KLA10928 Denial of service vulnerabilities in PHP

Multiple serious vulnerabilities have been found in PHP through 5.6.27 and 7.x through 7.0.12. Malicious users can exploit these vulnerabilities to cause a denial of service. Other unspecified impacts are also possible.

Below is a complete list of vulnerabilities:

1. Mishandling of property modification during __wakeup processing can be exploited remotely via specially designed serialized data to cause a denial of service;
2. Use-after-free vulnerability in the CURLFile implementation (ext/curl/curl_file.c) can be exploited remotely via specially designed data mishandled while __wakeup processing to cause a denial of service.

Original advisories

PHP 5 ChangeLog

PHP 7 ChangeLog

Related products

PHP

CVE list

CVE-2016-9138 critical

CVE-2016-9137 critical

Solution

Update to the latest versions

Download PHP

Impacts

• DoS

Denial of service. Exploitation of vulnerabilities with this impact can lead to loss of system availability or critical functional fault.

• SB

Security bypass. Exploitation of vulnerabilities with this impact can lead to performing actions restricted by current security settings.

Affected Products

• PHP through 5.6.27PHP 7.x through 7.0.12