NetSight
IP …
critical9.8

CVE-2016-4072

The Phar extension in PHP before 5.5.34, 5.6.x before 5.6.20, and 7.x before 7.0.5 allows remote attackers to execute arbitrary code via a crafted filename, as…

Impact

The Phar extension in PHP before 5.5.34, 5.6.x before 5.6.20, and 7.x before 7.0.5 allows remote attackers to execute arbitrary code via a crafted filename, as demonstrated by mishandling of \0 characters by the phar_analyze_path function in ext/phar/phar.c.

Affected products

VendorProductAffected versions
PhpPhp
Versions 5.6.0, 5.6.1, 5.6.2, 5.6.3, 5.6.4, 5.6.5
AppleMac Os X
through 10.11.4

Weakness classification

CWE-20

References