CVE-2016-7480: Buffer Overflow
The SplObjectStorage unserialize implementation in ext/spl/splobserver.c in PHP before 7.0.12 does not verify that a key is an object, which allows remote attackers to execute arbitrary code or cause a denial of service (uninitialized memory access) via crafted serialized data.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2016-7480?
CVE-2016-7480 is considered a critical vulnerability due to its potential for remote code execution and denial of service.
How do I fix CVE-2016-7480?
To mitigate CVE-2016-7480, update PHP to version 7.0.12 or later.
What versions of PHP are affected by CVE-2016-7480?
CVE-2016-7480 affects PHP versions before 7.0.12, including all versions from 7.0.0 to 7.0.11.
Can CVE-2016-7480 be exploited remotely?
Yes, CVE-2016-7480 can be exploited remotely through crafted serialized data.
What kind of attacks can CVE-2016-7480 allow?
CVE-2016-7480 can lead to arbitrary code execution or result in denial of service due to uninitialized memory access.