CVE-2016-7478

High

Published: 11/01/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

In PHP, in the zend_exceptions.c file, there is a vulnerability that allows remote attackers to cause a denial of service (infinite loop) via a crafted Exception object in serialized data. This affects versions 5.x before 5.6.28 and 7.x before 7.0.13.

Risk Assessment

This vulnerability can lead to significant disruptions in application operation, potentially resulting in downtime and loss of service availability.

Recommendation

It is recommended to upgrade PHP to version 5.6.28 or 7.0.13 and to monitor applications for suspicious serialized data.

Other vulnerabilities in PHP zend_exceptions.c

CVE-2015-8873High
CVE-2015-8873 describes a stack consumption vulnerability in zend_exceptions.c in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12. This allows remote attackers to cause a segmentation fault via recursive method calls.

Original NVD description (English source)

Zend/zend_exceptions.c in PHP, possibly 5.x before 5.6.28 and 7.x before 7.0.13, allows remote attackers to cause a denial of service (infinite loop) via a crafted Exception object in serialized data, a related issue to CVE-2015-8876.