CVE-2016-7479

9.8 CRITICAL

Published: January 12, 2017 Modified: May 06, 2026

Description

In all versions of PHP 7, during the unserialization process, resizing the 'properties' hash table of a serialized object may lead to use-after-free. A remote attacker may exploit this bug to gain arbitrary code execution.

AI Explanation

Get an AI-powered plain-language explanation of this vulnerability and remediation steps.

CVSS v3.x Details

0.0 Low Medium High Critical 10.0

Vector String

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References to Advisories, Solutions, and Tools

Patch Vendor Advisory Exploit Third Party Advisory

http://blog.checkpoint.com/2016/12/27/check-point-discovers-three-zero-day-vulnerabilities-web-programming-language-php-7

Source: cve@checkpoint.com

Third Party Advisory

http://blog.checkpoint.com/wp-content/uploads/2016/12/PHP_Technical_Report.pdf

Source: cve@checkpoint.com

Exploit Technical Description Third Party Advisory

http://www.securityfocus.com/bid/95151

Source: cve@checkpoint.com

Third Party Advisory VDB Entry

http://www.securitytracker.com/id/1037659

Source: cve@checkpoint.com

https://access.redhat.com/errata/RHSA-2018:1296

Source: cve@checkpoint.com

https://bugs.php.net/bug.php?id=73092

Source: cve@checkpoint.com

Issue Tracking Permissions Required

https://security.netapp.com/advisory/ntap-20180112-0001/

Source: cve@checkpoint.com

https://www.youtube.com/watch?v=LDcaPstAuPk

Source: cve@checkpoint.com

Technical Description

http://blog.checkpoint.com/2016/12/27/check-point-discovers-three-zero-day-vulnerabilities-web-programming-language-php-7