CVE-2016-6295
CriticalSummary
In PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9, there is an improper interaction between the unserialize implementation and garbage collection, which may allow remote attackers to cause a denial of service (use-after-free and application crash) or possibly have unspecified other impact via crafted serialized data.
Risk Assessment
Remote attackers may exploit this vulnerability to cause application crashes, leading to service unavailability. It may also pose other unspecified risks to the system.
Recommendation
It is recommended to upgrade PHP to version 5.5.38, 5.6.24, or 7.0.9 or later to mitigate the risks associated with this vulnerability.
Original NVD description (English source)
ext/snmp/snmp.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 improperly interacts with the unserialize implementation and garbage collection, which allows remote attackers to cause a denial of service (use-after-free and application crash) or possibly have unspecified other impact via crafted serialized data, a related issue to CVE-2016-5773.