CVE-2016-5771: Use After Free
splarray.c in the SPL extension in PHP before 5.5.37 and 5.6.x before 5.6.23 improperly interacts with the unserialize implementation and garbage collection, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and application crash) via crafted serialized data.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2016-5771?
The severity of CVE-2016-5771 is considered critical due to the potential for remote code execution and denial of service.
How do I fix CVE-2016-5771?
To fix CVE-2016-5771, upgrade to PHP version 5.5.37, 5.6.23 or later, or apply the relevant patches to affected software.
Which PHP versions are affected by CVE-2016-5771?
CVE-2016-5771 affects PHP versions prior to 5.5.37 and versions between 5.6.0 and 5.6.23, as well as certain 7.0.x versions before 7.0.8.
Can CVE-2016-5771 be exploited remotely?
Yes, CVE-2016-5771 can be exploited remotely by attackers to execute arbitrary code via crafted serialized data.
What are the potential impacts of CVE-2016-5771?
The potential impacts of CVE-2016-5771 include arbitrary code execution and application crashes due to use-after-free vulnerabilities.