NVD

Id
21873  
Name
CVE-2016-7480  
Description
The SplObjectStorage unserialize implementation in ext/spl/spl_observer.c in PHP before 7.0.12 does not verify that a key is an object, which allows remote attackers to execute arbitrary code or cause a denial of service (uninitialized memory access) via crafted serialized data.  
Reject
 
CVSS Version
2  
CVSS Score
7.5  
Severity
High  
CVSS Base Score
7.5  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-19  
Published
2017-01-11  
Modified Date
2017-01-12  
Seq
2016-7480  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
117253 21873 CVE-2016-7480 http://blog.checkpoint.com/2016/12/27/check-point-discovers-three-zero-day-vulnerabilities-web-programming-language-php-7  View
117254 21873 CVE-2016-7480 http://blog.checkpoint.com/wp-content/uploads/2016/12/PHP_Technical_Report.pdf  View
117255 21873 CVE-2016-7480 http://php.net/ChangeLog-7.php  View
117256 21873 CVE-2016-7480 95152  View
117257 21873 CVE-2016-7480 https://bugs.php.net/bug.php?id=73257  View
117258 21873 CVE-2016-7480 https://github.com/php/php-src/commit/61cdd1255d5b9c8453be71aacbbf682796ac77d4  View
117259 21873 CVE-2016-7480 https://www.youtube.com/watch?v=LDcaPstAuPk  View

Related JVN