CVE-2016-7124
CriticalSummary
In PHP before 5.6.25 and 7.x before 7.0.10, there is an issue with mishandling certain invalid objects, which may lead to denial of service or other unspecified impacts. Attackers can exploit crafted serialized data, leading to a __destruct call or magic method call.
Risk Assessment
Organizations may be exposed to denial of service attacks, potentially causing application downtime. Additionally, there is a risk of unspecified impacts that could affect system integrity.
Recommendation
It is recommended to upgrade PHP to version 5.6.25 or 7.0.10 and to monitor applications for suspicious serialized data. Implementing additional protective measures against DoS attacks is also advisable.
Original NVD description (English source)
ext/standard/var_unserializer.c in PHP before 5.6.25 and 7.x before 7.0.10 mishandles certain invalid objects, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted serialized data that leads to a (1) __destruct call or (2) magic method call.