CVE-2016-4343 Null dereference in n/a
Remote attackers can cause denial of service via crafted TAR archives due to uninitialized pointer dereference in PHP's phar extension.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2016-4343?
CVE-2016-4343 is a high-severity vulnerability in Opensuse Opensuse, published on 22 May 2016. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The phar_make_dirstream function in ext/phar/dirstream.c in PHP before 5.6.18 and 7.x before 7.0.3 mishandles zero-size ././@LongLink files, which allows remote attackers to cause a denial of service (uninitialized pointer dereference) or possibly have unspecified other impact via a crafted TAR archive.
Weakness: CWE-824
Which versions are affected by CVE-2016-4343?
It affects 2 products.
Products include Opensuse Opensuse, Php Php.
How do I fix CVE-2016-4343?
Upgrade to a fixed version.
Is CVE-2016-4343 being exploited?
There is no known exploitation of CVE-2016-4343 in the wild and no public exploit code.
Other vulnerabilities in Opensuse Opensuse
Sources
Also known as GHSA-957h-v895-rv7p, UBUNTU-CVE-2016-4343.