PT-2017-2450

Name of the Vulnerable Software and Affected Versions PHP versions prior to 5.6.28 PHP versions 7.x prior to 7.0.13 Description The issue is related to the mishandling of property modification during wakeup processing in PHP, allowing remote attackers to cause a denial of service or possibly have...

PT-2017-4174

Name of the Vulnerable Software and Affected Versions PHP versions prior to 5.6.28 PHP versions prior to 7.0.13 Description The issue is related to the Zend/zend exceptions.c component of the PHP interpreter, which can enter an infinite loop. This can be exploited by a remote attacker to cause a...

CVE-2016-6620

An issue was discovered in phpMyAdmin. Some data is passed to the PHP unserialize function without verification that it's valid serialized data. The unserialization can result in code execution because of the interaction with object instantiation and autoloading. All 4.6.x versions prior to 4.6.4...

BP Profile Search <= 4.5.3 - PHP Object Injection

The plugin bp-profile-search insecurely trusts serialized data submitted over HTTP requests. This opens up the site to a PHP object injection vulnerability potential exploit vector. This vulnerability was patched in version 4.6, information is being released now as a disclosure period has expired...

php: Zend/zend_exceptions.c does not validate certain Exception objects

Zend/zendexceptions.c in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 does not validate certain Exception objects, which allows remote attackers to cause a denial of service NULL pointer dereference and application crash or trigger unintended method execution via crafted...

php: Use After Free Vulnerability in PHP's GC algorithm and unserialize

splarray.c in the SPL extension in PHP before 5.5.37 and 5.6.x before 5.6.23 improperly interacts with the unserialize implementation and garbage collection, which allows remote attackers to execute arbitrary code or cause a denial of service use-after-free and application crash via crafted...

CVE-2016-9137

Use-after-free vulnerability in the CURLFile implementation in ext/curl/curlfile.c in PHP before 5.6.27 and 7.x before 7.0.12 allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted serialized data that is mishandled during wakeup processing...

PT-2017-2451

Name of the Vulnerable Software and Affected Versions PHP versions prior to 5.6.27 PHP versions 7.x prior to 7.0.12 Description The issue is related to a use-after-free vulnerability in the CURLFile implementation. This vulnerability can be exploited by remote attackers using crafted serialized...

Deserialization of untrusted data

CoreResponseStateManager in Apache MyFaces Trinidad 1.0.0 through 1.0.13, 1.2.x before 1.2.15, 2.0.x before 2.0.2, and 2.1.x before 2.1.2 might allow attackers to conduct deserialization attacks via a crafted serialized view state string...

CVE-2016-7417

ext/spl/splarray.c in PHP before 5.6.26 and 7.x before 7.0.11 proceeds with SplArray unserialization without validating a return value and data type, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted serialized data...

Authentication flaw

ext/spl/splarray.c in PHP before 5.6.26 and 7.x before 7.0.11 proceeds with SplArray unserialization without validating a return value and data type, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted serialized data...

CVE-2016-7417

ext/spl/splarray.c in PHP before 5.6.26 and 7.x before 7.0.11 proceeds with SplArray unserialization without validating a return value and data type, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted serialized data...

CVE-2016-7417: Improper Input Validation

ext/spl/splarray.c in PHP before 5.6.26 and 7.x before 7.0.11 proceeds with SplArray unserialization without validating a return value and data type, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted serialized data...

PT-2016-3378

Name of the Vulnerable Software and Affected Versions PHP versions prior to 5.6.26 PHP versions 7.x prior to 7.0.11 Description The issue arises from insufficient input validation in the ext/spl/spl array.c component of the PHP interpreter. This allows remote attackers to cause a denial of servic...

CVE-2016-7124

ext/standard/varunserializer.c in PHP before 5.6.25 and 7.x before 7.0.10 mishandles certain invalid objects, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted serialized data that leads to a 1 destruct call or 2 magic method call...

CVE-2016-7124

ext/standard/varunserializer.c in PHP before 5.6.25 and 7.x before 7.0.10 mishandles certain invalid objects, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted serialized data that leads to a 1 destruct call or 2 magic method call...

CVE-2016-7124

ext/standard/varunserializer.c in PHP before 5.6.25 and 7.x before 7.0.10 mishandles certain invalid objects, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted serialized data that leads to a 1 destruct call or 2 magic method call...

CVE-2016-7124

Removed by vendor...

PT-2016-3374

Name of the Vulnerable Software and Affected Versions PHP versions prior to 5.6.25 PHP versions 7.x prior to 7.0.10 Description The issue is related to the ext/standard/var unserializer.c component in PHP, which mishandles certain invalid objects. This can be exploited by remote attackers using...

Malware Information Sharing Platform PHP Object Injection Vulnerability

The Malware Information Sharing Platform MISP is an open source software solution for collecting, storing, distributing and sharing cybersecurity metrics and analyzing cybersecurity events and malware. A PHP object injection vulnerability exists in versions of MISP prior to 2.3.90. A remote...