Skip to content
OpenAdvisories
Unscored USN-3095-1 17 CVEs

php5, php7.0 vulnerabilities

Published Oct 4, 2016 · Updated Apr 22, 2026

Ecosystem: Ubuntu

Summary

Taoguang Chen discovered that PHP incorrectly handled certain invalid
objects when unserializing data. A remote attacker could use this issue to
cause PHP to crash, resulting in a denial of service, or possibly execute
arbitrary code. (CVE-2016-7124)

Taoguang Chen discovered that PHP incorrectly handled invalid session
names. A remote attacker could use this issue to inject arbitrary session
data. (CVE-2016-7125)

It was discovered that PHP incorrectly handled certain gamma values in the
imagegammacorrect function. A remote attacker could use this issue to cause
PHP to crash, resulting in a denial of service, or possibly execute
arbitrary code. (CVE-2016-7127)

It was discovered that PHP incorrectly handled certain crafted TIFF image
thumbnails. A remote attacker could use this issue to cause PHP to crash,
resulting in a denial of service, or possibly expose sensitive information.
(CVE-2016-7128)

It was discovered that PHP incorrectly handled unserializing certain
wddxPacket XML documents. A remote attacker could use this issue to cause
PHP to crash, resulting in a denial of service, or possibly execute
arbitrary code. (CVE-2016-7129, CVE-2016-7130, CVE-2016-7131,
CVE-2016-7132, CVE-2016-7413)

It was discovered that PHP incorrectly handled certain memory operations. A
remote attacker could use this issue to cause PHP to crash, resulting in a
denial of service, or possibly execute arbitrary code. This issue only
affected Ubuntu 16.04 LTS. (CVE-2016-7133)

It was discovered that PHP incorrectly handled long strings in curl_escape
calls. A remote attacker could use this issue to cause PHP to crash,
resulting in a denial of service, or possibly execute arbitrary code. This
issue only affected Ubuntu 16.04 LTS. (CVE-2016-7134)

Taoguang Chen discovered that PHP incorrectly handled certain failures when
unserializing data. A remote attacker could use this issue to cause PHP to
crash, resulting in a denial of service, or possibly execute arbitrary
code. This issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS.
(CVE-2016-7411)

It was discovered that PHP incorrectly handled certain flags in the MySQL
driver. Malicious remote MySQL servers could use this issue to cause PHP to
crash, resulting in a denial of service, or possibly execute arbitrary
code. (CVE-2016-7412)

It was discovered that PHP incorrectly handled ZIP file signature
verification when processing a PHAR archive. A remote attacker could use
this issue to cause PHP to crash, resulting in a denial of service, or
possibly execute arbitrary code. (CVE-2016-7414)

It was discovered that PHP incorrectly handled certain locale operations. A
remote attacker could use this issue to cause PHP to crash, resulting in a
denial of service, or possibly execute arbitrary code. (CVE-2016-7416)

It was discovered that PHP incorrectly handled SplArray unserializing. A
remote attacker could use this issue to cause PHP to crash, resulting in a
denial of service, or possibly execute arbitrary code. (CVE-2016-7417)

Ke Liu discovered that PHP incorrectly handled unserializing wddxPacket XML
documents with incorrect boolean elements. A remote attacker could use this
issue to cause PHP to crash, resulting in a denial of service, or possibly
execute arbitrary code. (CVE-2016-7418)

Fixed packages 2

ReleasePackageFixed in
Ubuntu · 14.04 LTS 14.04:LTS php5 5.5.9+dfsg-1ubuntu4.20
Ubuntu · 16.04 LTS 16.04:LTS php7.0 7.0.8-0ubuntu0.16.04.3

Vulnerabilities 17

  • Unscored —
    CVE-2016-7124 EPSS 16%

    ext/standard/var_unserializer.c in PHP before 5.6.25 and 7.x before 7.0.10 mishandles certain invalid objects, which al…

    php5 php7.0 Ubuntu
  • Unscored —
    CVE-2016-7125

    ext/session/session.c in PHP before 5.6.25 and 7.x before 7.0.10 skips invalid session names in a way that triggers inc…

    php5 php7.0 Ubuntu
  • Unscored —
    CVE-2016-7127

    The imagegammacorrect function in ext/gd/gd.c in PHP before 5.6.25 and 7.x before 7.0.10 does not properly validate gam…

    php5 php7.0 Ubuntu
  • Unscored —
    CVE-2016-7128

    The exif_process_IFD_in_TIFF function in ext/exif/exif.c in PHP before 5.6.25 and 7.x before 7.0.10 mishandles the case…

    php5 php7.0 Ubuntu
  • Unscored —
    CVE-2016-7129

    The php_wddx_process_data function in ext/wddx/wddx.c in PHP before 5.6.25 and 7.x before 7.0.10 allows remote attacker…

    php5 php7.0 Ubuntu
  • Unscored —
    CVE-2016-7130

    The php_wddx_pop_element function in ext/wddx/wddx.c in PHP before 5.6.25 and 7.x before 7.0.10 allows remote attackers…

    php5 php7.0 Ubuntu
  • Unscored —
    CVE-2016-7131

    ext/wddx/wddx.c in PHP before 5.6.25 and 7.x before 7.0.10 allows remote attackers to cause a denial of service (NULL p…

    php5 php7.0 Ubuntu
  • Unscored —
    CVE-2016-7132

    ext/wddx/wddx.c in PHP before 5.6.25 and 7.x before 7.0.10 allows remote attackers to cause a denial of service (NULL p…

    php5 php7.0 Ubuntu
  • Unscored —
    CVE-2016-7133

    Zend/zend_alloc.c in PHP 7.x before 7.0.10, when open_basedir is enabled, mishandles huge realloc operations, which all…

    php7.0 Ubuntu
  • Unscored —
    CVE-2016-7134

    ext/curl/interface.c in PHP 7.x before 7.0.10 does not work around a libcurl integer overflow, which allows remote atta…

    php7.0 Ubuntu
  • Unscored —
    CVE-2016-7411

    ext/standard/var_unserializer.re in PHP before 5.6.26 mishandles object-deserialization failures, which allows remote a…

    php5 php Ubuntu Alpine
  • Unscored —
    CVE-2016-7412

    ext/mysqlnd/mysqlnd_wireprotocol.c in PHP before 5.6.26 and 7.x before 7.0.11 does not verify that a BIT field has the …

    php5 php7.0 php Ubuntu Alpine
  • Unscored —
    CVE-2016-7413

    Use-after-free vulnerability in the wddx_stack_destroy function in ext/wddx/wddx.c in PHP before 5.6.26 and 7.x before …

    php5 php7.0 php Ubuntu Alpine
  • Unscored —
    CVE-2016-7414

    The ZIP signature-verification feature in PHP before 5.6.26 and 7.x before 7.0.11 does not ensure that the uncompressed…

    php5 php7.0 php Ubuntu Alpine
  • Unscored —
    CVE-2016-7416

    ext/intl/msgformat/msgformat_format.c in PHP before 5.6.26 and 7.x before 7.0.11 does not properly restrict the locale …

    php5 php7.0 php Ubuntu Alpine
  • Unscored —
    CVE-2016-7417

    ext/spl/spl_array.c in PHP before 5.6.26 and 7.x before 7.0.11 proceeds with SplArray unserialization without validatin…

    php5 php7.0 php Ubuntu Alpine
  • Unscored —
    CVE-2016-7418 EPSS 11%

    The php_wddx_push_element function in ext/wddx/wddx.c in PHP before 5.6.26 and 7.x before 7.0.11 allows remote attacker…

    php5 php7.0 php Ubuntu Alpine

References

  • report
    https://ubuntu.com/security/CVE-2016-7124
  • report
    https://ubuntu.com/security/CVE-2016-7125
  • report
    https://ubuntu.com/security/CVE-2016-7127
  • report
    https://ubuntu.com/security/CVE-2016-7128
  • report
    https://ubuntu.com/security/CVE-2016-7129
  • report
    https://ubuntu.com/security/CVE-2016-7130
  • report
    https://ubuntu.com/security/CVE-2016-7131
  • report
    https://ubuntu.com/security/CVE-2016-7132
  • report
    https://ubuntu.com/security/CVE-2016-7133
  • report
    https://ubuntu.com/security/CVE-2016-7134
  • report
    https://ubuntu.com/security/CVE-2016-7411
  • report
    https://ubuntu.com/security/CVE-2016-7412
  • report
    https://ubuntu.com/security/CVE-2016-7413
  • report
    https://ubuntu.com/security/CVE-2016-7414
  • report
    https://ubuntu.com/security/CVE-2016-7416
  • report
    https://ubuntu.com/security/CVE-2016-7417
  • report
    https://ubuntu.com/security/CVE-2016-7418