CVE-2016-7417: Input Validation
ext/spl/splarray.c in PHP before 5.6.26 and 7.x before 7.0.11 proceeds with SplArray unserialization without validating a return value and data type, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted serialized data.
Other sources
Fixed bug (Missing type check when unserializing SplArray). (CVE-2016-7417)
— PHP
It was found that the return value is not checked and used on splarraygetdimensionptrptr.
Vulnerable code:
static zval splarraygetdimensionptrptr(int checkinherited, zval object, zval offset, int type TSRMLSDC) / {{{ / { .... HashTable ht = splarraygethashtable(intern, 0 TSRMLSCC); <--- here is no check ht with NULL
}
Upstream bug:
https://bugs.php.net/bug.php?id=73029
Upstream patch:
https://github.com/php/php-src/commit/ecb7f58a069be0dec4a6131b6351a761f808f22e?w=1
CVE assignment:
http://seclists.org/oss-sec/2016/q3/518
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2016-7417?
CVE-2016-7417 is considered a denial of service vulnerability that can potentially impact application availability.
How do I fix CVE-2016-7417?
To mitigate CVE-2016-7417, upgrade your PHP installation to version 5.6.26 or 7.0.11 or later.
Which PHP versions are affected by CVE-2016-7417?
CVE-2016-7417 affects PHP versions prior to 5.6.26 and 7.x before 7.0.11.
What is the impact of CVE-2016-7417?
The impact of CVE-2016-7417 includes potential denial of service for applications using vulnerable PHP versions.
Can CVE-2016-7417 be exploited remotely?
Yes, CVE-2016-7417 can be exploited remotely via crafted serialized data by attackers.