Design/Logic Flaw

🗓️ 12 Sep 2016 01:59:00Reported by PRIOn knowledge baseType

PHP versions prior to 5.6.25 and 7.x before 7.0.10 are vulnerable to a design/logic flaw in session handling, allowing remote attackers to inject arbitrary-type session data

Reporter	Title	Published	Views	Family All 139
IBM Security Bulletins	Security Bulletins for IBM Tealeaf Customer Experience offerings	16 Jun 201819:35	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in OpenSSL and PHP affect IBM Tealeaf Customer Experience (CVE-2016-2107, CVE-2016-6290, CVE-2016-7125)	16 Jun 201820:05	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security issues in IBM Tealeaf Customer Experience on Cloud Network Capture Add-On	16 Jun 201820:06	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Flex System Manager (FSM) is affected by multiple php vulnerabilities	18 Jun 201801:34	–	ibm
Tenable Nessus	PHP 5.6.x < 5.6.25 / 7.0.x < 7.0.10 Multiple Vulnerabilities	26 Sep 201600:00	–	nessus
Tenable Nessus	Debian DSA-3689-1 : php5 - security update	10 Oct 201600:00	–	nessus
Tenable Nessus	EulerOS 2.0 SP5 : php (EulerOS-SA-2019-1984)	24 Sep 201900:00	–	nessus
Tenable Nessus	EulerOS 2.0 SP2 : php (EulerOS-SA-2019-2438)	4 Dec 201900:00	–	nessus
Tenable Nessus	EulerOS 2.0 SP3 : php (EulerOS-SA-2019-2649)	18 Dec 201900:00	–	nessus
Tenable Nessus	EulerOS Virtualization 3.0.6.0 : php (EulerOS-SA-2020-1747)	1 Jul 202000:00	–	nessus

Source	Link
php	www.php.net/ChangeLog-7.php
github	www.github.com/php/php-src/commit/8763c6090d627d8bb0ee1d030c30e58f406be9ce
bugs	www.bugs.php.net/bug.php
openwall	www.openwall.com/lists/oss-security/2016/09/02/9
php	www.php.net/ChangeLog-5.php
securityfocus	www.securityfocus.com/bid/92552
security	www.security.gentoo.org/glsa/201611-22
securitytracker	www.securitytracker.com/id/1036680
tenable	www.tenable.com/security/tns-2016-19
rhn	www.rhn.redhat.com/errata/RHSA-2016-2750.html

05 Jan 2018 02:31Current

7.5High risk

Vulners AI Score7.5

EPSS0.0578