KLA10928
Denial of service vulnerabilities in PHP
Обновлено: 17/06/2019
Дата обнаружения
04/01/2017
Уровень угрозы
Critical
Описание

Multiple serious vulnerabilities have been found in PHP through 5.6.27 and 7.x through 7.0.12. Malicious users can exploit these vulnerabilities to cause a denial of service. Other unspecified impacts are also possible.

Below is a complete list of vulnerabilities:

  1. Mishandling of property modification during __wakeup processing can be exploited remotely via specially designed serialized data to cause a denial of service;
  2. Use-after-free vulnerability in the CURLFile implementation (ext/curl/curl_file.c) can be exploited remotely via specially designed data mishandled while __wakeup processing to cause a denial of service.
Пораженные продукты

PHP through 5.6.27
PHP 7.x through 7.0.12

Решение

Update to the latest versions
Download PHP

Первичный источник обнаружения
PHP 5 ChangeLog
PHP 7 ChangeLog
Оказываемое влияние
?
DoS 
[?]
Связанные продукты
PHP
CVE-IDS
CVE-2016-91387.5Critical
CVE-2016-91377.5Critical