CVE-2016-9936

CRITICAL 9.8 CVSS 3.0

Published: January 4, 2017
Last modified: June 17, 2026
NVD status: Modified
Reported by: cve@mitre.org
Weakness: CWE-416
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

The unserialize implementation in ext/standard/var.c in PHP 7.x before 7.0.14 allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted serialized data. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-6834.

Affected products and versions

PHP versions 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.0.10, 7.0.11, 7.0.12, 7.0.13

References

lists.opensuse.org http://lists.opensuse.org/opensuse-updates/2017-01/msg00034.html
www.openwall.com http://www.openwall.com/lists/oss-security/2016/12/12/2 Mailing List
www.php.net http://www.php.net/ChangeLog-7.php Patch, Release Notes
www.securityfocus.com http://www.securityfocus.com/bid/94849
access.redhat.com https://access.redhat.com/errata/RHSA-2018:1296
bugs.php.net https://bugs.php.net/bug.php?id=72978 Exploit, Issue Tracking
github.com https://github.com/php/php-src/commit/b2af4e8868726a040234de113436c6e4f6372d17 Patch
nvd.nist.gov Official NVD record

PHP CVEs

Description

Affected products and versions

References