CVE-2016-7125: High severity php vulnerability
ext/session/session.c in PHP before 5.6.25 and 7.x before 7.0.10 skips invalid session names in a way that triggers incorrect parsing, which allows remote attackers to inject arbitrary-type session data by leveraging control of a session name, as demonstrated by object injection.
Other sources
Fixed bug (PHP Session Data Injection Vulnerability). (CVE-2016-7125)
— PHP
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2016-7125?
The CVE-2016-7125 vulnerability is considered to be of high severity due to its potential for remote code execution through session data injection.
How do I fix CVE-2016-7125?
To fix CVE-2016-7125, upgrade your PHP version to 5.6.25 or later, or 7.0.10 or later.
What versions of PHP are affected by CVE-2016-7125?
CVE-2016-7125 affects PHP versions prior to 5.6.25 and 7.x versions before 7.0.10.
What type of attacks can CVE-2016-7125 lead to?
CVE-2016-7125 can lead to arbitrary session data injection attacks when an attacker controls the session name.
Is there a specific type of data that can be injected due to CVE-2016-7125?
Yes, CVE-2016-7125 allows remote attackers to inject arbitrary-type session data, including objects.