---
title: "CVE-2016-5773\n    | Ubuntu"
description: Ubuntu is an open source software operating system that runs from the
  desktop, to the cloud, to all your internet connected things.
url: https://ubuntu.com/security/CVE-2016-5773?format=md
keywords: index, follow
---

# CVE-2016-5773

Publication date 24 June 2016

Last updated 25 August 2025

---

Ubuntu priority

**Low**

[Why this priority?](https://ubuntu.com/security/cves/about#priority )

## Cvss 3 Severity Score

**9.8 · Critical**

[Score breakdown](https://ubuntu.com/security/CVE-2016-5773?format=md#impact-score)

Toggle side navigation

## Description

php\_zip.c in the zip extension in PHP before 5.5.37, 5.6.x before 5.6.23,
and 7.x before 7.0.8 improperly interacts with the unserialize
implementation and garbage collection, which allows remote attackers to
execute arbitrary code or cause a denial of service (use-after-free and
application crash) via crafted serialized data containing a ZipArchive
object.

[Read the notes from the security team](https://ubuntu.com/security/CVE-2016-5773?format=md#notes)

## Status

Show unmaintained releases

| Package | Ubuntu Release | Status |
| --- | --- | --- |
| php5 | 16.04 LTS xenial | Not in release |
| 15.10 wily | Ignored end of life |
| 14.04 LTS trusty | Fixed 5.5.9+dfsg-1ubuntu4.19 |
| 12.04 LTS precise | Ignored |
| php7.0 | 16.04 LTS xenial | Fixed 7.0.8-0ubuntu0.16.04.1 |
| 15.10 wily | Not in release |
| 14.04 LTS trusty | Not in release |
| 12.04 LTS precise | Not in release |

---

* [How can I get the fixes?](https://ubuntu.com/security/cves/about#security)
* [What do statuses mean?](https://ubuntu.com/security/cves/about#statuses)
* [Patch details](https://ubuntu.com/security/CVE-2016-5773?format=md#patch-details)

## Notes

---

### [mdeslaur](https://launchpad.net/~mdeslaur)

Applications should never deserialize unauthenticated data.
precise needs backported fix
we will not be fixing this in Ubuntu 12.04 LTS. We recommend
validating untrusted data before unserializing.

### Patch details

For informational purposes only. We recommend not to cherry-pick updates. [How can I get the fixes?](https://ubuntu.com/security/cves/about#security)

| Package | Patch details |
| --- | --- |
| php5 | * Upstream:   <http://git.php.net/?p=php-src.git;a=commit;h=f6aef68089221c5ea047d4a74224ee3deead99a6> |
| php7.0 | * Upstream:   <http://git.php.net/?p=php-src.git;a=commit;h=f6aef68089221c5ea047d4a74224ee3deead99a6> |

## Severity score breakdown

CVSS version:
CVSS v3.0

**Base score**

9.8 · Critical

* Base metrics

  | Parameter | Value |
  | --- | --- |
  | Attack vector | Network |
  | Attack complexity | Low |
  | Privileges required | None |
  | User interaction | None |
  | Scope | Unchanged |
  | Confidentiality impact | High |
  | Integrity impact | High |
  | Availability impact | High |
* Scores

  | Parameter | Value |
  | --- | --- |
  | Base score | 9.8 · Critical |
  | Exploitability score | - |
  | Impact score | - |

**Vector:** CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

## References

* [MITRE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5773)
* [NVD](https://nvd.nist.gov/vuln/detail/CVE-2016-5773)
* [Launchpad](https://launchpad.net/bugs/cve/CVE-2016-5773)
* [Debian](https://security-tracker.debian.org/tracker/CVE-2016-5773)

### Related Ubuntu Security Notices (USN)

+ [USN-3045-1](https://usn.ubuntu.com/USN-3045-1)
+ PHP vulnerabilities
+ 2 August 2016

### Other references

* <https://www.evonide.com/breaking-phps-garbage-collection-and-unserialize/>
* <https://www.cve.org/CVERecord?id=CVE-2016-5773>