CVE-2016-7124: Critical severity php vulnerability
ext/standard/varunserializer.c in PHP before 5.6.25 and 7.x before 7.0.10 mishandles certain invalid objects, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted serialized data that leads to a (1) destruct call or (2) magic method call.
Other sources
Fixed bug (Create an Unexpected Object and Don't Invoke wakeup() in Deserialization). (CVE-2016-7124)
— PHP
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2016-7124?
CVE-2016-7124 is classified as a critical vulnerability that can lead to denial of service.
How do I fix CVE-2016-7124?
To fix CVE-2016-7124, upgrade PHP to version 5.6.25 or higher or to version 7.0.10 or higher.
Which versions of PHP are affected by CVE-2016-7124?
CVE-2016-7124 affects PHP versions prior to 5.6.25 and 7.x prior to 7.0.10.
What impact can CVE-2016-7124 have on my system?
CVE-2016-7124 can allow remote attackers to cause a denial of service or possibly perform unspecified actions by exploiting the vulnerability.
Is CVE-2016-7124 a remote exploit?
Yes, CVE-2016-7124 can be exploited remotely through crafted serialized data.