CVE-2017-12934
HIGH
7.5
CVSS 3.0
Description
ext/standard/var_unserializer.re in PHP 7.0.x before 7.0.21 and 7.1.x before 7.1.7 is prone to a heap use after free while unserializing untrusted data, related to the zval_get_type function in Zend/zend_types.h. Exploitation of this issue can have an unspecified impact on the integrity of PHP.
Affected products and versions
- PHP versions 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.0.10, 7.0.11, 7.0.12, 7.0.13, 7.0.14, 7.0.15, 7.0.16, 7.0.17, 7.0.18, 7.0.19, 7.0.20, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6
References
- php.net http://php.net/ChangeLog-7.php Vendor Advisory
- www.securityfocus.com http://www.securityfocus.com/bid/100428 Third Party Advisory, VDB Entry
- access.redhat.com https://access.redhat.com/errata/RHSA-2018:1296
- bugs.php.net https://bugs.php.net/bug.php?id=74101 Issue Tracking, Third Party Advisory
- www.debian.org https://www.debian.org/security/2018/dsa-4080
- nvd.nist.gov Official NVD record