CVE-2016-5771
CriticalSummary
In spl_array.c in the SPL extension in PHP before 5.5.37 and 5.6.x before 5.6.23, there is an improper interaction with the unserialize implementation and garbage collection, allowing remote attackers to execute arbitrary code or cause a denial of service via crafted serialized data.
Risk Assessment
This vulnerability may lead to the execution of malicious code on the server or application crashes, posing a serious security threat to the organization.
Recommendation
It is recommended to upgrade PHP to version 5.5.37 or 5.6.23 and later to mitigate the risks associated with this vulnerability.
Original NVD description (English source)
spl_array.c in the SPL extension in PHP before 5.5.37 and 5.6.x before 5.6.23 improperly interacts with the unserialize implementation and garbage collection, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and application crash) via crafted serialized data.