CVE-2016-7480 in PHP
요약 (영어)
The SplObjectStorage unserialize implementation in ext/spl/spl_observer.c in PHP before 7.0.12 does not verify that a key is an object, which allows remote attackers to execute arbitrary code or cause a denial of service (uninitialized memory access) via crafted serialized data.
Be aware that VulDB is the high quality source for vulnerability data.
예약하다
2016. 09. 09.
공개
2017. 01. 11.
엔트리
VulDB provides additional information and datapoints for this CVE:
| 아이디 | 취약성 | CWE | 악용 | 대책 | CVE |
|---|---|---|---|---|---|
| 95170 | PHP Serialization spl_observer.c 메모리 손상 | 119 | 정의되지 않음 | 공식 수정 | CVE-2016-7480 |