CVE-2016-7480
Critical · 9.8CVSS
9.8
EPSS
41.6%
Published
Jan 11, 2017
CISA due date
—
The record
The SplObjectStorage unserialize implementation in ext/spl/spl_observer.c in PHP before 7.0.12 does not verify that a key is an object, which allows remote attackers to execute arbitrary code or cause a denial of service (uninitialized memory access) via crafted serialized data.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| SUSE:Linux Enterprise Module for Web and Scripting 12 | php7 | 0 | 7.0.7-35.1 |
| SUSE:Linux Enterprise Software Development Kit 12 SP1 | php7 | 0 | 7.0.7-35.1 |
| SUSE:Linux Enterprise Software Development Kit 12 SP2 | php7 | 0 | 7.0.7-35.1 |
| Ubuntu:14.04:LTS | php5 | 0 | 5.5.9+dfsg-1ubuntu4.20 |
| Ubuntu:16.04:LTS | php7.0 | 0 | 7.0.13-0ubuntu0.16.04.1 |
Related vulnerabilities
- CVE-2017-16642 In PHP before 5.6.32, 7.x before 7.0.25, and 7.1.x before 7.1.11, an error in the date… Also affects php7
- CVE-2017-12933 The finish_nested_data function in ext/standard/var_unserializer.re in PHP before 5.6.31… Also affects php7
- CVE-2017-7890 The GIF decoding function gdImageCreateFromGifCtx in gd_gif_in.c in the GD Graphics… Also affects php7
- CVE-2016-10166 Integer underflow in the _gdContributionsAlloc function in gd_interpolation.c in the GD… Also affects php7
- CVE-2015-8994 An issue was discovered in PHP 5.x and 7.x, when the configuration uses… Also affects php7
- CVE-2016-6911 The dynamicGetbuf function in the GD Graphics Library (aka libgd) before 2.2.4 allows… Also affects php7
- CVE-2016-10158 The exif_convert_any_to_int function in ext/exif/exif.c in PHP before 5.6.30, 7.0.x… Also affects php7
- CVE-2016-10161 The object_common1 function in ext/standard/var_unserializer.c in PHP before 5.6.30… Also affects php7