CVE catalog

CVE-2016-10158

Security update for php5

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
Updated
Source
[NVD] · [CVE record]
EPSS
7.76% · Oct 27, 2026

The exif_convert_any_to_int function in ext/exif/exif.c in PHP before 5.6.30, 7.0.x before 7.0.15, and 7.1.x before 7.1.1 allows remote attackers to cause a denial of service (application crash) via crafted EXIF data that triggers an attempt to divide the minimum representable negative integer by -1.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Ubuntuphp514.045.5.3+dfsg-1ubuntu2vulnerable
Ubuntuphp514.045.5.3+dfsg-1ubuntu3vulnerable
Ubuntuphp514.045.5.6+dfsg-1ubuntu1vulnerable
Ubuntuphp514.045.5.6+dfsg-1ubuntu2vulnerable
Ubuntuphp514.045.5.8+dfsg-2ubuntu1vulnerable
Ubuntuphp514.045.5.9+dfsg-1ubuntu1vulnerable
Ubuntuphp514.045.5.9+dfsg-1ubuntu2vulnerable
Ubuntuphp514.045.5.9+dfsg-1ubuntu3vulnerable
Ubuntuphp514.045.5.9+dfsg-1ubuntu4vulnerable
Ubuntuphp514.045.5.9+dfsg-1ubuntu4.1vulnerable
Ubuntuphp514.045.5.9+dfsg-1ubuntu4.2vulnerable
Ubuntuphp514.045.5.9+dfsg-1ubuntu4.3vulnerable
Ubuntuphp514.045.5.9+dfsg-1ubuntu4.4vulnerable
Ubuntuphp514.045.5.9+dfsg-1ubuntu4.5vulnerable
Ubuntuphp514.045.5.9+dfsg-1ubuntu4.6vulnerable
Ubuntuphp514.045.5.9+dfsg-1ubuntu4.7vulnerable
Ubuntuphp514.045.5.9+dfsg-1ubuntu4.9vulnerable
Ubuntuphp514.045.5.9+dfsg-1ubuntu4.11vulnerable
Ubuntuphp514.045.5.9+dfsg-1ubuntu4.12vulnerable
Ubuntuphp514.045.5.9+dfsg-1ubuntu4.13vulnerable
Ubuntuphp514.045.5.9+dfsg-1ubuntu4.14vulnerable
Ubuntuphp514.045.5.9+dfsg-1ubuntu4.16vulnerable
Ubuntuphp514.045.5.9+dfsg-1ubuntu4.17vulnerable
Ubuntuphp514.045.5.9+dfsg-1ubuntu4.19vulnerable
Ubuntuphp514.045.5.9+dfsg-1ubuntu4.20vulnerable
Ubuntuphp514.045.5.9+dfsg-1ubuntu4.21fixed
Ubuntuphp7.016.047.0.1-5vulnerable
Ubuntuphp7.016.047.0.1-6vulnerable
Ubuntuphp7.016.047.0.2-1vulnerable
Ubuntuphp7.016.047.0.2-3vulnerable
Ubuntuphp7.016.047.0.2-4vulnerable
Ubuntuphp7.016.047.0.2-5vulnerable
Ubuntuphp7.016.047.0.3-2vulnerable
Ubuntuphp7.016.047.0.3-3vulnerable
Ubuntuphp7.016.047.0.3-9ubuntu1vulnerable
Ubuntuphp7.016.047.0.4-5ubuntu1vulnerable
Ubuntuphp7.016.047.0.4-5ubuntu2vulnerable
Ubuntuphp7.016.047.0.4-7ubuntu1vulnerable
Ubuntuphp7.016.047.0.4-7ubuntu2vulnerable
Ubuntuphp7.016.047.0.4-7ubuntu2.1vulnerable
Ubuntuphp7.016.047.0.8-0ubuntu0.16.04.1vulnerable
Ubuntuphp7.016.047.0.8-0ubuntu0.16.04.2vulnerable
Ubuntuphp7.016.047.0.8-0ubuntu0.16.04.3vulnerable
Ubuntuphp7.016.047.0.13-0ubuntu0.16.04.1vulnerable
Ubuntuphp7.016.047.0.15-0ubuntu0.16.04.1vulnerable
Ubuntuphp7.016.047.0.15-0ubuntu0.16.04.2fixed
Ubuntuphp7.016.047.0.1-5vulnerable
Ubuntuphp7.016.047.0.1-6vulnerable
Ubuntuphp7.016.047.0.2-1vulnerable
Ubuntuphp7.016.047.0.2-3vulnerable
Ubuntuphp7.016.047.0.2-4vulnerable
Ubuntuphp7.016.047.0.2-5vulnerable
Ubuntuphp7.016.047.0.3-2vulnerable
Ubuntuphp7.016.047.0.3-3vulnerable
Ubuntuphp7.016.047.0.3-9ubuntu1vulnerable
Ubuntuphp7.016.047.0.4-5ubuntu1vulnerable
Ubuntuphp7.016.047.0.4-5ubuntu2vulnerable
Ubuntuphp7.016.047.0.4-7ubuntu1vulnerable
Ubuntuphp7.016.047.0.4-7ubuntu2vulnerable
Ubuntuphp7.016.047.0.4-7ubuntu2.1vulnerable
Ubuntuphp7.016.047.0.8-0ubuntu0.16.04.1vulnerable
Ubuntuphp7.016.047.0.8-0ubuntu0.16.04.2vulnerable
Ubuntuphp7.016.047.0.8-0ubuntu0.16.04.3vulnerable
Ubuntuphp7.016.047.0.13-0ubuntu0.16.04.1vulnerable
Ubuntuphp7.016.047.0.15-0ubuntu0.16.04.1vulnerable
Ubuntuphp7.016.047.0.15-0ubuntu0.16.04.2fixed
Debianphp575.4.11-1vulnerable
Debianphp575.4.15-1vulnerable
Debianphp575.4.34-0+deb7u1vulnerable
Debianphp575.4.35-0+deb7u1vulnerable
Debianphp575.4.35-0+deb7u2vulnerable
Debianphp575.4.36-0+deb7u1vulnerable
Debianphp575.4.36-0+deb7u3vulnerable
Debianphp575.4.38-0+deb7u1vulnerable
Debianphp575.4.39-0+deb7u1vulnerable
Debianphp575.4.39-0+deb7u2vulnerable
Debianphp575.4.4-14vulnerable
Debianphp575.4.4-14+deb7u1vulnerable
Debianphp575.4.4-14+deb7u10vulnerable
Debianphp575.4.4-14+deb7u11vulnerable
Debianphp575.4.4-14+deb7u12vulnerable
Debianphp575.4.4-14+deb7u13vulnerable
Debianphp575.4.4-14+deb7u14vulnerable
Debianphp575.4.4-14+deb7u2vulnerable
Debianphp575.4.4-14+deb7u3vulnerable
Debianphp575.4.4-14+deb7u4vulnerable
Debianphp575.4.4-14+deb7u5vulnerable
Debianphp575.4.4-14+deb7u7vulnerable
Debianphp575.4.4-14+deb7u8vulnerable
Debianphp575.4.4-14+deb7u9vulnerable
Debianphp575.4.4-15vulnerable
Debianphp575.4.4-15.1vulnerable
Debianphp575.4.41-0+deb7u1vulnerable
Debianphp575.4.44-0+deb7u1vulnerable
Debianphp575.4.45-0+deb7u1vulnerable
Debianphp575.4.45-0+deb7u2vulnerable
Debianphp575.4.45-0+deb7u3vulnerable
Debianphp575.4.45-0+deb7u4vulnerable
Debianphp575.4.45-0+deb7u5vulnerable
Debianphp575.4.45-0+deb7u6vulnerable
Debianphp575.4.6-1vulnerable
Debianphp575.4.6-2vulnerable
Debianphp575.4.8-1vulnerable
Debianphp575.4.9-1vulnerable
Debianphp575.4.9-2vulnerable
Debianphp575.4.9-3vulnerable
Debianphp575.4.9-4vulnerable
Debianphp575.4.45-0+deb7u7fixed
Debianphp585.6.11+dfsg-1vulnerable
Debianphp585.6.12+dfsg-0+deb8u1vulnerable
Debianphp585.6.12+dfsg-1vulnerable
Debianphp585.6.13+dfsg-0+deb8u1vulnerable
Debianphp585.6.13+dfsg-1vulnerable
Debianphp585.6.13+dfsg-2vulnerable
Debianphp585.6.14+dfsg-0+deb8u1vulnerable
Debianphp585.6.14+dfsg-1vulnerable
Debianphp585.6.15+dfsg-1vulnerable
Debianphp585.6.16+dfsg-1vulnerable
Debianphp585.6.16+dfsg-2vulnerable
Debianphp585.6.16+dfsg-3vulnerable
Debianphp585.6.16+dfsg-4vulnerable
Debianphp585.6.17+dfsg-0+deb8u1vulnerable
Debianphp585.6.17+dfsg-1vulnerable
Debianphp585.6.17+dfsg-3vulnerable
Debianphp585.6.18+dfsg-1vulnerable
Debianphp585.6.19+dfsg-0+deb8u1vulnerable
Debianphp585.6.19+dfsg-1vulnerable
Debianphp585.6.19+dfsg-2vulnerable
Debianphp585.6.20+dfsg-0+deb8u1vulnerable
Debianphp585.6.20+dfsg-1vulnerable
Debianphp585.6.21+dfsg-1vulnerable
Debianphp585.6.21+dfsg-2vulnerable
Debianphp585.6.22+dfsg-0+deb8u1vulnerable
Debianphp585.6.22+dfsg-1vulnerable
Debianphp585.6.22+dfsg-2vulnerable
Debianphp585.6.23+dfsg-0+deb8u1vulnerable
Debianphp585.6.23+dfsg-1vulnerable
Debianphp585.6.24+dfsg-0+deb8u1vulnerable
Debianphp585.6.24+dfsg-1vulnerable
Debianphp585.6.26+dfsg-0+deb8u1vulnerable
Debianphp585.6.26+dfsg-1vulnerable
Debianphp585.6.27+dfsg-0+deb8u1vulnerable
Debianphp585.6.28+dfsg-0+deb8u1vulnerable
Debianphp585.6.29+dfsg-0+deb8u1vulnerable
Debianphp585.6.7+dfsg-1vulnerable
Debianphp585.6.9+dfsg-0+deb8u1vulnerable
Debianphp585.6.9+dfsg-1vulnerable
Debianphp585.6.30+dfsg-0+deb8u1fixed
Susephp7linux enterprise module for web and scripting 127.0.7-35.1fixed
Susephp7linux enterprise software development kit 12 sp17.0.7-35.1fixed
Susephp7linux enterprise software development kit 12 sp27.0.7-35.1fixed
Susephp53linux enterprise software development kit 11 sp45.3.17-101.1fixed
Susephp53openstack cloud 55.3.17-101.1fixed
Susephp53manager 2.15.3.17-101.1fixed
Susephp53manager proxy 2.15.3.17-101.1fixed
Susephp53linux enterprise point of sale 11 sp35.3.17-101.1fixed
Susephp53linux enterprise server 11 sp3-ltss5.3.17-101.1fixed
Susephp53linux enterprise server 11 sp3-teradata5.3.17-101.1fixed
Susephp53linux enterprise server 11 sp45.3.17-101.1fixed
Susephp53linux enterprise server for sap applications 11 sp45.3.17-101.1fixed
Susephp5linux enterprise module for web and scripting 125.5.14-96.1fixed
Susephp5linux enterprise software development kit 12 sp15.5.14-96.1fixed
Susephp5linux enterprise software development kit 12 sp25.5.14-96.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Ubuntuphp5deb14.045.5.9+dfsg-1ubuntu4.21Not reportedUBUNTU-CVE-2016-10158Not reported
Ubuntuphp7.0deb16.047.0.15-0ubuntu0.16.04.2Not reportedUBUNTU-CVE-2016-10158Not reported
Ubuntuphp7.0deb16.047.0.15-0ubuntu0.16.04.2Not reportedUSN-3211-1Not reported
Debianphp5deb75.4.45-0+deb7u7Not reportedDLA-818-1Not reported
Debianphp5deb85.6.30+dfsg-0+deb8u1Not reportedDSA-3783-1Not reported
Susephp7rpmlinux enterprise module for web and scripting 127.0.7-35.1Not reportedSUSE-SU-2017:0534-1Not reported
Susephp7rpmlinux enterprise software development kit 12 sp17.0.7-35.1Not reportedSUSE-SU-2017:0534-1Not reported
Susephp7rpmlinux enterprise software development kit 12 sp27.0.7-35.1Not reportedSUSE-SU-2017:0534-1Not reported
Susephp53rpmlinux enterprise software development kit 11 sp45.3.17-101.1Not reportedSUSE-SU-2017:0568-1Not reported
Susephp53rpmopenstack cloud 55.3.17-101.1Not reportedSUSE-SU-2017:0568-1Not reported
Susephp53rpmmanager 2.15.3.17-101.1Not reportedSUSE-SU-2017:0568-1Not reported
Susephp53rpmmanager proxy 2.15.3.17-101.1Not reportedSUSE-SU-2017:0568-1Not reported
Susephp53rpmlinux enterprise point of sale 11 sp35.3.17-101.1Not reportedSUSE-SU-2017:0568-1Not reported
Susephp53rpmlinux enterprise server 11 sp3-ltss5.3.17-101.1Not reportedSUSE-SU-2017:0568-1Not reported
Susephp53rpmlinux enterprise server 11 sp3-teradata5.3.17-101.1Not reportedSUSE-SU-2017:0568-1Not reported
Susephp53rpmlinux enterprise server 11 sp45.3.17-101.1Not reportedSUSE-SU-2017:0568-1Not reported
Susephp53rpmlinux enterprise server for sap applications 11 sp45.3.17-101.1Not reportedSUSE-SU-2017:0568-1Not reported
Susephp5rpmlinux enterprise module for web and scripting 125.5.14-96.1Not reportedSUSE-SU-2017:0556-1Not reported
Susephp5rpmlinux enterprise software development kit 12 sp15.5.14-96.1Not reportedSUSE-SU-2017:0556-1Not reported
Susephp5rpmlinux enterprise software development kit 12 sp25.5.14-96.1Not reportedSUSE-SU-2017:0556-1Not reported

OpenFactory catalog packages

No matching packages in this catalog.

Observed:

References

[FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]