CVE-2016-9936

Critical

Published: 04/01/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

The unserialize implementation in PHP 7.x before 7.0.14 allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted serialized data.

Risk Assessment

This vulnerability may lead to serious availability issues for applications and potential unauthorized actions within the system.

Recommendation

It is recommended to upgrade PHP to version 7.0.14 or later to mitigate this vulnerability.

Original NVD description (English source)

The unserialize implementation in ext/standard/var.c in PHP 7.x before 7.0.14 allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted serialized data. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-6834.