Denial of service and arbitrary code execution vulnerabilities in PHP

Описание

An improper implementation of the SplObjectStorage unserialize in ext/spl/spl_observer.c was found in PHP before 7.0.12. By exploiting this vulnerability malicious users can execute arbitrary code or cause a denial of service. This vulnerability can be exploited remotely via a specially designed serialized data.

---

Technical details

Vulnerability occurs because an implementation does not verify whether a key is an object or not.

Первичный источник обнаружения

• PHP Bug Tracking System
  

Связанные продукты

• PHP

Список CVE

• CVE-2016-7480
  critical

Смотрите также

Узнай статистику распространения уязвимостей в своем регионе statistics.securelist.com