CVE-2016-7480
CriticalSummary
The SplObjectStorage unserialize implementation in PHP before 7.0.12 does not verify that a key is an object, allowing remote attackers to execute arbitrary code or cause a denial of service via crafted serialized data.
Risk Assessment
An attacker could exploit this vulnerability to execute malicious code on the server or cause application crashes, potentially leading to service unavailability.
Recommendation
It is recommended to upgrade PHP to version 7.0.12 or later to mitigate this vulnerability.
Original NVD description (English source)
The SplObjectStorage unserialize implementation in ext/spl/spl_observer.c in PHP before 7.0.12 does not verify that a key is an object, which allows remote attackers to execute arbitrary code or cause a denial of service (uninitialized memory access) via crafted serialized data.