The unserialize implementation in ext/standard/var.c in PHP 7.x before 7.0.14 allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted serialized data. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-6834.

References

lists.opensuse.org/opensuse-updates/2017-01/msg00034.html

www.openwall.com/lists/oss-security/2016/12/12/2

www.php.net/ChangeLog-7.php

www.securityfocus.com/bid/94849

access.redhat.com/errata/RHSA-2018:1296

bugs.php.net/bug.php?id=72978

github.com/php/php-src/commit/b2af4e8868726a040234de113436c6e4f6372d17

debiancve 1

nvd 2

ubuntucve 2

redhatcve 1

kaspersky 1

prion 2

osv 3

cve 2

cvelist 1

hackerone 3

openvas 22

veracode 13

zdt 2

exploitdb 3

nessus 38

amazon 4

freebsd 2

archlinux 1

f5 2

securityvulns 4

slackware 1

debian 3

fedora 3

mageia 1

exploitpack 1

packetstorm 1

suse 2

ubuntu 3

redhat 2

ibm 1

gentoo 1

rosalinux 1

debiancve

CVE-2016-9936

2017-01-04 20:59:00

nvd

CVE-2016-9936

2017-01-04 20:59:00

CVE-2015-6834

2016-05-16 10:59:18

ubuntucve

CVE-2016-9936

2017-01-04 00:00:00

CVE-2015-6834

2015-09-09 00:00:00

redhatcve

CVE-2016-9936

2016-12-14 14:47:50

kaspersky

KLA10929 Denial of service vulnerability in PHP

2017-01-04 00:00:00

prion

Design/Logic Flaw

2017-01-04 20:59:00

Design/Logic Flaw

2016-05-16 10:59:00

osv

CVE-2016-9936

2017-01-04 20:59:00

php5 - security update

2015-09-13 00:00:00

php5 - security update

2015-11-08 00:00:00

cve

CVE-2016-9936

2017-01-04 20:59:00

CVE-2015-6834

2016-05-16 10:59:18

cvelist

CVE-2015-6834

2016-05-16 10:00:00

hackerone

Internet Bug Bounty: Use After Free Vulnerability in unserialize() with SplObjectStorage

2015-08-27 00:00:00

Internet Bug Bounty: Use After Free Vulnerability in unserialize()

2015-07-31 00:00:00

Internet Bug Bounty: Use After Free Vulnerability in unserialize() with SplDoublyLinkedList

2015-08-27 00:00:00

openvas

PHP 7.0.x < 7.0.14 DoS Vulnerability - Windows

2021-11-29 00:00:00

PHP 7.0.x < 7.0.14 DoS Vulnerability - Linux

2021-11-29 00:00:00

SUSE: Security Advisory (SUSE-SU-2017:0017-1)

2021-06-09 00:00:00

veracode

Use After Free

2019-05-16 02:59:59

Denial Of Service (DoS)

2019-05-02 05:27:42

Denial Of Service (DoS)

2019-05-02 05:27:43

zdt

PHP 7.0.13 Use After Free unserialize() PoC Exploit

2016-12-13 00:00:00

Kerio Control Unified Threat Management 9.1.0 build 1087 / 9.1.1 build 1324 - Multiple Vulnerabiliti

2016-09-22 00:00:00

exploitdb

PHP 5.4/5.5/5.6 - SplDoublyLinkedList 'Unserialize()' Use-After-Free

2015-09-09 00:00:00

PHP 5.4/5.5/5.6 - SplObjectStorage 'Unserialize()' Use-After-Free

2015-09-09 00:00:00

Kerio Control Unified Threat Management 9.1.0 build 1087/9.1.1 build 1324 - Multiple Vulnerabilities

2016-09-22 00:00:00

nessus

FreeBSD : PHP -- multiple vulnerabilities (6972668d-cdb7-11e6-a9a5-b499baebfeaf)

2017-01-03 00:00:00

PHP 7.0.x < 7.0.14 Multiple Vulnerabilities

2016-12-15 00:00:00

Amazon Linux AMI : php70 (ALAS-2017-788)

2017-01-27 00:00:00

amazon

Medium: php70

2017-01-26 18:00:00

Low: php54

2016-03-16 16:30:00

Medium: php55

2015-10-20 14:52:00

freebsd

PHP -- multiple vulnerabilities

2016-12-08 00:00:00

php -- multiple vulnerabilities

2015-09-03 00:00:00

archlinux

[ASA-201701-28] php: multiple issues

2017-01-19 00:00:00

K17377 : PHP vulnerabilities CVE-2015-6834, CVE-2015-6835, CVE-2015-6836, CVE-2015-6837, and CVE-2015-6838

2015-10-08 00:00:00

SOL17377 - PHP vulnerabilities CVE-2015-6834, CVE-2015-6835, CVE-2015-6836, CVE-2015-6837, and CVE-2015-6838

2015-10-08 00:00:00

securityvulns

PHP multiple security vulnerabilities

2015-09-15 00:00:00

[SECURITY] [DSA 3358-1] php5 security update

2015-09-15 00:00:00

APPLE-SA-2015-10-21-4 OS X El Capitan 10.11.1 and Security Update 2015-007

2015-10-25 00:00:00

slackware

[slackware-security] php

2015-10-01 21:35:28

debian

[SECURITY] [DSA 3358-1] php5 security update

2015-09-13 14:58:00

[SECURITY] [DSA 3358-1] php5 security update

2015-09-13 14:58:00

[SECURITY] [DLA 341-1] php5 security update

2015-11-08 18:51:20

fedora

[SECURITY] Fedora 23 Update: php-5.6.13-1.fc23

2015-09-18 19:33:49

[SECURITY] Fedora 22 Update: php-5.6.13-1.fc22

2015-09-14 23:22:46

[SECURITY] Fedora 21 Update: php-5.6.13-1.fc21

2015-09-14 22:23:26

mageia

Updated php packages fix security vulnerabilities

2015-09-14 00:58:30

exploitpack

Kerio Control Unified Threat Management 9.1.0 build 10879.1.1 build 1324 - Multiple Vulnerabilities

2016-09-22 00:00:00

packetstorm

Kerio Control Unified Threat Management Code Execution / XSS / Memory Corruption

2016-09-22 00:00:00

suse

Security update for php5 (important)

2015-09-25 15:09:56

Security update for php5 (important)

2015-09-25 11:09:46

ubuntu

PHP vulnerabilities

2015-09-30 00:00:00

PHP vulnerabilities

2017-02-23 00:00:00

PHP regression

2017-03-02 00:00:00

redhat

(RHSA-2016:0457) Moderate: rh-php56-php security update

2016-03-15 00:00:00

(RHSA-2018:1296) Moderate: rh-php70-php security, bug fix, and enhancement update

2018-05-03 03:21:11

ibm

Security Bulletin: IBM Tealeaf Customer Experience PCA Web UI PHP security issues

2018-06-16 19:50:01

gentoo

PHP: Multiple vulnerabilities

2016-06-19 00:00:00

rosalinux

Advisory ROSA-SA-2021-1950

2021-07-02 17:57:45

Solutions

Vulnerabilities intelligence
Perimeter control tool
Linux scanner
Windows scanner
Developers SDK
Security Intelligence feeds

Database

Vulnerabilities
Exploits
Security News
BugBounty
Wild Exploited
Top Vulnerabilities
CVE Feed

Resources

Statics & Sources
Plugins
API docs
FAQ
Blog
Glossary

Company

About
Contacts
Pricing
EULA
Privacy Policy
Submission Policy
OpenSource

@2024 Vulners Inc

AI Score

8.8

Confidence

High

EPSS

0.201

Percentile

96.4%

JSON

Related for CVELIST:CVE-2016-9936