9.8

CVE-2016-7417

Exploit
ext/spl/spl_array.c in PHP before 5.6.26 and 7.x before 7.0.11 proceeds with SplArray unserialization without validating a return value and data type, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted serialized data.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Php ≫ Php Version <= 5.6.25
Php ≫ Php Version7.0.0
Php ≫ Php Version7.0.1
Php ≫ Php Version7.0.2
Php ≫ Php Version7.0.3
Php ≫ Php Version7.0.4
Php ≫ Php Version7.0.5
Php ≫ Php Version7.0.6
Php ≫ Php Version7.0.7
Php ≫ Php Version7.0.8
Php ≫ Php Version7.0.9
Php ≫ Php Version7.0.10
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 6.84% 0.932
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 9.8 3.9 5.9
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 7.5 10 6.4
AV:N/AC:L/Au:N/C:P/I:P/A:P
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

http://www.php.net/ChangeLog-5.php
Release Notes
http://www.php.net/ChangeLog-7.php
Release Notes
https://security.gentoo.org/glsa/201611-22
https://www.tenable.com/security/tns-2016-19
http://www.openwall.com/lists/oss-security/2016/09/15/10
Mailing List
http://www.securitytracker.com/id/1036836
https://access.redhat.com/errata/RHSA-2018:1296
http://www.securityfocus.com/bid/93007
https://bugs.php.net/bug.php?id=73029
Exploit
Issue Tracking
https://github.com/php/php-src/commit/ecb7f58a069be0dec4a6131b6351a761f808f22e?w=1
Patch
Issue Tracking