CVE-2016-10160: Debian Linux

Critical severity, CVSS 9.8. EPSS: 7.4% chance of exploitation in the next 30 days.

Off-by-one error in the phar_parse_pharfile function in ext/phar/phar.c in PHP before 5.6.30 and 7.0.x before 7.0.15 allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a crafted PHAR archive with an alias mismatch.

Affected products

• Debian Debian Linux: version 8.0 only
• Netapp Clustered Data Ontap: affected versions not specified
• PHP PHP: from 5.6.0, before 5.6.30 (fixed in 5.6.30); from 7.0.0, before 7.0.15 (fixed in 7.0.15); from 7.1.0, before 7.1.1 (fixed in 7.1.1)

Published 2017-01-24. Last modified 2026-06-17.