CVE catalog

CVE-2016-5773

Security update for php5

[CVE catalog]

Severity
Critical · CVSS 9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published
Updated
Source
[NVD] · [CVE record]
EPSS
9.26% · Oct 25, 2026

php_zip.c in the zip extension in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8 improperly interacts with the unserialize implementation and garbage collection, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and application crash) via crafted serialized data containing a ZipArchive object.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Ubuntuphp514.045.5.3+dfsg-1ubuntu2vulnerable
Ubuntuphp514.045.5.3+dfsg-1ubuntu3vulnerable
Ubuntuphp514.045.5.6+dfsg-1ubuntu1vulnerable
Ubuntuphp514.045.5.6+dfsg-1ubuntu2vulnerable
Ubuntuphp514.045.5.8+dfsg-2ubuntu1vulnerable
Ubuntuphp514.045.5.9+dfsg-1ubuntu1vulnerable
Ubuntuphp514.045.5.9+dfsg-1ubuntu2vulnerable
Ubuntuphp514.045.5.9+dfsg-1ubuntu3vulnerable
Ubuntuphp514.045.5.9+dfsg-1ubuntu4vulnerable
Ubuntuphp514.045.5.9+dfsg-1ubuntu4.1vulnerable
Ubuntuphp514.045.5.9+dfsg-1ubuntu4.2vulnerable
Ubuntuphp514.045.5.9+dfsg-1ubuntu4.3vulnerable
Ubuntuphp514.045.5.9+dfsg-1ubuntu4.4vulnerable
Ubuntuphp514.045.5.9+dfsg-1ubuntu4.5vulnerable
Ubuntuphp514.045.5.9+dfsg-1ubuntu4.6vulnerable
Ubuntuphp514.045.5.9+dfsg-1ubuntu4.7vulnerable
Ubuntuphp514.045.5.9+dfsg-1ubuntu4.9vulnerable
Ubuntuphp514.045.5.9+dfsg-1ubuntu4.11vulnerable
Ubuntuphp514.045.5.9+dfsg-1ubuntu4.12vulnerable
Ubuntuphp514.045.5.9+dfsg-1ubuntu4.13vulnerable
Ubuntuphp514.045.5.9+dfsg-1ubuntu4.14vulnerable
Ubuntuphp514.045.5.9+dfsg-1ubuntu4.16vulnerable
Ubuntuphp514.045.5.9+dfsg-1ubuntu4.17vulnerable
Ubuntuphp514.045.5.9+dfsg-1ubuntu4.19fixed
Ubuntuphp7.016.047.0.1-5vulnerable
Ubuntuphp7.016.047.0.1-6vulnerable
Ubuntuphp7.016.047.0.2-1vulnerable
Ubuntuphp7.016.047.0.2-3vulnerable
Ubuntuphp7.016.047.0.2-4vulnerable
Ubuntuphp7.016.047.0.2-5vulnerable
Ubuntuphp7.016.047.0.3-2vulnerable
Ubuntuphp7.016.047.0.3-3vulnerable
Ubuntuphp7.016.047.0.3-9ubuntu1vulnerable
Ubuntuphp7.016.047.0.4-5ubuntu1vulnerable
Ubuntuphp7.016.047.0.4-5ubuntu2vulnerable
Ubuntuphp7.016.047.0.4-7ubuntu1vulnerable
Ubuntuphp7.016.047.0.4-7ubuntu2vulnerable
Ubuntuphp7.016.047.0.4-7ubuntu2.1vulnerable
Ubuntuphp7.016.047.0.8-0ubuntu0.16.04.1fixed
Suseimaplinux enterprise desktop 12 sp12007e_suse-22.1fixed
Suseimaplinux enterprise desktop 12 sp22007e_suse-22.1fixed
Suseimaplinux enterprise module for web and scripting 122007e_suse-22.1fixed
Susephp5linux enterprise module for web and scripting 125.5.14-86.2fixed
Suseimaplinux enterprise software development kit 12 sp12007e_suse-22.1fixed
Susephp5linux enterprise software development kit 12 sp15.5.14-86.2fixed
Suseimaplinux enterprise software development kit 12 sp22007e_suse-22.1fixed
Susephp5linux enterprise software development kit 12 sp25.5.14-86.2fixed
Suseimaplinux enterprise workstation extension 12 sp12007e_suse-22.1fixed
Suseimaplinux enterprise workstation extension 12 sp22007e_suse-22.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Ubuntuphp5deb14.045.5.9+dfsg-1ubuntu4.19Not reportedUBUNTU-CVE-2016-5773Not reported
Ubuntuphp7.0deb16.047.0.8-0ubuntu0.16.04.1Not reportedUBUNTU-CVE-2016-5773Not reported
Suseimaprpmlinux enterprise desktop 12 sp12007e_suse-22.1Not reportedSUSE-SU-2016:2975-1Not reported
Suseimaprpmlinux enterprise desktop 12 sp22007e_suse-22.1Not reportedSUSE-SU-2016:2975-1Not reported
Suseimaprpmlinux enterprise module for web and scripting 122007e_suse-22.1Not reportedSUSE-SU-2016:2975-1Not reported
Susephp5rpmlinux enterprise module for web and scripting 125.5.14-86.2Not reportedSUSE-SU-2016:2975-1Not reported
Suseimaprpmlinux enterprise software development kit 12 sp12007e_suse-22.1Not reportedSUSE-SU-2016:2975-1Not reported
Susephp5rpmlinux enterprise software development kit 12 sp15.5.14-86.2Not reportedSUSE-SU-2016:2975-1Not reported
Suseimaprpmlinux enterprise software development kit 12 sp22007e_suse-22.1Not reportedSUSE-SU-2016:2975-1Not reported
Susephp5rpmlinux enterprise software development kit 12 sp25.5.14-86.2Not reportedSUSE-SU-2016:2975-1Not reported
Suseimaprpmlinux enterprise workstation extension 12 sp12007e_suse-22.1Not reportedSUSE-SU-2016:2975-1Not reported
Suseimaprpmlinux enterprise workstation extension 12 sp22007e_suse-22.1Not reportedSUSE-SU-2016:2975-1Not reported

OpenFactory catalog packages

No matching packages in this catalog.

Observed:

References

[FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]