Note: This is a public test instance of Red Hat Bugzilla. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback at bugzilla.redhat.com.

Bug 1351179 (CVE-2016-5773)

Summary: CVE-2016-5773 php: ZipArchive class Use After Free Vulnerability in PHP's GC algorithm and unserialize
Product: [Other] Security Response Reporter: Andrej Nemec <anemec>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: abhgupta, dmcphers, fedora, hhorak, jialiu, jokerman, jorton, kseifried, lmeyer, mmccomas, rcollet, sardella, tiwillia, webstack-team
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: php 5.5.37, php 5.6.23 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2016-07-27 05:36:05 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Andrej Nemec 2016-06-29 12:03:04 UTC
A use after free vulnerability was discovered when PHP's garbage collection algorithm interacts with other specific PHP objects. This vulnerability has wide reaching effects like allowing the exploitation of unserialize to gain remote code execution on a target system.

Upstream bug:

https://bugs.php.net/bug.php?id=72434

Upstream patch:

http://git.php.net/?p=php-src.git;a=commitdiff;h=f6aef68089221c5ea047d4a74224ee3deead99a6

CVE assignment:

http://seclists.org/oss-sec/2016/q2/589

Comment 1 Andrej Nemec 2016-06-29 12:05:37 UTC
Created php tracking bugs for this issue:

Affects: fedora-all [bug 1351180]

Comment 2 Fedora Update System 2016-07-02 15:26:50 UTC
php-pecl-zip-1.13.3-1.fc24 has been pushed to the Fedora 24 stable repository. If problems still persist, please make note of it in this bug report.

Comment 3 Fedora Update System 2016-07-02 19:21:39 UTC
php-pecl-zip-1.12.5-2.fc22 has been pushed to the Fedora 22 stable repository. If problems still persist, please make note of it in this bug report.

Comment 4 Fedora Update System 2016-07-02 19:26:59 UTC
php-pecl-zip-1.13.3-1.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report.

Comment 5 Huzaifa S. Sidhpurwala 2016-07-15 05:57:39 UTC
Analysis:

This seems to be very similar to CVE-2016-5771 security flaw. There is a use-after-free flaw in the garbage collector for the zip class. When a specially crafted zip file is processed via php-zip class, it may result in crash or arbitrary code execution.

Comment 7 Huzaifa S. Sidhpurwala 2016-07-27 05:36:05 UTC
This issue happens when untrusted input is unserialized.  Doing so it documented as being unsafe:

  http://php.net/manual/en/function.unserialize.php

  Do not pass untrusted user input to unserialize(). Unserialization can
  result in code being loaded and executed due to object instantiation and
  autoloading, and a malicious user may be able to exploit this. Use a safe,
  standard data interchange format such as JSON (via json_decode() and
  json_encode()) if you need to pass serialized data to the user.

Comment 8 Tomas Hoger 2016-07-27 12:51:19 UTC
More details about this issue can be found in:

https://www.evonide.com/breaking-phps-garbage-collection-and-unserialize/

Comment 9 errata-xmlrpc 2016-11-15 11:42:17 UTC
This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 6
  Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7
  Red Hat Software Collections for Red Hat Enterprise Linux 7.2 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.3 EUS

Via RHSA-2016:2750 https://rhn.redhat.com/errata/RHSA-2016-2750.html