CVE-2016-6295: Use After Free
ext/snmp/snmp.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 improperly interacts with the unserialize implementation and garbage collection, which allows remote attackers to cause a denial of service (use-after-free and application crash) or possibly have unspecified other impact via crafted serialized data, a related issue to CVE-2016-5773.
Other sources
Fixed bug (Use After Free Vulnerability in SNMP with GC and unserialize()). (CVE-2016-6295)
— PHP
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2016-6295?
CVE-2016-6295 has been classified as a denial of service vulnerability due to a use-after-free issue that can lead to application crashes.
How do I fix CVE-2016-6295?
To mitigate CVE-2016-6295, upgrade your PHP version to 5.5.38, 5.6.24, or 7.0.9 or later.
Which versions of PHP are affected by CVE-2016-6295?
CVE-2016-6295 affects PHP versions prior to 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9.
What types of attacks can result from CVE-2016-6295?
CVE-2016-6295 can be exploited by remote attackers to cause denial of service through application crashes.
Is CVE-2016-6295 exploitable in production environments?
Yes, CVE-2016-6295 can be exploited in production environments if vulnerable versions of PHP are used.