KLA10944 Denial of service and arbitrary code execution vulnerabilities in PHP

An improper implementation of the SplObjectStorage unserialize in ext/spl/spl_observer.c was found in PHP before 7.0.12. By exploiting this vulnerability malicious users can execute arbitrary code or cause a denial of service. This vulnerability can be exploited remotely via a specially designed serialized data.

Technical details

Vulnerability occurs because an implementation does not verify whether a key is an object or not.

Original advisories

PHP Bug Tracking System

Related products

PHP

CVE list

CVE-2016-7480 critical

Solution

Update to the latest version

Download PHP

Impacts

• ACE

Arbitrary code execution. Exploitation of vulnerabilities with this impact can lead to executing by abuser any code or commands at vulnerable machine or process.

• DoS

Denial of service. Exploitation of vulnerabilities with this impact can lead to loss of system availability or critical functional fault.

• SB

Security bypass. Exploitation of vulnerabilities with this impact can lead to performing actions restricted by current security settings.

Affected Products

• PHP 7.x before 7.0.12