Skip to content
OpenAdvisories
Unscored USN-2984-1 17 CVEs

php5, php7.0 vulnerabilities

Published May 24, 2016 · Updated Apr 22, 2026

Ecosystem: Ubuntu

Summary

It was discovered that the PHP Fileinfo component incorrectly handled
certain magic files. An attacker could use this issue to cause PHP to
crash, resulting in a denial of service, or possibly execute arbitrary
code. This issue only affected Ubuntu 16.04 LTS. (CVE-2015-8865)

Hans Jerry Illikainen discovered that the PHP Zip extension incorrectly
handled certain malformed Zip archives. A remote attacker could use this
issue to cause PHP to crash, resulting in a denial of service, or possibly
execute arbitrary code. This issue only affected Ubuntu 16.04 LTS.
(CVE-2016-3078)

It was discovered that PHP incorrectly handled invalid indexes in the
SplDoublyLinkedList class. An attacker could use this issue to cause PHP to
crash, resulting in a denial of service, or possibly execute arbitrary
code. This issue only affected Ubuntu 16.04 LTS. (CVE-2016-3132)

It was discovered that the PHP rawurlencode() function incorrectly handled
large strings. A remote attacker could use this issue to cause PHP to
crash, resulting in a denial of service. This issue only affected Ubuntu
16.04 LTS. (CVE-2016-4070)

It was discovered that the PHP php_snmp_error() function incorrectly
handled string formatting. A remote attacker could use this issue to cause
PHP to crash, resulting in a denial of service, or possibly execute
arbitrary code. This issue only affected Ubuntu 16.04 LTS. (CVE-2016-4071)

It was discovered that the PHP phar extension incorrectly handled certain
filenames in archives. A remote attacker could use this issue to cause PHP
to crash, resulting in a denial of service, or possibly execute arbitrary
code. This issue only affected Ubuntu 16.04 LTS. (CVE-2016-4072)

It was discovered that the PHP mb_strcut() function incorrectly handled
string formatting. A remote attacker could use this issue to cause PHP to
crash, resulting in a denial of service, or possibly execute arbitrary
code. This issue only affected Ubuntu 16.04 LTS. (CVE-2016-4073)

It was discovered that the PHP phar extension incorrectly handled certain
archive files. A remote attacker could use this issue to cause PHP to
crash, resulting in a denial of service, or possibly execute arbitrary
code. This issue only affected Ubuntu 12.04 LTS, Ubuntu 14.04 LTS and
Ubuntu 15.10. (CVE-2016-4342, CVE-2016-4343)

It was discovered that the PHP bcpowmod() function incorrectly handled
memory. A remote attacker could use this issue to cause PHP to crash,
resulting in a denial of service, or possibly execute arbitrary code.
(CVE-2016-4537, CVE-2016-4538)

It was discovered that the PHP XML parser incorrectly handled certain
malformed XML data. A remote attacker could possibly use this issue to
cause PHP to crash, resulting in a denial of service, or possibly execute
arbitrary code. (CVE-2016-4539)

It was discovered that certain PHP grapheme functions incorrectly handled
negative offsets. A remote attacker could possibly use this issue to cause
PHP to crash, resulting in a denial of service. (CVE-2016-4540,
CVE-2016-4541)

It was discovered that PHP incorrectly handled certain malformed EXIF tags.
A remote attacker could possibly use this issue to cause PHP to crash,
resulting in a denial of service. (CVE-2016-4542, CVE-2016-4543,
CVE-2016-4544)

Fixed packages 2

ReleasePackageFixed in
Ubuntu · 14.04 LTS 14.04:LTS php5 5.5.9+dfsg-1ubuntu4.17
Ubuntu · 16.04 LTS 16.04:LTS php7.0 7.0.4-7ubuntu2.1

Vulnerabilities 17

  • Unscored —
    CVE-2015-8865

    The file_check_mem function in funcs.c in file before 5.23, as used in the Fileinfo component in PHP before 5.5.34, 5.6…

    php5 php7.0 file file Debian Ubuntu
  • Unscored —
    CVE-2016-3078 Public exploit EPSS 56%

    Multiple integer overflows in php_zip.c in the zip extension in PHP before 7.0.6 allow remote attackers to cause a deni…

    php7.0 Ubuntu
  • Unscored —
    CVE-2016-3132 EPSS 12%

    Double free vulnerability in the SplDoublyLinkedList::offsetSet function in ext/spl/spl_dllist.c in PHP 7.x before 7.0.…

    php7.0 Ubuntu
  • Unscored —
    CVE-2016-4070

    Integer overflow in the php_raw_url_encode function in ext/standard/url.c in PHP before 5.5.34, 5.6.x before 5.6.20, an…

    php5 php7.0 Ubuntu
  • Unscored —
    CVE-2016-4071 Public exploit EPSS 20%

    Format string vulnerability in the php_snmp_error function in ext/snmp/snmp.c in PHP before 5.5.34, 5.6.x before 5.6.20…

    php5 php7.0 Ubuntu
  • Unscored —
    CVE-2016-4072

    The Phar extension in PHP before 5.5.34, 5.6.x before 5.6.20, and 7.x before 7.0.5 allows remote attackers to execute a…

    php5 php7.0 Ubuntu
  • Unscored —
    CVE-2016-4073

    Multiple integer overflows in the mbfl_strcut function in ext/mbstring/libmbfl/mbfl/mbfilter.c in PHP before 5.5.34, 5.…

    php5 php7.0 Ubuntu
  • Unscored —
    CVE-2016-4342

    ext/phar/phar_object.c in PHP before 5.5.32, 5.6.x before 5.6.18, and 7.x before 7.0.3 mishandles zero-length uncompres…

    php5 Ubuntu
  • Unscored —
    CVE-2016-4343

    The phar_make_dirstream function in ext/phar/dirstream.c in PHP before 5.6.18 and 7.x before 7.0.3 mishandles zero-size…

    php5 Ubuntu
  • Unscored —
    CVE-2016-4537

    The bcpowmod function in ext/bcmath/bcmath.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 accepts a …

    php5 php7.0 Ubuntu
  • Unscored —
    CVE-2016-4538

    The bcpowmod function in ext/bcmath/bcmath.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 modifies c…

    php5 php7.0 Ubuntu
  • Unscored —
    CVE-2016-4539

    The xml_parse_into_struct function in ext/xml/xml.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 all…

    php5 php7.0 Ubuntu
  • Unscored —
    CVE-2016-4540

    The grapheme_stripos function in ext/intl/grapheme/grapheme_string.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x…

    php5 php7.0 Ubuntu
  • Unscored —
    CVE-2016-4541

    The grapheme_strpos function in ext/intl/grapheme/grapheme_string.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x …

    php5 php7.0 Ubuntu
  • Unscored —
    CVE-2016-4542

    The exif_process_IFD_TAG function in ext/exif/exif.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 do…

    php5 php7.0 Ubuntu
  • Unscored —
    CVE-2016-4543 EPSS 12%

    The exif_process_IFD_in_JPEG function in ext/exif/exif.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.…

    php5 php7.0 Ubuntu
  • Unscored —
    CVE-2016-4544

    The exif_process_TIFF_in_JPEG function in ext/exif/exif.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0…

    php5 php7.0 Ubuntu

References

  • report
    https://ubuntu.com/security/CVE-2015-8865
  • report
    https://ubuntu.com/security/CVE-2016-3078
  • report
    https://ubuntu.com/security/CVE-2016-3132
  • report
    https://ubuntu.com/security/CVE-2016-4070
  • report
    https://ubuntu.com/security/CVE-2016-4071
  • report
    https://ubuntu.com/security/CVE-2016-4072
  • report
    https://ubuntu.com/security/CVE-2016-4073
  • report
    https://ubuntu.com/security/CVE-2016-4342
  • report
    https://ubuntu.com/security/CVE-2016-4343
  • report
    https://ubuntu.com/security/CVE-2016-4537
  • report
    https://ubuntu.com/security/CVE-2016-4538
  • report
    https://ubuntu.com/security/CVE-2016-4539
  • report
    https://ubuntu.com/security/CVE-2016-4540
  • report
    https://ubuntu.com/security/CVE-2016-4541
  • report
    https://ubuntu.com/security/CVE-2016-4542
  • report
    https://ubuntu.com/security/CVE-2016-4543
  • report
    https://ubuntu.com/security/CVE-2016-4544