CVE-2016-5399

33

FAUCET Score

CVE-2016-5399 describes an out-of-bounds write vulnerability in the bzread function of PHP versions before 5.5.38, 5.6.24, and 7.0.9. This flaw allows remote attackers to trigger a denial of service or potentially execute arbitrary code by supplying a specially crafted bz2 archive. With a CVSS score of 7.8 (High) and a FAUCET Risk Score of 95/100, this vulnerability presents a significant risk, requiring user interaction (UI:R) for exploitation but offering high impact on confidentiality, integrity, and availability. While not listed on CISA's KEV catalog, public exploit code (EDB-40155) exists, though there is no evidence of active exploitation, Metasploit modules, or significant community discussion or media coverage.

Impacted Technologies

Vendor	Product	Version(s)	CPE
		<= 5.5.37CPE matchmatch criteria	cpe:2.3:a:php:php::::::::
		>= 5.6.0, < 5.6.24CPE matchmatch criteria	cpe:2.3:a:php:php::::::::
		>= 7.0.0, < 7.0.9CPE matchmatch criteria	cpe:2.3:a:php:php::::::::

CVSS Data

CVSS version used by this source: 3.1

7.8HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

Exploitability Score

1.8

Impact Score

5.9

CvssVersion

3.1

Exploit Intelligence

EPSS Score

9.84%

Probability of exploitation in next 30 days

EPSS Percentile

95.1%

Percentile rank of EPSS score among Peer Group

As of 2026-07-27

Model: v2026.06.15

ExploitDB: EDB-40155 · Jul 25, 2016

This CVE's current EPSS score of 0.0984 is in the 95th percentile among its peer group of 11,617 CVEs.

Social Chatter

No social media mentions found for this CVE.

The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (21)

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 7Fixed in: php-0:5.4.16-42.el7

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 6Fixed in: rh-php56-0:2.3-1.el6

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 6Fixed in: rh-php56-php-0:5.6.25-1.el6

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 6Fixed in: rh-php56-php-pear-1:1.9.5-4.el6

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUSFixed in: rh-php56-0:2.3-1.el6

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUSFixed in: rh-php56-php-0:5.6.25-1.el6

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUSFixed in: rh-php56-php-pear-1:1.9.5-4.el6

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7Fixed in: rh-php56-0:2.3-1.el7

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7Fixed in: rh-php56-php-0:5.6.25-1.el7

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7Fixed in: rh-php56-php-pear-1:1.9.5-4.el7

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.2 EUSFixed in: rh-php56-0:2.3-1.el7

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.2 EUSFixed in: rh-php56-php-0:5.6.25-1.el7

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.2 EUSFixed in: rh-php56-php-pear-1:1.9.5-4.el7

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.3 EUSFixed in: rh-php56-0:2.3-1.el7

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.3 EUSFixed in: rh-php56-php-0:5.6.25-1.el7

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.3 EUSFixed in: rh-php56-php-pear-1:1.9.5-4.el7

redhatend of lifevia redhat_api

Product: Red Hat Enterprise Linux 5Fixed in: php

redhatend of lifevia redhat_api

Product: Red Hat Enterprise Linux 5Fixed in: php53

redhatend of lifevia redhat_api

Product: Red Hat Enterprise Linux 6Fixed in: php

redhatend of lifevia redhat_api

Product: Red Hat Software CollectionsFixed in: php54-php

redhatend of lifevia redhat_api

Product: Red Hat Software CollectionsFixed in: php55-php

Vendor Advisories (1)

redhatCVE-2016-5399Moderate

php: Improper error handling in bzread()

References

packetstormsecurity.com / files/137998/PHP-7.0.8-5.6.23-5.5.37-bzread-OOB-Write.html

ExploitThird Party AdvisoryVDB Entry

php.net / ChangeLog-5.php

Release NotesVendor Advisory

php.net / ChangeLog-7.php

Release NotesVendor Advisory

rhn.redhat.com / errata/RHSA-2016-2598.html

Third Party Advisory

rhn.redhat.com / errata/RHSA-2016-2750.html

Third Party Advisory

bugs.php.net / bug.php

ExploitVendor Advisory

bugzilla.redhat.com / show_bug.cgi

Issue TrackingThird Party AdvisoryVDB Entry

seclists.org / fulldisclosure/2016/Jul/72

ExploitMailing ListThird Party Advisory

security.netapp.com / advisory/ntap-20180112-0001

Third Party Advisory

exploit-db.com / exploits/40155

ExploitThird Party AdvisoryVDB Entry

debian.org / security/2016/dsa-3631

Third Party Advisory

openwall.com / lists/oss-security/2016/07/21/1

ExploitMailing ListThird Party Advisory

securityfocus.com / archive/1/538966/100/0/threaded

Third Party AdvisoryVDB Entry

securityfocus.com / bid/92051

Third Party AdvisoryVDB Entry

securitytracker.com / id/1036430

Third Party AdvisoryVDB Entry