PT-2017-2452 · Php+2 · Php+2

Nikic · Published 2017-01-04 · Updated 2018-05-04 · CVE-2016-9936

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PHP versions prior to 7.0.14

Description The issue is related to the unserialize implementation in PHP, which allows remote attackers to cause a denial of service or possibly have other impacts via crafted serialized data. This is due to an incomplete fix for a previous issue. The vulnerability is associated with the use of memory after it has been freed, and its exploitation can lead to a denial of service or other unspecified effects.

Recommendations For PHP versions prior to 7.0.14, update to version 7.0.14 or later to resolve the issue. As a temporary workaround, consider restricting the use of the unserialize function until a patch is applied. Avoid using crafted serialized data in the affected API endpoints until the issue is resolved.

Exploit

Fix

DoS

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

BDU:2017-01660

CVE-2016-9936

RHSA-2018:1296

SUSE-SU-2017:0017-1

USN-3211-1

USN-3211-2

Affected Products

Php

Suse

Ubuntu

References · 37

• 🔥 https://bugs.php.net/bug.php?id=72978 · Exploit
• https://github.com/php/php-src/commit/b2af4e8868726a040234de113436c6e4f6372d17 · Patch
• https://osv.dev/vulnerability/USN-3211-2 · Vendor Advisory
• http://php.net/ChangeLog-7.php · Patch
• https://ubuntu.com/security/notices/USN-3211-2 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-7479 · Vendor Advisory
• https://bdu.fstec.ru/vul/2017-01660 · Security Note
• https://ubuntu.com/security/CVE-2016-10158 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-9936 · Vendor Advisory
• http://lists.opensuse.org/opensuse-updates/2017-01/msg00034.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-9935 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-9936 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2017:0017-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-10162 · Vendor Advisory
• https://osv.dev/vulnerability/USN-3211-1 · Vendor Advisory