PT-2016-3402 · Php+2 · Php+2

Dario Weißer

+1

·

Publicado

2016-06-24

·

Atualizado

2022-07-20

·

CVE-2016-5771

CVSS v3.1

10

Crítica

VetorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions PHP versions prior to 5.5.37 PHP versions 5.6.x prior to 5.6.23
Description The issue is related to improper interaction between the SPL extension and the unserialize implementation, along with garbage collection. This can be exploited by remote attackers using crafted serialized data, potentially leading to the execution of arbitrary code or a denial of service, resulting in a use-after-free condition and application crash.
Recommendations For PHP versions prior to 5.5.37, update to version 5.5.37 or later. For PHP versions 5.6.x prior to 5.6.23, update to version 5.6.23 or later.

Exploit

Correção

RCE

DoS

Use After Free

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-416

Identificadores relacionados

BDU:2022-02540
CVE-2016-5771
DLA-628-1
DSA-3618-1
MGASA-2016-0238
OPENSUSE-SU-2016_1761-1
RHSA-2016:2750
SUSE-SU-2016:1842-1
SUSE-SU-2018:0806-1
USN-3045-1

Produtos afetados

Php
Suse
Ubuntu