CVE-2016-9936

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The unserialize implementation in ext/standard/var.c in PHP 7.x before 7.0.14 allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted serialized data. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-6834.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.opensuse.org/opensuse-updates/2017-01/msg00034.html
http://www.openwall.com/lists/oss-security/2016/12/12/2Mailing List
http://www.php.net/ChangeLog-7.phpPatch, Release Notes
http://www.securityfocus.com/bid/94849
https://access.redhat.com/errata/RHSA-2018:1296
https://bugs.php.net/bug.php?id=72978Exploit, Issue Tracking
https://github.com/php/php-src/commit/b2af4e8868726a040234de113436c6e4f6372d17Patch
http://lists.opensuse.org/opensuse-updates/2017-01/msg00034.html
http://www.openwall.com/lists/oss-security/2016/12/12/2Mailing List
http://www.php.net/ChangeLog-7.phpPatch, Release Notes
http://www.securityfocus.com/bid/94849
https://access.redhat.com/errata/RHSA-2018:1296
https://bugs.php.net/bug.php?id=72978Exploit, Issue Tracking
https://github.com/php/php-src/commit/b2af4e8868726a040234de113436c6e4f6372d17Patch

Timeline

Published: Jan 4, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-99377.5An issue was discovered in Asterisk Open Source 13.12.x and 13.13.x before 13.13.1 and 14.x before 14.2.1. If an SDP offer or answer is rece CVE-2016-99385.3An issue was discovered in Asterisk Open Source 11.x before 11.25.1, 13.x before 13.13.1, and 14.x before 14.2.1 and Certified Asterisk 11.x CVE-2016-99397.5Crypto++ (aka cryptopp and libcrypto++) 5.6.4 contained a bug in its ASN.1 BER decoding routine. The library will allocate a memory block ba CVE-2016-99419.8Heap-based buffer overflow in rfbproto.c in LibVNCClient in LibVNCServer before 0.9.11 allows remote servers to cause a denial of service (a CVE-2016-99429.8Heap-based buffer overflow in ultra.c in LibVNCClient in LibVNCServer before 0.9.11 allows remote servers to cause a denial of service (appl CVE-2016-99497.8An issue was discovered in Apport before 2.20.4. In apport/ui.py, Apport reads the CrashDB field and it then evaluates the field as Python c CVE-2016-99507.8An issue was discovered in Apport before 2.20.4. There is a path traversal issue in the Apport crash file "Package" and "SourcePackage" fiel CVE-2016-99516.5An issue was discovered in Apport before 2.20.4. A malicious Apport crash file can contain a restart command in `RespawnCommand` or `ProcCmd CVE-2016-99528.1The verify_certificate function in lib/vtls/schannel.c in libcurl 7.30.0 through 7.51.0, when built for Windows CE using the schannel TLS ba CVE-2016-99539.8The verify_certificate function in lib/vtls/schannel.c in libcurl 7.30.0 through 7.51.0, when built for Windows CE using the schannel TLS ba CVE-2016-99547.5The backtrack compilation code in the Irregex package (aka IrRegular Expressions) before 0.9.6 for Scheme allows remote attackers to cause a CVE-2016-99556.3The SimpleSAML_XML_Validator class constructor in SimpleSAMLphp before 1.14.11 might allow remote attackers to spoof signatures on SAML 1 re