },
        {
            "introduced": "5.6.0-beta2"
        },
        {
            "last_affected": "5.6.0-beta2"
        },
        {
            "introduced": "5.6.0-beta3"
        },
        {
            "last_affected": "5.6.0-beta3"
        },
        {
            "introduced": "5.6.0-beta4"
        },
        {
            "last_affected": "5.6.0-beta4"
        },
        {
            "introduced": "5.6.1"
        },
        {
            "last_affected": "5.6.1"
        },
        {
            "introduced": "5.6.2"
        },
        {
            "last_affected": "5.6.2"
        },
        {
            "introduced": "5.6.3"
        },
        {
            "last_affected": "5.6.3"
        },
        {
            "introduced": "5.6.4"
        },
        {
            "last_affected": "5.6.4"
        },
        {
            "introduced": "5.6.5"
        },
        {
            "last_affected": "5.6.5"
        },
        {
            "introduced": "5.6.6"
        },
        {
            "last_affected": "5.6.6"
        },
        {
            "introduced": "5.6.7"
        },
        {
            "last_affected": "5.6.7"
        },
        {
            "introduced": "5.6.8"
        },
        {
            "last_affected": "5.6.8"
        },
        {
            "introduced": "5.6.9"
        },
        {
            "last_affected": "5.6.9"
        },
        {
            "introduced": "5.6.10"
        },
        {
            "last_affected": "5.6.10"
        },
        {
            "introduced": "5.6.11"
        },
        {
            "last_affected": "5.6.11"
        },
        {
            "introduced": "5.6.12"
        },
        {
            "last_affected": "5.6.12"
        },
        {
            "introduced": "5.6.13"
        },
        {
            "last_affected": "5.6.13"
        },
        {
            "introduced": "5.6.14"
        },
        {
            "last_affected": "5.6.14"
        },
        {
            "introduced": "5.6.15"
        },
        {
            "last_affected": "5.6.15"
        },
        {
            "introduced": "5.6.16"
        },
        {
            "last_affected": "5.6.16"
        },
        {
            "introduced": "5.6.17"
        },
        {
            "last_affected": "5.6.17"
        },
        {
            "introduced": "5.6.18"
        },
        {
            "last_affected": "5.6.18"
        },
        {
            "introduced": "5.6.19"
        },
        {
            "last_affected": "5.6.19"
        },
        {
            "introduced": "5.6.20"
        },
        {
            "last_affected": "5.6.20"
        },
        {
            "introduced": "5.6.21"
        },
        {
            "last_affected": "5.6.21"
        },
        {
            "introduced": "5.6.22"
        },
        {
            "last_affected": "5.6.22"
        },
        {
            "introduced": "5.6.23"
        },
        {
            "last_affected": "5.6.23"
        },
        {
            "introduced": "7.0.0"
        },
        {
            "last_affected": "7.0.0"
        },
        {
            "introduced": "7.0.1"
        },
        {
            "last_affected": "7.0.1"
        },
        {
            "introduced": "7.0.2"
        },
        {
            "last_affected": "7.0.2"
        },
        {
            "introduced": "7.0.3"
        },
        {
            "last_affected": "7.0.3"
        },
        {
            "introduced": "7.0.4"
        },
        {
            "last_affected": "7.0.4"
        },
        {
            "introduced": "7.0.5"
        },
        {
            "last_affected": "7.0.5"
        },
        {
            "introduced": "7.0.6"
        },
        {
            "last_affected": "7.0.6"
        },
        {
            "introduced": "7.0.7"
        },
        {
            "last_affected": "7.0.7"
        }
    ],
    "source": [
        "CPE_RANGE",
        "CPE_STRING",
        "REFERENCES"
    ]
}

Affected versions

5.*
5.6.0-alpha1
5.6.0-alpha2
5.6.0-alpha3
5.6.0-beta1
5.6.0-beta2
5.6.0-beta3
5.6.0-beta4
5.6.1
5.6.10
5.6.11
5.6.12
5.6.13
5.6.14
5.6.15
5.6.16
5.6.17
5.6.18
5.6.19
5.6.2
5.6.20
5.6.21
5.6.22
5.6.23
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
7.*
7.0.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
Other
POST_64BIT_BRANCH_MERGE
POST_AST_MERGE
POST_PHP7_NSAPI_REMOVAL
POST_PHP7_REMOVALS
POST_PHPNG_MERGE
PRE_64BIT_BRANCH_MERGE
PRE_AST_MERGE
PRE_PHP7_EREG_MYSQL_REMOVALS
PRE_PHP7_NSAPI_REMOVAL
PRE_PHP7_REMOVALS
php-5.*
php-5.5.36
php-7.*
php-7.0.7
php-7.0.7RC1

Database specific

vanir_signatures 
[
    {
        "source": "https://github.com/php/php-src/commit/f6aef68089221c5ea047d4a74224ee3deead99a6",
        "signature_version": "v1",
        "signature_type": "Line",
        "digest": {
            "line_hashes": [
                "336596916085203698350057541604668175738",
                "312605460516307546358655968823750311776",
                "202289105112210415793622660399889669894",
                "2659789645517324669066205643089415753",
                "44597108971789535196204357436920634856",
                "23647072536535761014923467067741495308"
            ],
            "threshold": 0.9
        },
        "deprecated": false,
        "id": "CVE-2016-5773-0450c870",
        "target": {
            "file": "ext/zip/php_zip.c"
        }
    },
    {
        "source": "https://github.com/php/php-src/commit/f6aef68089221c5ea047d4a74224ee3deead99a6",
        "signature_version": "v1",
        "signature_type": "Function",
        "digest": {
            "function_hash": "119329149946522731800414006082504987445",
            "length": 3706.0
        },
        "deprecated": false,
        "id": "CVE-2016-5773-76d74a1e",
        "target": {
            "function": "PHP_MINIT_FUNCTION",
            "file": "ext/zip/php_zip.c"
        }
    }
]
vanir_signatures_modified 
"2026-07-08T12:27:26Z"
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-5773.json"