CVE

Id
93944  
CVE No.
CVE-2016-7124  
Status
Candidate  
Description
ext/standard/var_unserializer.c in PHP before 5.6.25 and 7.x before 7.0.10 mishandles certain invalid objects, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted serialized data that leads to a (1) __destruct call or (2) magic method call.  
Phase
Assigned (20160902)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
794908 93944 CVE-2016-7124 MLIST:[oss-security] 20160902 Re: CVE assignment for PHP 5.6.25 and 7.0.10 - and libcurl  View
794909 93944 CVE-2016-7124 URL:http://openwall.com/lists/oss-security/2016/09/02/9  View
794910 93944 CVE-2016-7124 CONFIRM:http://www.php.net/ChangeLog-5.php  View
794911 93944 CVE-2016-7124 CONFIRM:http://www.php.net/ChangeLog-7.php  View
794912 93944 CVE-2016-7124 CONFIRM:https://bugs.php.net/bug.php?id=72663  View
794913 93944 CVE-2016-7124 CONFIRM:https://github.com/php/php-src/commit/20ce2fe8e3c211a42fee05a461a5881be9a8790e?w=1  View
794914 93944 CVE-2016-7124 BID:92756  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
4649 JVNDB-2016-005422 SAP Netweaver における RFC 機能のコールバックの実行を拒否したことを隠蔽される脆弱性 SAP Netweaver は、(1) DUI および (2) DUJ イベントを non-critical として SAP Security Audit Log に不適切にログを作成するため、RFC 機能のコールバックの実行を拒否したことを隠蔽される脆弱性が存在します。 CVE-2016-7437 93944 2.1 3.3 http://jvndb.jvn.jp/ja/contents/2016/JVNDB-2016-005422.html  View